From 85e93a165aa21f7796de4f38e2be7c07a232d0eb Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 2 Sep 2026 14:03:14 +0200
Subject: [PATCH 001/202] test: bump WPT webidl and interfaces

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65679
Refs: https://github.com/nodejs/node/issues/63579
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/fixtures/wpt/interfaces/FileAPI.idl      |   1 +
 test/fixtures/wpt/interfaces/compression.idl  |   1 +
 test/fixtures/wpt/interfaces/dom.idl          |  18 ++-
 test/fixtures/wpt/interfaces/html.idl         | 106 ++++++++++++++++--
 .../wpt/interfaces/resource-timing.idl        |   9 +-
 test/fixtures/wpt/interfaces/streams.idl      |   4 +-
 test/fixtures/wpt/interfaces/web-locks.idl    |   4 +-
 .../wpt/interfaces/webcrypto-modern-algos.idl |   6 +-
 test/fixtures/wpt/interfaces/webcrypto.idl    |   8 +-
 test/fixtures/wpt/versions.json               |   4 +-
 .../allow-shared.https.html                   |  29 +++++
 .../DOMException-constants.any.js             |   2 +-
 ...Exception-constructor-and-prototype.any.js |   2 +-
 .../DOMException-constructor-behavior.any.js  |   2 +-
 .../DOMException-custom-bindings.any.js       |   2 +-
 .../DOMException-is-error.any.js              |   2 +-
 .../DOMException-stack-accessor.any.js        |  80 +++++++++++++
 .../global-mutable-prototype.any.js           |  27 -----
 test/fixtures/wpt/webidl/idlharness.any.js    |   2 +-
 test/wpt/status/webidl.json                   |  12 ++
 20 files changed, 255 insertions(+), 66 deletions(-)
 create mode 100644 test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
 create mode 100644 test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
 delete mode 100644 test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js

diff --git a/test/fixtures/wpt/interfaces/FileAPI.idl b/test/fixtures/wpt/interfaces/FileAPI.idl
index 49219fce277f..4a711a684459 100644
--- a/test/fixtures/wpt/interfaces/FileAPI.idl
+++ b/test/fixtures/wpt/interfaces/FileAPI.idl
@@ -20,6 +20,7 @@ interface Blob {
   [NewObject] ReadableStream stream();
   [NewObject] Promise<USVString> text();
   [NewObject] Promise<ArrayBuffer> arrayBuffer();
+  [NewObject] ReadableStream textStream();
   [NewObject] Promise<Uint8Array> bytes();
 };
 
diff --git a/test/fixtures/wpt/interfaces/compression.idl b/test/fixtures/wpt/interfaces/compression.idl
index defe4ba55cdf..6e44b4ad6dd9 100644
--- a/test/fixtures/wpt/interfaces/compression.idl
+++ b/test/fixtures/wpt/interfaces/compression.idl
@@ -4,6 +4,7 @@
 // Source: Compression Standard (https://compression.spec.whatwg.org/)
 
 enum CompressionFormat {
+  "brotli",
   "deflate",
   "deflate-raw",
   "gzip",
diff --git a/test/fixtures/wpt/interfaces/dom.idl b/test/fixtures/wpt/interfaces/dom.idl
index 1ddc084b949d..f61580f43a90 100644
--- a/test/fixtures/wpt/interfaces/dom.idl
+++ b/test/fixtures/wpt/interfaces/dom.idl
@@ -328,7 +328,7 @@ interface DOMImplementation {
   [NewObject] XMLDocument createDocument(DOMString? namespace, [LegacyNullToEmptyString] DOMString qualifiedName, optional DocumentType? doctype = null);
   [NewObject] Document createHTMLDocument(optional DOMString title);
 
-  boolean hasFeature(); // useless; always returns true
+  boolean hasFeature(); // historical; always returns true
 };
 
 [Exposed=Window]
@@ -347,9 +347,9 @@ interface DocumentFragment : Node {
 interface ShadowRoot : DocumentFragment {
   readonly attribute ShadowRootMode mode;
   readonly attribute boolean delegatesFocus;
+  readonly attribute boolean serializable;
   readonly attribute SlotAssignmentMode slotAssignment;
   readonly attribute boolean clonable;
-  readonly attribute boolean serializable;
   readonly attribute Element host;
 
   attribute EventHandler onslotchange;
@@ -409,9 +409,9 @@ interface Element : Node {
 dictionary ShadowRootInit {
   required ShadowRootMode mode;
   boolean delegatesFocus = false;
+  boolean serializable = false;
   SlotAssignmentMode slotAssignment = "named";
   boolean clonable = false;
-  boolean serializable = false;
   CustomElementRegistry? customElementRegistry;
 };
 
@@ -438,7 +438,7 @@ interface Attr : Node {
 
   readonly attribute Element? ownerElement;
 
-  readonly attribute boolean specified; // useless; always returns true
+  readonly attribute boolean specified; // historical; always returns true
 };
 [Exposed=Window]
 interface CharacterData : Node {
@@ -464,7 +464,17 @@ interface CDATASection : Text {
 };
 [Exposed=Window]
 interface ProcessingInstruction : CharacterData {
+  constructor(DOMString target, optional DOMString data = "");
+
   readonly attribute DOMString target;
+
+  boolean hasAttributes();
+  sequence<DOMString> getAttributeNames();
+  DOMString? getAttribute(DOMString name);
+  undefined setAttribute(DOMString name, DOMString value);
+  undefined removeAttribute(DOMString name);
+  boolean toggleAttribute(DOMString name, optional boolean force);
+  boolean hasAttribute(DOMString name);
 };
 [Exposed=Window]
 interface Comment : CharacterData {
diff --git a/test/fixtures/wpt/interfaces/html.idl b/test/fixtures/wpt/interfaces/html.idl
index 567e5a79a36a..e5ce24af481a 100644
--- a/test/fixtures/wpt/interfaces/html.idl
+++ b/test/fixtures/wpt/interfaces/html.idl
@@ -48,7 +48,8 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
 
 [LegacyOverrideBuiltIns]
 partial interface Document {
-  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html);
+  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html, optional ParseHTMLUnsafeOptions options = {});
+  static Document parseHTML(DOMString html, optional SetHTMLOptions options = {});
 
   // resource metadata management
   [PutForwards=href, LegacyUnforgeable] readonly attribute Location? location;
@@ -152,14 +153,14 @@ dictionary TogglePopoverOptions : ShowPopoverOptions {
 
 HTMLElement includes GlobalEventHandlers;
 HTMLElement includes ElementContentEditable;
-HTMLElement includes HTMLOrSVGElement;
+HTMLElement includes HTMLOrSVGOrMathMLElement;
 
 [Exposed=Window]
 interface HTMLUnknownElement : HTMLElement {
   // Note: intentionally no [HTMLConstructor]
 };
 
-interface mixin HTMLOrSVGElement {
+interface mixin HTMLOrSVGOrMathMLElement {
   [SameObject] readonly attribute DOMStringMap dataset;
   attribute DOMString nonce; // intentionally no [CEReactions]
 
@@ -349,13 +350,10 @@ interface HTMLDivElement : HTMLElement {
 interface HTMLAnchorElement : HTMLElement {
   [HTMLConstructor] constructor();
 
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
   [SameObject, PutForwards=value, Reflect="rel"] readonly attribute DOMTokenList relList;
-  [CEReactions, Reflect] attribute DOMString hreflang;
-  [CEReactions, Reflect] attribute DOMString type;
 
   [CEReactions] attribute DOMString text;
 
@@ -403,10 +401,14 @@ interface mixin HyperlinkElementUtils {
   [CEReactions] attribute USVString pathname;
   [CEReactions] attribute USVString search;
   [CEReactions] attribute USVString hash;
+
+  [CEReactions, Reflect] attribute DOMString hreflang;
+  [CEReactions, Reflect] attribute DOMString type;
 };
 
 interface mixin HTMLHyperlinkElementUtils {
   [CEReactions, ReflectSetter] stringifier attribute USVString href;
+  [CEReactions, Reflect] attribute DOMString target;
 };
 
 [Exposed=Window]
@@ -447,6 +449,7 @@ interface HTMLImageElement : HTMLElement {
   [CEReactions] attribute DOMString? crossOrigin;
   [CEReactions, Reflect] attribute DOMString useMap;
   [CEReactions, Reflect] attribute boolean isMap;
+  [CEReactions, Reflect] attribute boolean controls;
   [CEReactions, ReflectSetter] attribute unsigned long width;
   [CEReactions, ReflectSetter] attribute unsigned long height;
   readonly attribute unsigned long naturalWidth;
@@ -531,6 +534,7 @@ interface HTMLVideoElement : HTMLMediaElement {
   readonly attribute unsigned long videoHeight;
   [CEReactions, ReflectURL] attribute USVString poster;
   [CEReactions, Reflect] attribute boolean playsInline;
+
 };
 
 [Exposed=Window,
@@ -613,6 +617,7 @@ interface HTMLMediaElement : HTMLElement {
   attribute double volume;
   attribute boolean muted;
   [CEReactions, Reflect="muted"] attribute boolean defaultMuted;
+  [CEReactions] attribute DOMString loading;
 
   // tracks
   [SameObject] readonly attribute AudioTrackList audioTracks;
@@ -760,7 +765,6 @@ interface HTMLAreaElement : HTMLElement {
   [CEReactions, Reflect] attribute DOMString alt;
   [CEReactions, Reflect] attribute DOMString coords;
   [CEReactions, Reflect] attribute DOMString shape;
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
@@ -966,7 +970,7 @@ interface HTMLButtonElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   [CEReactions, ReflectSetter] attribute DOMString command;
-  [CEReactions, Reflect] attribute Element? commandForElement;
+  [CEReactions, Reflect="commandfor"] attribute Element? commandForElement;
   [CEReactions, Reflect] attribute boolean disabled;
   readonly attribute HTMLFormElement? form;
   [CEReactions, ReflectSetter] attribute USVString formAction;
@@ -1271,10 +1275,12 @@ interface HTMLTemplateElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   readonly attribute DocumentFragment content;
+  [CEReactions, Reflect="for"] attribute DOMString htmlFor;
   [CEReactions] attribute DOMString shadowRootMode;
   [CEReactions, Reflect] attribute boolean shadowRootDelegatesFocus;
-  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute boolean shadowRootSerializable;
+  [CEReactions] attribute DOMString shadowRootSlotAssignment;
+  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute DOMString shadowRootCustomElementRegistry;
 };
 
@@ -1808,7 +1814,7 @@ dictionary DragEventInit : MouseEventInit {
 };
 
 interface mixin PopoverTargetAttributes {
-  [CEReactions, Reflect] attribute Element? popoverTargetElement;
+  [CEReactions, Reflect="popovertarget"] attribute Element? popoverTargetElement;
   [CEReactions] attribute DOMString popoverTargetAction;
 };
 
@@ -2357,7 +2363,8 @@ Window includes WindowOrWorkerGlobalScope;
 WorkerGlobalScope includes WindowOrWorkerGlobalScope;
 
 partial interface Element {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
@@ -2366,12 +2373,25 @@ partial interface Element {
 };
 
 partial interface ShadowRoot {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
 };
 
+enum SanitizerPresets { "default" };
+dictionary SetHTMLOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
+};
+dictionary SetHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+  boolean runScripts = false;
+};
+dictionary ParseHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+};
+
 dictionary GetHTMLOptions {
   boolean serializableShadowRoots = false;
   sequence<ShadowRoot> shadowRoots = [];
@@ -2403,6 +2423,68 @@ interface XMLSerializer {
   DOMString serializeToString(Node root);
 };
 
+[Exposed=Window]
+interface Sanitizer {
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");
+
+  // Query configuration:
+  SanitizerConfig get();
+
+  // Modify a Sanitizer's lists and fields:
+  boolean allowElement(SanitizerElementWithAttributes element);
+  boolean removeElement(SanitizerElement element);
+  boolean replaceElementWithChildren(SanitizerElement element);
+  boolean allowProcessingInstruction(SanitizerPI pi);
+  boolean removeProcessingInstruction(SanitizerPI pi);
+  boolean allowAttribute(SanitizerAttribute attribute);
+  boolean removeAttribute(SanitizerAttribute attribute);
+  boolean setComments(boolean allow);
+  boolean setDataAttributes(boolean allow);
+
+  // Remove markup that executes script.
+  boolean removeUnsafe();
+};
+
+dictionary SanitizerElementNamespace {
+  required DOMString name;
+  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
+};
+
+// Used by "elements"
+dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+};
+
+dictionary SanitizerAttributeNamespace {
+  required DOMString name;
+  DOMString? _namespace = null;
+};
+
+dictionary SanitizerProcessingInstruction {
+  required DOMString target;
+};
+
+typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
+typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
+typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
+typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;
+
+dictionary SanitizerConfig {
+  sequence<SanitizerElementWithAttributes> elements;
+  sequence<SanitizerElement> removeElements;
+  sequence<SanitizerElement> replaceWithChildrenElements;
+
+  sequence<SanitizerPI> processingInstructions;
+  sequence<SanitizerPI> removeProcessingInstructions;
+
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+
+  boolean comments;
+  boolean dataAttributes;
+};
+
 [Exposed=Window]
 interface Navigator {
   // objects implementing this interface also implement the interfaces given below
diff --git a/test/fixtures/wpt/interfaces/resource-timing.idl b/test/fixtures/wpt/interfaces/resource-timing.idl
index ba8e3953b497..1391b09022e1 100644
--- a/test/fixtures/wpt/interfaces/resource-timing.idl
+++ b/test/fixtures/wpt/interfaces/resource-timing.idl
@@ -41,7 +41,8 @@ enum RenderBlockingStatusType {
     "non-blocking"
 };
 
-partial interface Performance {  undefined clearResourceTimings ();
-  undefined setResourceTimingBufferSize (unsigned long maxSize);
-  attribute EventHandler onresourcetimingbufferfull;
-};
+partial interface Performance {
+      undefined clearResourceTimings ();
+      undefined setResourceTimingBufferSize (unsigned long maxSize);
+      attribute EventHandler onresourcetimingbufferfull;
+    };
diff --git a/test/fixtures/wpt/interfaces/streams.idl b/test/fixtures/wpt/interfaces/streams.idl
index 8abc8f5cfda9..a0de8b89aa46 100644
--- a/test/fixtures/wpt/interfaces/streams.idl
+++ b/test/fixtures/wpt/interfaces/streams.idl
@@ -7,7 +7,7 @@
 interface ReadableStream {
   constructor(optional object underlyingSource, optional QueuingStrategy strategy = {});
 
-  static ReadableStream from(any asyncIterable);
+  static ReadableStream from(async_sequence<any> asyncIterable);
 
   readonly attribute boolean locked;
 
@@ -114,7 +114,7 @@ interface ReadableByteStreamController {
 
 [Exposed=*]
 interface ReadableStreamBYOBRequest {
-  readonly attribute ArrayBufferView? view;
+  readonly attribute Uint8Array? view;
 
   undefined respond([EnforceRange] unsigned long long bytesWritten);
   undefined respondWithNewView(ArrayBufferView view);
diff --git a/test/fixtures/wpt/interfaces/web-locks.idl b/test/fixtures/wpt/interfaces/web-locks.idl
index 00648cc3b1e5..d79e404b983f 100644
--- a/test/fixtures/wpt/interfaces/web-locks.idl
+++ b/test/fixtures/wpt/interfaces/web-locks.idl
@@ -10,7 +10,7 @@ interface mixin NavigatorLocks {
 Navigator includes NavigatorLocks;
 WorkerNavigator includes NavigatorLocks;
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface LockManager {
   Promise<any> request(DOMString name,
                        LockGrantedCallback callback);
@@ -43,7 +43,7 @@ dictionary LockInfo {
   DOMString clientId;
 };
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface Lock {
   readonly attribute DOMString name;
   readonly attribute LockMode mode;
diff --git a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
index aeb1d650b7d7..00df80f74ccf 100644
--- a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
@@ -38,7 +38,7 @@ partial interface SubtleCrypto {
 
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
-                   optional unsigned long? length = null);
+                   optional [EnforceRange] unsigned long? length = null);
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
                    AlgorithmIdentifier additionalAlgorithm);
@@ -59,7 +59,7 @@ dictionary EncapsulatedBits {
 };
 
 partial dictionary JsonWebKey {
-  // The following fields are defined in draft-ietf-cose-dilithium-08
+  // The following fields are defined in RFC 9964
   DOMString pub;
   DOMString priv;
 };
@@ -99,7 +99,7 @@ dictionary KmacImportParams : Algorithm {
 };
 
 dictionary KmacKeyAlgorithm : KeyAlgorithm {
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary KmacParams : Algorithm {
diff --git a/test/fixtures/wpt/interfaces/webcrypto.idl b/test/fixtures/wpt/interfaces/webcrypto.idl
index ebb9cf5718b9..7599a1a994aa 100644
--- a/test/fixtures/wpt/interfaces/webcrypto.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto.idl
@@ -79,7 +79,7 @@ interface SubtleCrypto {
   Promise<ArrayBuffer> deriveBits(
     AlgorithmIdentifier algorithm,
     CryptoKey baseKey,
-    optional unsigned long? length = null
+    optional [EnforceRange] unsigned long? length = null
   );
 
   Promise<CryptoKey> importKey(
@@ -161,7 +161,7 @@ dictionary RsaHashedKeyGenParams : RsaKeyGenParams {
 };
 
 dictionary RsaKeyAlgorithm : KeyAlgorithm {
-  required unsigned long modulusLength;
+  required [EnforceRange] unsigned long modulusLength;
   required BigInteger publicExponent;
 };
 
@@ -209,7 +209,7 @@ dictionary AesCtrParams : Algorithm {
 };
 
 dictionary AesKeyAlgorithm : KeyAlgorithm {
-  required unsigned short length;
+  required [EnforceRange] unsigned short length;
 };
 
 dictionary AesKeyGenParams : Algorithm {
@@ -237,7 +237,7 @@ dictionary HmacImportParams : Algorithm {
 
 dictionary HmacKeyAlgorithm : KeyAlgorithm {
   required KeyAlgorithm hash;
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary HmacKeyGenParams : Algorithm {
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index 2481ba0cee5d..fa3732a0e9fd 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -52,7 +52,7 @@
     "path": "html/webappapis/timers"
   },
   "interfaces": {
-    "commit": "a8392bd0210378dda13278eeccf2c2602278e214",
+    "commit": "3f15e5c09448b8e917c9128d3b07cc78f044c83a",
     "path": "interfaces"
   },
   "performance-timeline": {
@@ -104,7 +104,7 @@
     "path": "WebCryptoAPI"
   },
   "webidl": {
-    "commit": "63ca529a021fec15b2996db82fd7dd04c11abe85",
+    "commit": "65bbe07908e5c19e8a6c7ff8701cc2a722cd215e",
     "path": "webidl"
   },
   "webidl/ecmascript-binding/es-exceptions": {
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
new file mode 100644
index 000000000000..b4cd1e37fd94
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>WebIDL [AllowShared] semantics</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#AllowShared">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/sab.js"></script>
+<script>
+  "use strict";
+
+  test(t => {
+    // Create a standard SharedArrayBuffer (safe even without COOP/COEP headers)
+    const sab = createBuffer('SharedArrayBuffer', 128);
+    const arr = new Uint8Array(sab);
+    arr.fill(42);
+    assert_equals(sab.constructor.name, 'SharedArrayBuffer');
+    new ImageDecoder({
+      data: arr,
+      // We don't really need encoding to succeed, just for argument conversion before the native call.
+      type: "invalid"
+    });
+
+    assert_throws_js(TypeError, () => {
+      new MIDIMessageEvent('message', { data: arr });
+    }, "An attempt to pass a view backed by a shared array buffer should throw");
+
+  }, "APIs without [AllowShared] do not accept SharedArrayBuffer-backed views with pre-existing wrapper");
+
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
index 9b6978783723..856d13681e60 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
index 011521652654..ca0fc84fc66a 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 test(function() {
     assert_own_property(self, "DOMException", "property of global");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
index c4ddabdafd45..10aad220b917 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
index d1c86930d4cd..467bf054c3a9 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
index 6f3097b222ed..dc39c978217b 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
new file mode 100644
index 000000000000..24f6fd486bdc
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
@@ -0,0 +1,80 @@
+// META: global=window,dedicatedworker
+
+// https://tc39.es/proposal-error-stack-accessor/
+// https://github.com/whatwg/webidl/pull/1421
+
+"use strict";
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() has a stack property that is a string");
+
+test(() => {
+  const e = new DOMException();
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() with no arguments has a stack property that is a string");
+
+if (typeof document !== "undefined") {
+  test(() => {
+    let caught;
+    try {
+      document.createElement("");
+    } catch (e) {
+      caught = e;
+    }
+    assert_true(caught instanceof DOMException, "must be a DOMException");
+    assert_equals(typeof caught.stack, "string", "stack must be a string");
+  }, "thrown DOMException from DOM API has a stack property that is a string");
+}
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_false(e.hasOwnProperty("stack"), "stack must not be an own property of the instance");
+}, "DOMException instance does not have an own stack property");
+
+test(() => {
+  assert_false(DOMException.prototype.hasOwnProperty("stack"),
+    "DOMException.prototype must not have an own stack property");
+}, "DOMException.prototype does not have an own stack property");
+
+test(() => {
+  const desc = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_not_equals(desc, undefined, "Error.prototype must have a stack property descriptor");
+  assert_equals(typeof desc.get, "function", "stack must have a getter");
+  assert_equals(typeof desc.set, "function", "stack must have a setter");
+  assert_false(desc.enumerable, "stack must not be enumerable");
+  assert_true(desc.configurable, "stack must be configurable");
+}, "Error.prototype.stack is an accessor property with correct attributes");
+
+test(() => {
+  const getter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").get;
+  const e = new DOMException("some message", "SyntaxError");
+  const stack = getter.call(e);
+  assert_equals(typeof stack, "string", "getter must return a string for DOMException");
+  assert_equals(stack, e.stack, "getter result must match e.stack");
+}, "Error.prototype.stack getter works on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  const e = new DOMException("some message", "SyntaxError");
+  setter.call(e, "custom stack");
+  assert_true(e.hasOwnProperty("stack"), "after setter, stack must be an own property");
+  assert_equals(e.stack, "custom stack", "own stack property must have the set value");
+
+  const desc = Object.getOwnPropertyDescriptor(e, "stack");
+  assert_equals(desc.value, "custom stack", "must be a data property");
+  assert_true(desc.writable, "must be writable");
+  assert_true(desc.enumerable, "must be enumerable");
+  assert_true(desc.configurable, "must be configurable");
+}, "Error.prototype.stack setter installs own data property on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  // SetterThatIgnoresPrototypeProperties should not install a property on Error.prototype itself
+  const originalStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  setter.call(Error.prototype, "custom stack");
+  const afterStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_equals(typeof afterStack.get, "function",
+    "Error.prototype.stack must still be an accessor after calling setter on it");
+}, "Error.prototype.stack setter ignores Error.prototype itself");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
deleted file mode 100644
index eba96e9adf46..000000000000
--- a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
+++ /dev/null
@@ -1,27 +0,0 @@
-// META: global=shadowrealm
-// META: title=Mutability of the global prototype chain
-
-const objects = [];
-setup(() => {
-  for (let object = self; object; object = Object.getPrototypeOf(object)) {
-    objects.push(object);
-  }
-});
-
-test(() => {
-  for (const object of objects) {
-    const proto = Object.getPrototypeOf(object);
-    const plainObject = {};
-    Object.setPrototypeOf(object, plainObject);
-    assert_equals(Object.getPrototypeOf(object), plainObject);
-    Object.setPrototypeOf(object, proto);
-  }
-}, "Setting to a different prototype");
-
-test(() => {
-  for (const object of objects) {
-    const expected = Object.getPrototypeOf(object);
-    Object.setPrototypeOf(object, expected);
-    assert_equals(Object.getPrototypeOf(object), expected);
-  }
-}, "Setting to the same prototype");
diff --git a/test/fixtures/wpt/webidl/idlharness.any.js b/test/fixtures/wpt/webidl/idlharness.any.js
index f8b285c485c4..164fa0e65c8d 100644
--- a/test/fixtures/wpt/webidl/idlharness.any.js
+++ b/test/fixtures/wpt/webidl/idlharness.any.js
@@ -1,6 +1,6 @@
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
-// META: global=window,dedicatedworker,shadowrealm-in-window
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/wpt/status/webidl.json b/test/wpt/status/webidl.json
index 73a89a373812..8dcbe1b247c8 100644
--- a/test/wpt/status/webidl.json
+++ b/test/wpt/status/webidl.json
@@ -6,6 +6,18 @@
       ]
     }
   },
+  "ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js": {
+    "fail": {
+      "note": "needs a V8 update, see https://github.com/nodejs/node/issues/63579",
+      "expected": [
+        "DOMException instance does not have an own stack property",
+        "Error.prototype.stack is an accessor property with correct attributes",
+        "Error.prototype.stack getter works on DOMException instances",
+        "Error.prototype.stack setter installs own data property on DOMException instances",
+        "Error.prototype.stack setter ignores Error.prototype itself"
+      ]
+    }
+  },
   "ecmascript-binding/global-immutable-prototype.any.js": {
     "fail": {
       "expected": [

From 86f9a1b300335c2cd2b2163ac68f342bc7472801 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 23:19:49 +0000
Subject: [PATCH 002/202] stream: fixup cancelation handling in pull()

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/pull.js            | 34 ++++++++++++++++++--
 test/parallel/test-stream-iter-pull-async.js | 30 +++++++++++++++++
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index b6c2d9849c42..aef7a7cacd58 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -34,7 +34,10 @@ const {
   isPromise,
   isUint8Array,
 } = require('internal/util/types');
-const { AbortController } = require('internal/abort_controller');
+const {
+  AbortController,
+  AbortSignal,
+} = require('internal/abort_controller');
 
 const {
   arrayBufferViewToUint8Array,
@@ -862,8 +865,33 @@ function pull(source, ...args) {
 
   return {
     __proto__: null,
-    async *[SymbolAsyncIterator]() {
-      yield* createAsyncPipeline(from(source), transforms, signal);
+    [SymbolAsyncIterator]() {
+      const controller = new AbortController();
+      const iteratorSignal = signal === undefined ?
+        controller.signal : AbortSignal.any([signal, controller.signal]);
+
+      async function* pipeline() {
+        yield* createAsyncPipeline(from(source), transforms, iteratorSignal);
+      }
+      const iterator = pipeline();
+
+      return {
+        __proto__: null,
+        next(value) {
+          return iterator.next(value);
+        },
+        return(value) {
+          controller.abort(lazyDOMException('Aborted', 'AbortError'));
+          return iterator.return(value);
+        },
+        throw(error) {
+          controller.abort(error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
+        },
+      };
     },
   };
 }
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 3159b718f27e..fca2b4da293a 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -170,6 +170,35 @@ async function testPullSignalAbortWhileSourceNextPending() {
   await assert.rejects(next, { name: 'AbortError' });
 }
 
+async function testPullReturnWhileSourceNextPending() {
+  let startNext;
+  const nextStarted = new Promise((resolve) => { startNext = resolve; });
+  const source = {
+    [Symbol.asyncIterator]() {
+      return {
+        next() {
+          startNext();
+          return new Promise(() => {});
+        },
+      };
+    },
+  };
+
+  const iter = pull(source)[Symbol.asyncIterator]();
+  const next = assert.rejects(iter.next(), { name: 'AbortError' });
+  await nextStarted;
+
+  const timeout = {};
+  const result = await Promise.race([
+    iter.return(),
+    new Promise((resolve) => setImmediate(resolve, timeout)),
+  ]);
+
+  assert.notStrictEqual(result, timeout);
+  assert.deepStrictEqual(result, { value: undefined, done: true });
+  await next;
+}
+
 async function testPullSignalAbortWithTransformWhileSourceNextPending() {
   const source = {
     [Symbol.asyncIterator]() {
@@ -417,6 +446,7 @@ async function testTransformOptionsNotShared() {
     testTapCallbackError(),
     testPullSignalAbortMidIteration(),
     testPullSignalAbortWhileSourceNextPending(),
+    testPullReturnWhileSourceNextPending(),
     testPullSignalAbortWithTransformWhileSourceNextPending(),
     testPullConsumerBreakCleanup(),
     testPullTransformReturnsPromise(),

From ae168eac5b0718e375ed3789451c383f6c561982 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 23:30:50 +0000
Subject: [PATCH 003/202] stream: ensure iterator cleanup on done, reject, etc

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/broadcast.js       |  9 +--
 lib/internal/streams/iter/pull.js            | 72 ++++++++++++++++++++
 lib/internal/streams/iter/push.js            | 10 +--
 lib/internal/streams/iter/share.js           | 10 +--
 test/parallel/test-stream-iter-pull-async.js | 37 +++++++++-
 5 files changed, 115 insertions(+), 23 deletions(-)

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0674d4d57037..0b03dd36c6f3 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -52,7 +52,7 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -157,12 +157,7 @@ class BroadcastImpl {
     // When no transforms, return rawConsumer directly (controller elided
     // per PULL-02 optimization -- no transforms means no signal recipient).
     if (transforms.length > 0 || signal) {
-      const pullArgs = [...transforms];
-      if (signal) {
-        ArrayPrototypePush(pullArgs,
-                           { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...pullArgs);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index aef7a7cacd58..465f6666c651 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -12,6 +12,7 @@ const {
   ArrayIsArray,
   ArrayPrototypePush,
   ArrayPrototypeSlice,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   SymbolAsyncIterator,
@@ -896,6 +897,76 @@ function pull(source, ...args) {
   };
 }
 
+// Keep ownership of a bonded consumer outside the transform pipeline so it can
+// be detached even when the pipeline never starts or terminates early.
+function pullWithConsumerCleanup(source, transforms, signal) {
+  const sourceIterator = source[SymbolAsyncIterator]();
+  const pipelineSource = {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      return sourceIterator;
+    },
+  };
+  const pipeline = signal === undefined ?
+    pull(pipelineSource, ...transforms) :
+    pull(pipelineSource, ...transforms, { __proto__: null, signal });
+  let sourceClosed = false;
+  let abortHandler;
+
+  function closeSource(method, value) {
+    if (sourceClosed) return;
+    sourceClosed = true;
+    if (abortHandler !== undefined) {
+      signal.removeEventListener('abort', abortHandler);
+    }
+    const close = sourceIterator[method] ?? sourceIterator.return;
+    if (typeof close === 'function') {
+      const result = FunctionPrototypeCall(close, sourceIterator, value);
+      PromisePrototypeThen(PromiseResolve(result), undefined, () => {});
+    }
+  }
+
+  if (signal !== undefined) {
+    abortHandler = () => closeSource('throw', signal.reason);
+    signal.addEventListener('abort', abortHandler,
+                            { __proto__: null, once: true });
+    if (signal.aborted) abortHandler();
+  }
+
+  return {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      const iterator = pipeline[SymbolAsyncIterator]();
+      return {
+        __proto__: null,
+        next(value) {
+          return PromisePrototypeThen(
+            iterator.next(value),
+            (result) => {
+              if (result.done) closeSource('return');
+              return result;
+            },
+            (error) => {
+              closeSource('throw', error);
+              throw error;
+            });
+        },
+        return(value) {
+          closeSource('return', value);
+          return iterator.return(value);
+        },
+        throw(error) {
+          closeSource('throw', error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
+        },
+      };
+    },
+  };
+}
+
 // =============================================================================
 // Public API: pipeTo() and pipeToSync()
 // =============================================================================
@@ -1112,4 +1183,5 @@ module.exports = {
   pipeToSync,
   pull,
   pullSync,
+  pullWithConsumerCleanup,
 };
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index cc7bfc900cec..3f5c22217916 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -46,7 +46,7 @@ const {
 } = require('internal/streams/iter/utils');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -756,12 +756,8 @@ function push(...args) {
   // Apply transforms lazily if provided
   let readable;
   if (transforms.length > 0) {
-    if (options.signal) {
-      readable = pullWithTransforms(
-        rawReadable, ...transforms, { __proto__: null, signal: options.signal });
-    } else {
-      readable = pullWithTransforms(rawReadable, ...transforms);
-    }
+    readable = pullWithConsumerCleanup(
+      rawReadable, transforms, options.signal);
   } else {
     readable = rawReadable;
   }
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 711abeb21b9a..0d9e83dfc1ba 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -30,8 +30,8 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
   pullSync: pullSyncWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -111,13 +111,7 @@ class ShareImpl {
     const rawConsumer = this.#createRawConsumer();
 
     if (transforms.length > 0 || signal) {
-      if (signal) {
-        return pullWithTransforms(
-          rawConsumer,
-          ...transforms,
-          { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...transforms);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index fca2b4da293a..86c790c85cb2 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -3,7 +3,15 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pull, from, text, tap } = require('stream/iter');
+const {
+  broadcast,
+  from,
+  pull,
+  push,
+  share,
+  tap,
+  text,
+} = require('stream/iter');
 
 async function testPullIdentity() {
   const data = await text(pull(from('hello-async')));
@@ -199,6 +207,32 @@ async function testPullReturnWhileSourceNextPending() {
   await next;
 }
 
+async function testTransformedConsumerReturnBeforeNext() {
+  const identity = (chunks) => chunks;
+  const pushed = push(identity);
+  const { broadcast: bc } = broadcast();
+  const broadcastConsumer = bc.push(identity);
+  const shared = share(from('shared'));
+  const sharedConsumer = shared.pull(identity);
+
+  assert.strictEqual(bc.consumerCount, 1);
+  assert.strictEqual(shared.consumerCount, 1);
+
+  const cases = [
+    [pushed.readable, common.mustCall(
+      () => assert.strictEqual(pushed.writer.canWrite, null))],
+    [broadcastConsumer, common.mustCall(
+      () => assert.strictEqual(bc.consumerCount, 0))],
+    [sharedConsumer, common.mustCall(
+      () => assert.strictEqual(shared.consumerCount, 0))],
+  ];
+
+  for (const [readable, verify] of cases) {
+    await readable[Symbol.asyncIterator]().return();
+    verify();
+  }
+}
+
 async function testPullSignalAbortWithTransformWhileSourceNextPending() {
   const source = {
     [Symbol.asyncIterator]() {
@@ -447,6 +481,7 @@ async function testTransformOptionsNotShared() {
     testPullSignalAbortMidIteration(),
     testPullSignalAbortWhileSourceNextPending(),
     testPullReturnWhileSourceNextPending(),
+    testTransformedConsumerReturnBeforeNext(),
     testPullSignalAbortWithTransformWhileSourceNextPending(),
     testPullConsumerBreakCleanup(),
     testPullTransformReturnsPromise(),

From 535f9340008972182575cf09c61ba30dca75eaa2 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 23:37:56 +0000
Subject: [PATCH 004/202] stream: fixup writer to terminate on consumer
 return/throw

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/push.js             | 51 ++++++++++++-------
 test/parallel/test-stream-iter-push-writer.js | 15 ++++++
 2 files changed, 47 insertions(+), 19 deletions(-)

diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 3f5c22217916..650fc7c91a31 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -425,6 +425,13 @@ class PushQueue {
   // ===========================================================================
 
   async read() {
+    if (this.#consumerState === 'returned') {
+      return { __proto__: null, done: true, value: undefined };
+    }
+    if (this.#consumerState === 'thrown') {
+      throw this.#error;
+    }
+
     // If there's data in the buffer, return it immediately
     if (this.#slots.length > 0) {
       const result = this.#drain();
@@ -458,16 +465,9 @@ class PushQueue {
   consumerReturn() {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'returned';
-    this.#cleanup();
+    const error = new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+    this.#terminateWriterFromConsumer(error);
     this.#resolvePendingReads();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-    // If closing, reject the pending end promise
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-      this.#pendingEnd = null;
-    }
     // Resolve pending drains with false - no more data will be consumed
     this.#resolvePendingDrains(false);
   }
@@ -476,13 +476,8 @@ class PushQueue {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'thrown';
     this.#error = error;
-    this.#cleanup();
+    this.#terminateWriterFromConsumer(error);
     this.#rejectPendingReads(error);
-    this.#rejectPendingWrites(error);
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(error);
-      this.#pendingEnd = null;
-    }
     // Reject pending drains - the consumer errored
     this.#rejectPendingDrains(error);
   }
@@ -516,9 +511,30 @@ class PushQueue {
     return size;
   }
 
+  #terminateWriterFromConsumer(error) {
+    this.#slots.clear();
+    this.#bufferedBytes = 0;
+    if (this.#writerState === 'open' || this.#writerState === 'closing') {
+      this.#writerState = 'errored';
+      this.#error = error;
+    }
+    this.#cleanup();
+    this.#rejectPendingWrites(error);
+    if (this.#pendingEnd) {
+      this.#pendingEnd.reject(error);
+      this.#pendingEnd = null;
+    }
+  }
+
   #resolvePendingReads() {
     while (this.#pendingReads.length > 0) {
-      if (this.#slots.length > 0) {
+      if (this.#consumerState === 'returned') {
+        const pending = this.#pendingReads.shift();
+        pending.resolve({ __proto__: null, done: true, value: undefined });
+      } else if (this.#consumerState === 'thrown') {
+        const pending = this.#pendingReads.shift();
+        pending.reject(this.#error);
+      } else if (this.#slots.length > 0) {
         const pending = this.#pendingReads.shift();
         const result = this.#drain();
         this.#resolvePendingWrites();
@@ -533,9 +549,6 @@ class PushQueue {
       } else if (this.#writerState === 'errored') {
         const pending = this.#pendingReads.shift();
         pending.reject(this.#error);
-      } else if (this.#consumerState === 'returned') {
-        const pending = this.#pendingReads.shift();
-        pending.resolve({ __proto__: null, done: true, value: undefined });
       } else {
         break;
       }
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 8ce555ca9251..dd6cf7d494b2 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -424,6 +424,20 @@ async function testConsumerReturnResolvesPendingRead() {
   assert.strictEqual(readResult.done, true);
 }
 
+async function testEndRejectsAfterConsumerReturn() {
+  const { writer, readable } = push();
+  writer.writeSync('data');
+  const iter = readable[Symbol.asyncIterator]();
+
+  await iter.return();
+
+  await assert.rejects(
+    writer.end({ signal: AbortSignal.timeout(common.platformTimeout(100)) }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual((await iter.next()).done, true);
+}
+
 // iterator.throw() rejects a pending read with the thrown error
 async function testConsumerThrowRejectsPendingRead() {
   const { readable } = push();
@@ -599,6 +613,7 @@ Promise.all([
   testFailRejectsFutureReadWithFalsyReason(),
   testFailRejectsPendingReadWithFalsyReason(),
   testConsumerReturnResolvesPendingRead(),
+  testEndRejectsAfterConsumerReturn(),
   testConsumerThrowRejectsPendingRead(),
   testEndRejectsPendingWrites(),
   testEndIdempotentWhenClosed(),

From fdc3770ea7b7419479685128eb8cee1848b4bf8e Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 00:07:35 +0000
Subject: [PATCH 005/202] stream: ensure stability of stored metadata

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/broadcast.js        |  99 +++++-----
 lib/internal/streams/iter/consumers.js        |  47 +++--
 lib/internal/streams/iter/pull.js             |  86 +++++----
 lib/internal/streams/iter/push.js             |  88 +++++----
 lib/internal/streams/iter/share.js            |  53 +++---
 lib/internal/streams/iter/utils.js            |  70 +++++++
 .../test-stream-iter-resizable-buffers.js     | 177 ++++++++++++++++++
 7 files changed, 463 insertions(+), 157 deletions(-)
 create mode 100644 test/parallel/test-stream-iter-resizable-buffers.js

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0b03dd36c6f3..11c616842e67 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -21,7 +21,6 @@ const {
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const { lazyDOMException } = require('internal/util');
@@ -59,6 +58,7 @@ const {
   kMultiConsumerDefaultBudget,
   kResolvedPromise,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
@@ -67,6 +67,7 @@ const {
   wrapError,
   toUint8Array,
   validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -215,7 +216,8 @@ class BroadcastImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
+              if (chunk === null) return PromiseReject(self.#error);
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -304,10 +306,10 @@ class BroadcastImpl {
 
   // Methods accessed by BroadcastWriter via symbol keys
 
-  [kWrite](chunk) {
+  [kWrite](entry) {
     if (this.#ended || this.#cancelled) return false;
 
-    const batchSize = this.#batchByteSize(chunk);
+    const batchSize = entry.byteLength;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -322,7 +324,7 @@ class BroadcastImpl {
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -338,7 +340,7 @@ class BroadcastImpl {
       }
     }
 
-    this.#buffer.push(chunk);
+    this.#buffer.push(entry);
     this.#bufferedBytes += batchSize;
     this.#notifyConsumers();
     return true;
@@ -352,7 +354,8 @@ class BroadcastImpl {
       while (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -433,7 +436,7 @@ class BroadcastImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -445,12 +448,16 @@ class BroadcastImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.#writer.fail(error);
+      if (this.#error === undefined) this[kAbort](error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      return null;
     }
-    return size;
   }
 
   #notifyConsumers() {
@@ -464,7 +471,8 @@ class BroadcastImpl {
       if (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -587,8 +595,9 @@ class BroadcastWriter {
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
       const converted = toUint8Array(chunk);
-      this.#broadcast[kWrite]([converted]);
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+      const batch = createBatchEntry([converted]);
+      this.#broadcast[kWrite](batch);
+      this.#totalBytes += batch.byteLength;
       return kResolvedPromise;
     }
     return this.#writevSlow([chunk], signal);
@@ -600,10 +609,9 @@ class BroadcastWriter {
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
       const converted = convertChunks(chunks);
-      this.#broadcast[kWrite](converted);
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+      const batch = createBatchEntry(converted);
+      this.#broadcast[kWrite](batch);
+      this.#totalBytes += batch.byteLength;
       return kResolvedPromise;
     }
     return this.#writevSlow(chunks, signal);
@@ -619,12 +627,10 @@ class BroadcastWriter {
 
     signal?.throwIfAborted();
 
-    const converted = convertChunks(chunks);
+    const batch = createBatchEntry(convertChunks(chunks));
 
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return;
     }
 
@@ -636,11 +642,11 @@ class BroadcastWriter {
           'Backpressure violation: too many pending writes. ' +
           'Await each write() call to respect backpressure.');
       }
-      return this.#createPendingWrite(converted, signal);
+      return this.#createPendingWrite(batch, signal);
     }
 
     // 'unbounded' policy
-    return this.#createPendingWrite(converted, signal);
+    return this.#createPendingWrite(batch, signal);
   }
 
   writeSync(chunk) {
@@ -648,8 +654,9 @@ class BroadcastWriter {
     if (!this.#broadcast[kCanWrite]()) return false;
     const converted =
       toUint8Array(chunk);
-    if (this.#broadcast[kWrite]([converted])) {
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+    const batch = createBatchEntry([converted]);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
@@ -660,10 +667,9 @@ class BroadcastWriter {
     if (this.#state !== 'open') return false;
     if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    const batch = createBatchEntry(converted);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
@@ -752,9 +758,9 @@ class BroadcastWriter {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunk, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunk, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
     if (signal) {
       wireBroadcastWriteSignal(entry, signal, resolve, reject, this);
@@ -765,14 +771,17 @@ class BroadcastWriter {
   #resolvePendingWrites() {
     while (this.#pendingWrites.length > 0 && this.#broadcast[kCanWrite]()) {
       const pending = this.#pendingWrites.shift();
-      if (this.#broadcast[kWrite](pending.chunk)) {
-        for (let i = 0; i < pending.chunk.length; i++) {
-          this.#totalBytes += TypedArrayPrototypeGetByteLength(pending.chunk[i]);
+      try {
+        validateBatchEntry(pending.batch);
+        if (this.#broadcast[kWrite](pending.batch)) {
+          this.#totalBytes += pending.batch.byteLength;
+          pending.resolve();
+        } else {
+          this.#pendingWrites.unshift(pending);
+          break;
         }
-        pending.resolve();
-      } else {
-        this.#pendingWrites.unshift(pending);
-        break;
+      } catch (error) {
+        pending.reject(error);
       }
     }
     this.#finishEndIfReady();
@@ -806,18 +815,18 @@ function wireBroadcastWriteSignal(entry, signal, resolve, reject, self) {
     const pendingWrites = getBroadcastPendingWrites(self);
     const idx = pendingWrites.indexOf(entry);
     if (idx !== -1) pendingWrites.removeAt(idx);
-    entry.chunk = null;
+    entry.batch = null;
     reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
     if (idx !== -1) self[kPendingWriteRemoved]();
   };
   entry.resolve = function() {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     resolve();
   };
   entry.reject = function(reason) {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     reject(reason);
   };
   signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index e3bd7856dcd4..30f4eb4f53da 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -54,6 +54,8 @@ const {
 
 const {
   concatBytes,
+  createBatchEntry,
+  validateBatchEntry,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
 
@@ -89,6 +91,17 @@ function isMergeOptions(value) {
 // Shared chunk collection helpers
 // =============================================================================
 
+function flattenBatchEntries(entries) {
+  const chunks = [];
+  for (let i = 0; i < entries.length; i++) {
+    const batch = validateBatchEntry(entries[i]);
+    for (let j = 0; j < batch.length; j++) {
+      ArrayPrototypePush(chunks, batch[j]);
+    }
+  }
+  return chunks;
+}
+
 /**
  * Collect chunks from a sync source into an array.
  * @param {Iterable<Uint8Array[]>} source
@@ -98,23 +111,23 @@ function isMergeOptions(value) {
 function collectSync(source, limit) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  const chunks = [];
+  const entries = [];
   let totalBytes = 0;
 
   for (const batch of normalized) {
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -131,16 +144,14 @@ async function collectAsync(source, signal, limit) {
   const abortableSource = signal && isAsyncIterable(source) ?
     yieldAbortable(source, signal) : source;
   const normalized = from(abortableSource);
-  const chunks = [];
+  const entries = [];
 
   // Fast path: no signal and no limit
   if (!signal && limit === undefined) {
     for await (const batch of normalized) {
-      for (let i = 0; i < batch.length; i++) {
-        ArrayPrototypePush(chunks, batch[i]);
-      }
+      ArrayPrototypePush(entries, createBatchEntry(batch));
     }
-    return chunks;
+    return flattenBatchEntries(entries);
   }
 
   // Slow path: with signal or limit checks
@@ -149,19 +160,19 @@ async function collectAsync(source, signal, limit) {
 
   for await (const batch of iterable) {
     signal?.throwIfAborted();
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index 465f6666c651..a9a77377a84e 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -17,7 +17,6 @@ const {
   PromiseResolve,
   SymbolAsyncIterator,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
   Uint8Array,
 } = primordials;
 
@@ -52,11 +51,14 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
+  createBatchEntry,
   isPullOptions,
   isTransform,
   isTransformObject,
   parsePullArgs,
   toUint8Array,
+  validateBatchEntry,
+  validateByteView,
   wrapError,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
@@ -992,22 +994,26 @@ function pipeToSync(source, ...args) {
 
   try {
     for (const batch of pipeline) {
+      const entry = createBatchEntry(batch);
       if (hasWritevSync && batch.length > 1) {
-        if (writer.writevSync(batch) === false) {
+        const accepted = writer.writevSync(validateBatchEntry(entry));
+        validateBatchEntry(entry);
+        if (accepted === false) {
           throw new ERR_OUT_OF_RANGE(
             'write', 'within byte budget', 'budget exhausted');
         }
-        for (let i = 0; i < batch.length; i++) {
-          totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-        }
+        totalBytes += entry.byteLength;
       } else {
-        for (let i = 0; i < batch.length; i++) {
-          const chunk = batch[i];
-          if (writer.writeSync(chunk) === false) {
+        for (let i = 0; i < entry.views.length; i++) {
+          const view = entry.views[i];
+          const chunk = validateByteView(view);
+          const accepted = writer.writeSync(chunk);
+          validateByteView(view);
+          if (accepted === false) {
             throw new ERR_OUT_OF_RANGE(
               'write', 'within byte budget', 'budget exhausted');
           }
-          totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+          totalBytes += view.byteLength;
         }
       }
     }
@@ -1056,19 +1062,26 @@ async function pipeTo(source, ...args) {
 
   // Async fallback for writeBatch when sync write fails partway through.
   // Continues writing from batch[startIndex] using async write().
-  async function writeBatchAsyncFallback(batch, startIndex) {
-    for (let i = startIndex; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (hasWriteSync && writer.writeSync(chunk)) {
-        // Sync retry succeeded
-      } else {
-        const result = writer.write(
-          chunk, signal ? { __proto__: null, signal } : undefined);
-        if (result !== undefined) {
-          await result;
+  async function writeBatchAsyncFallback(entry, startIndex) {
+    for (let i = startIndex; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      if (hasWriteSync) {
+        const chunk = validateByteView(view);
+        if (writer.writeSync(chunk)) {
+          validateByteView(view);
+          totalBytes += view.byteLength;
+          continue;
         }
+        validateByteView(view);
+      }
+      const result = writer.write(
+        validateByteView(view),
+        signal ? { __proto__: null, signal } : undefined);
+      if (result !== undefined) {
+        await result;
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
@@ -1076,34 +1089,37 @@ async function pipeTo(source, ...args) {
   // Returns undefined on sync success, or a Promise when async fallback
   // is required. Callers must check: const p = writeBatch(b); if (p) await p;
   function writeBatch(batch) {
+    const entry = createBatchEntry(batch);
     if (hasWritev && batch.length > 1) {
-      if (!hasWritevSync || !writer.writevSync(batch)) {
+      if (!hasWritevSync ||
+          !writer.writevSync(validateBatchEntry(entry))) {
+        validateBatchEntry(entry);
         const opts = signal ? { __proto__: null, signal } : undefined;
-        const writevResult = writer.writev(batch, opts);
+        const writevResult = writer.writev(validateBatchEntry(entry), opts);
         if (writevResult === undefined) {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
           return;
         }
         return PromisePrototypeThen(PromiseResolve(writevResult), () => {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
         });
       }
-      for (let i = 0; i < batch.length; i++) {
-        totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-      }
+      validateBatchEntry(entry);
+      totalBytes += entry.byteLength;
       return;
     }
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
+    for (let i = 0; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      const chunk = validateByteView(view);
       if (!hasWriteSync || !writer.writeSync(chunk)) {
+        if (hasWriteSync) validateByteView(view);
         // Sync path failed at index i - fall back to async for the rest.
-        return writeBatchAsyncFallback(batch, i);
+        return writeBatchAsyncFallback(entry, i);
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 650fc7c91a31..368a121f4106 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -15,7 +15,6 @@ const {
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -37,12 +36,14 @@ const {
 const {
   kPushDefaultBudget,
   kResolvedPromise,
+  createBatchEntry,
   onSignalAbort,
   toUint8Array,
   convertChunks,
   getWriterSignal,
   parsePullArgs,
   validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -185,7 +186,11 @@ class PushQueue {
     if (this.#writerState !== 'open') return false;
     if (this.#consumerState !== 'active') return false;
 
-    const batchSize = this.#batchByteSize(chunks);
+    return this.#writeEntry(createBatchEntry(chunks));
+  }
+
+  #writeEntry(entry) {
+    const batchSize = entry.byteLength;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -201,7 +206,7 @@ class PushQueue {
           while (this.#bufferedBytes >= this.#budget &&
                  this.#slots.length > 0) {
             const evicted = this.#slots.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
           }
           break;
         case 'drop-newest':
@@ -211,7 +216,7 @@ class PushQueue {
       }
     }
 
-    this.#slots.push(chunks);
+    this.#slots.push(entry);
     this.#bufferedBytes += batchSize;
     this.#bytesWritten += batchSize;
 
@@ -253,8 +258,8 @@ class PushQueue {
     // Check for pre-aborted signal (after state checks per spec)
     signal?.throwIfAborted();
 
-    // Try sync first
-    if (this.writeSync(chunks)) {
+    const entry = createBatchEntry(chunks);
+    if (this.#writeEntry(entry)) {
       return;
     }
 
@@ -266,9 +271,9 @@ class PushQueue {
             'Backpressure violation: too many pending writes. ' +
             'Await each write() call to respect backpressure.');
         }
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       case 'unbounded':
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       default:
         throw new ERR_INVALID_STATE(
           'Unexpected: writeSync should have handled non-strict policy');
@@ -281,9 +286,9 @@ class PushQueue {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunks, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunks, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
 
     if (signal) {
@@ -487,28 +492,29 @@ class PushQueue {
   // ===========================================================================
 
   #drain() {
-    this.#bufferedBytes = 0;
-    if (this.#slots.length === 1) {
-      return this.#slots.shift();
-    }
-
-    const result = [];
-    for (let i = 0; i < this.#slots.length; i++) {
-      const slot = this.#slots.get(i);
-      for (let j = 0; j < slot.length; j++) {
-        ArrayPrototypePush(result, slot[j]);
+    try {
+      if (this.#slots.length === 1) {
+        const result = validateBatchEntry(this.#slots.shift());
+        this.#bufferedBytes = 0;
+        return result;
       }
-    }
-    this.#slots.clear();
-    return result;
-  }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+      const result = [];
+      for (let i = 0; i < this.#slots.length; i++) {
+        const batch = validateBatchEntry(this.#slots.get(i));
+        for (let j = 0; j < batch.length; j++) {
+          ArrayPrototypePush(result, batch[j]);
+        }
+      }
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      return result;
+    } catch (error) {
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      this.fail(error);
+      throw error;
     }
-    return size;
   }
 
   #terminateWriterFromConsumer(error) {
@@ -536,9 +542,13 @@ class PushQueue {
         pending.reject(this.#error);
       } else if (this.#slots.length > 0) {
         const pending = this.#pendingReads.shift();
-        const result = this.#drain();
-        this.#resolvePendingWrites();
-        pending.resolve({ __proto__: null, done: false, value: result });
+        try {
+          const result = this.#drain();
+          this.#resolvePendingWrites();
+          pending.resolve({ __proto__: null, done: false, value: result });
+        } catch (error) {
+          pending.reject(error);
+        }
       } else if (this.#writerState === 'closing' && this.#slots.length === 0) {
         this.endDrained();
         const pending = this.#pendingReads.shift();
@@ -559,11 +569,15 @@ class PushQueue {
     while (this.#pendingWrites.length > 0 &&
           this.#bufferedBytes < this.#budget) {
       const pending = this.#pendingWrites.shift();
-      const batchSize = this.#batchByteSize(pending.chunks);
-      this.#slots.push(pending.chunks);
-      this.#bufferedBytes += batchSize;
-      this.#bytesWritten += batchSize;
-      pending.resolve();
+      try {
+        validateBatchEntry(pending.batch);
+        this.#slots.push(pending.batch);
+        this.#bufferedBytes += pending.batch.byteLength;
+        this.#bytesWritten += pending.batch.byteLength;
+        pending.resolve();
+      } catch (error) {
+        pending.reject(error);
+      }
     }
 
     if (this.#bufferedBytes < this.#budget) {
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 0d9e83dfc1ba..2cb4ed7fa469 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -14,7 +14,6 @@ const {
   SymbolAsyncIterator,
   SymbolDispose,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -36,12 +35,14 @@ const {
 
 const {
   kMultiConsumerDefaultBudget,
+  createBatchEntry,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
   wrapError,
   parsePullArgs,
   validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -166,7 +167,7 @@ class ShareImpl {
             // Check if data is available in buffer
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -296,7 +297,7 @@ class ShareImpl {
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -368,8 +369,9 @@ class ShareImpl {
         if (result.done) {
           this.#sourceExhausted = true;
         } else if (!discard) {
-          this.#buffer.push(result.value);
-          this.#bufferedBytes += this.#batchByteSize(result.value);
+          const entry = createBatchEntry(result.value);
+          this.#buffer.push(entry);
+          this.#bufferedBytes += entry.byteLength;
         }
       } catch (error) {
         this.#sourceError = wrapError(error);
@@ -392,7 +394,7 @@ class ShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -403,12 +405,15 @@ class ShareImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -511,7 +516,7 @@ class SyncShareImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -543,7 +548,7 @@ class SyncShareImpl {
                   while (self.#bufferedBytes >= self.#options.budget &&
                          self.#buffer.length > 0) {
                     const evicted = self.#buffer.shift();
-                    self.#bufferedBytes -= self.#batchByteSize(evicted);
+                    self.#bufferedBytes -= evicted.byteLength;
                     self.#bufferStart++;
                   }
                   for (const consumer of self.#consumers) {
@@ -571,7 +576,7 @@ class SyncShareImpl {
 
             const newBufferIndex = state.cursor - self.#bufferStart;
             if (newBufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(newBufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(newBufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -643,8 +648,9 @@ class SyncShareImpl {
       if (result.done) {
         this.#sourceExhausted = true;
       } else {
-        this.#buffer.push(result.value);
-        this.#bufferedBytes += this.#batchByteSize(result.value);
+        const entry = createBatchEntry(result.value);
+        this.#buffer.push(entry);
+        this.#bufferedBytes += entry.byteLength;
       }
     } catch (error) {
       this.#sourceError = wrapError(error);
@@ -660,19 +666,22 @@ class SyncShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 9966f351b9d5..53610dbe6317 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -3,6 +3,7 @@
 const {
   Array,
   ArrayBufferPrototypeGetByteLength,
+  ArrayBufferPrototypeGetDetached,
   ArrayPrototypeSlice,
   PromiseResolve,
   PromiseWithResolvers,
@@ -25,6 +26,7 @@ const { TextEncoder } = require('internal/encoding');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
     ERR_OPERATION_FAILED,
   },
 } = require('internal/errors');
@@ -196,6 +198,71 @@ function allUint8Array(chunks) {
   return true;
 }
 
+function snapshotByteView(value) {
+  const buffer = TypedArrayPrototypeGetBuffer(value);
+  const sharedBufferView = isSharedArrayBuffer(buffer) ?
+    new Uint8Array(buffer) : undefined;
+  return {
+    __proto__: null,
+    value,
+    buffer,
+    bufferByteLength: sharedBufferView === undefined ?
+      ArrayBufferPrototypeGetByteLength(buffer) :
+      TypedArrayPrototypeGetByteLength(sharedBufferView),
+    byteLength: TypedArrayPrototypeGetByteLength(value),
+    byteOffset: TypedArrayPrototypeGetByteOffset(value),
+    detached: sharedBufferView === undefined &&
+      ArrayBufferPrototypeGetDetached(buffer),
+    sharedBufferView,
+  };
+}
+
+function validateByteView(snapshot) {
+  const {
+    value,
+    buffer,
+    bufferByteLength,
+    byteLength,
+    byteOffset,
+    detached,
+    sharedBufferView,
+  } = snapshot;
+  const currentBufferByteLength = sharedBufferView === undefined ?
+    ArrayBufferPrototypeGetByteLength(buffer) :
+    TypedArrayPrototypeGetByteLength(sharedBufferView);
+  const currentDetached = sharedBufferView === undefined &&
+    ArrayBufferPrototypeGetDetached(buffer);
+
+  if (TypedArrayPrototypeGetBuffer(value) !== buffer ||
+      currentBufferByteLength !== bufferByteLength ||
+      TypedArrayPrototypeGetByteLength(value) !== byteLength ||
+      TypedArrayPrototypeGetByteOffset(value) !== byteOffset ||
+      currentDetached !== detached) {
+    throw new ERR_INVALID_STATE.TypeError(
+      'Byte view was resized or detached after being accepted');
+  }
+  return value;
+}
+
+function createBatchEntry(chunks) {
+  const views = new Array(chunks.length);
+  let byteLength = 0;
+  for (let i = 0; i < chunks.length; i++) {
+    const view = snapshotByteView(chunks[i]);
+    views[i] = view;
+    byteLength += view.byteLength;
+  }
+  return { __proto__: null, views, byteLength };
+}
+
+function validateBatchEntry(entry) {
+  const chunks = new Array(entry.views.length);
+  for (let i = 0; i < entry.views.length; i++) {
+    chunks[i] = validateByteView(entry.views[i]);
+  }
+  return chunks;
+}
+
 function copyBytes(chunk) {
   const copy = new Uint8Array(TypedArrayPrototypeGetByteLength(chunk));
   TypedArrayPrototypeSet(copy, chunk);
@@ -382,6 +449,7 @@ module.exports = {
   allUint8Array,
   concatBytes,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
@@ -392,6 +460,8 @@ module.exports = {
   parsePullArgs,
   toUint8Array,
   validateBackpressure,
+  validateBatchEntry,
+  validateByteView,
   wrapError,
   yieldAbortable,
 };
diff --git a/test/parallel/test-stream-iter-resizable-buffers.js b/test/parallel/test-stream-iter-resizable-buffers.js
new file mode 100644
index 000000000000..c4be26774ac6
--- /dev/null
+++ b/test/parallel/test-stream-iter-resizable-buffers.js
@@ -0,0 +1,177 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  array,
+  arraySync,
+  broadcast,
+  pipeTo,
+  pipeToSync,
+  push,
+  share,
+  shareSync,
+} = require('stream/iter');
+
+const kResizeError = {
+  code: 'ERR_INVALID_STATE',
+  message: /resized or detached/,
+};
+
+async function testBufferedViewMutationRejected() {
+  const resizable = new ArrayBuffer(1, { maxByteLength: 2 });
+  const growable = new SharedArrayBuffer(1, { maxByteLength: 2 });
+  const detachable = new ArrayBuffer(1);
+  const cases = [
+    [new Uint8Array(resizable), () => resizable.resize(2)],
+    [new Uint8Array(growable), () => growable.grow(2)],
+    [new Uint8Array(detachable), () => {
+      structuredClone(detachable, { transfer: [detachable] });
+    }],
+  ];
+
+  for (const [view, mutate] of cases) {
+    const { writer, readable } = push();
+    assert.strictEqual(writer.writeSync(view), true);
+    mutate();
+    await assert.rejects(
+      readable[Symbol.asyncIterator]().next(),
+      kResizeError,
+    );
+  }
+}
+
+async function testDropOldestUsesAcceptedByteLength() {
+  const buffer = new ArrayBuffer(16384, { maxByteLength: 16384 });
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'drop-oldest',
+  });
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(0);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(2)), true);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(3)), true);
+  writer.endSync();
+
+  assert.strictEqual((await iterator.next()).value[0][0], 2);
+  assert.strictEqual((await iterator.next()).value[0][0], 3);
+  assert.strictEqual((await iterator.next()).done, true);
+}
+
+async function testPendingWritesRejectResizedViews() {
+  const pushResult = push({ budget: 16384, backpressure: 'unbounded' });
+  assert.strictEqual(
+    pushResult.writer.writeSync(new Uint8Array(16384)), true);
+  const pushBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const pushPending = pushResult.writer.write(new Uint8Array(pushBuffer));
+  const pushRejected = assert.rejects(pushPending, kResizeError);
+  pushBuffer.resize(2);
+  const pushIterator = pushResult.readable[Symbol.asyncIterator]();
+  assert.strictEqual((await pushIterator.next()).done, false);
+  await pushRejected;
+  pushResult.writer.endSync();
+  assert.strictEqual((await pushIterator.next()).done, true);
+
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const broadcastIterator = bc.push()[Symbol.asyncIterator]();
+  assert.strictEqual(writer.writeSync(new Uint8Array(16384)), true);
+  const broadcastBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const broadcastPending = writer.write(new Uint8Array(broadcastBuffer));
+  const broadcastRejected = assert.rejects(broadcastPending, kResizeError);
+  broadcastBuffer.resize(2);
+  assert.strictEqual((await broadcastIterator.next()).done, false);
+  await broadcastRejected;
+  writer.endSync();
+  assert.strictEqual((await broadcastIterator.next()).done, true);
+}
+
+async function testBroadcastRejectsResizedBufferedView() {
+  const buffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const { writer, broadcast: bc } = broadcast();
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(2);
+
+  await assert.rejects(iterator.next(), kResizeError);
+  await assert.rejects(writer.end(), kResizeError);
+}
+
+async function testShareRejectsResizedBufferedView() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const shared = share([[new Uint8Array(asyncBuffer)]]);
+  const first = shared.pull()[Symbol.asyncIterator]();
+  const second = shared.pull()[Symbol.asyncIterator]();
+
+  assert.strictEqual((await first.next()).done, false);
+  asyncBuffer.resize(2);
+  await assert.rejects(second.next(), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const sharedSync = shareSync([[new Uint8Array(syncBuffer)]]);
+  const firstSync = sharedSync.pull()[Symbol.iterator]();
+  const secondSync = sharedSync.pull()[Symbol.iterator]();
+
+  assert.strictEqual(firstSync.next().done, false);
+  syncBuffer.resize(2);
+  assert.throws(() => secondSync.next(), kResizeError);
+}
+
+async function testConsumersRejectResizedViews() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  async function* asyncSource() {
+    yield [new Uint8Array(asyncBuffer)];
+    asyncBuffer.resize(2);
+  }
+  await assert.rejects(array(asyncSource(), { limit: 1 }), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  function* syncSource() {
+    yield [new Uint8Array(syncBuffer)];
+    syncBuffer.resize(2);
+  }
+  assert.throws(() => arraySync(syncSource(), { limit: 1 }), kResizeError);
+}
+
+async function testPipeRejectsWriterResize() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const asyncWriter = {
+    write() {
+      asyncBuffer.resize(2);
+    },
+    fail: common.mustCall(),
+  };
+  await assert.rejects(
+    pipeTo([new Uint8Array(asyncBuffer)], asyncWriter),
+    kResizeError,
+  );
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const syncWriter = {
+    writeSync() {
+      syncBuffer.resize(2);
+      return true;
+    },
+    fail: common.mustCall(),
+  };
+  assert.throws(
+    () => pipeToSync([new Uint8Array(syncBuffer)], syncWriter),
+    kResizeError,
+  );
+}
+
+Promise.all([
+  testBufferedViewMutationRejected(),
+  testDropOldestUsesAcceptedByteLength(),
+  testPendingWritesRejectResizedViews(),
+  testBroadcastRejectsResizedBufferedView(),
+  testShareRejectsResizedBufferedView(),
+  testConsumersRejectResizedViews(),
+  testPipeRejectsWriterResize(),
+]).then(common.mustCall());

From 6e2b635dcd7eea426d715eb214046c9f700be9ea Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 00:16:04 +0000
Subject: [PATCH 006/202] stream: defend against re-entrancy in writev

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/broadcast.js        | 21 +++++-
 lib/internal/streams/iter/push.js             |  6 +-
 lib/internal/streams/iter/utils.js            | 17 -----
 .../test-stream-iter-writer-reentrancy.js     | 65 +++++++++++++++++++
 4 files changed, 85 insertions(+), 24 deletions(-)
 create mode 100644 test/parallel/test-stream-iter-writer-reentrancy.js

diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 11c616842e67..0dc6364768d5 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -610,9 +610,11 @@ class BroadcastWriter {
     if (this.#canUseWriteFastPath(signal)) {
       const converted = convertChunks(chunks);
       const batch = createBatchEntry(converted);
-      this.#broadcast[kWrite](batch);
-      this.#totalBytes += batch.byteLength;
-      return kResolvedPromise;
+      if (this.#state === 'open' && this.#broadcast[kWrite](batch)) {
+        this.#totalBytes += batch.byteLength;
+        return kResolvedPromise;
+      }
+      return this.#writeBatchSlow(batch, signal);
     }
     return this.#writevSlow(chunks, signal);
   }
@@ -629,6 +631,19 @@ class BroadcastWriter {
 
     const batch = createBatchEntry(convertChunks(chunks));
 
+    return this.#writeBatchSlow(batch, signal);
+  }
+
+  async #writeBatchSlow(batch, signal) {
+    if (this.#state === 'errored') {
+      throw this.#error;
+    }
+    if (this.#state !== 'open') {
+      throw new ERR_INVALID_STATE.TypeError('Writer is closed');
+    }
+
+    signal?.throwIfAborted();
+
     if (this.#broadcast[kWrite](batch)) {
       this.#totalBytes += batch.byteLength;
       return;
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 368a121f4106..36a2034e5298 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -657,12 +657,10 @@ class PushWriter {
   writev(chunks, options) {
     validateArray(chunks, 'chunks');
     const signal = getWriterSignal(options);
-    if (!signal && this.#queue.canWriteSync()) {
-      const bytes = convertChunks(chunks);
-      this.#queue.writeSync(bytes);
+    const bytes = convertChunks(chunks);
+    if (!signal && this.#queue.writeSync(bytes)) {
       return kResolvedPromise;
     }
-    const bytes = convertChunks(chunks);
     return this.#queue.writeAsync(bytes, signal);
   }
 
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 53610dbe6317..66e831a58523 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -185,19 +185,6 @@ function toUint8Array(chunk) {
   return chunk;
 }
 
-/**
- * Check if all chunks in an array are already Uint8Array.
- * Short-circuits on the first non-Uint8Array chunk found.
- * @param {Array<Uint8Array|string>} chunks
- * @returns {boolean}
- */
-function allUint8Array(chunks) {
-  for (let i = 0; i < chunks.length; i++) {
-    if (!isUint8Array(chunks[i])) return false;
-  }
-  return true;
-}
-
 function snapshotByteView(value) {
   const buffer = TypedArrayPrototypeGetBuffer(value);
   const sharedBufferView = isSharedArrayBuffer(buffer) ?
@@ -317,9 +304,6 @@ function concatBytes(chunks) {
  * @returns {Uint8Array[]}
  */
 function convertChunks(chunks) {
-  if (allUint8Array(chunks)) {
-    return ArrayPrototypeSlice(chunks);
-  }
   const len = chunks.length;
   const result = new Array(len);
   for (let i = 0; i < len; i++) {
@@ -446,7 +430,6 @@ module.exports = {
   kMultiConsumerDefaultBudget,
   kPushDefaultBudget,
   kResolvedPromise,
-  allUint8Array,
   concatBytes,
   convertChunks,
   createBatchEntry,
diff --git a/test/parallel/test-stream-iter-writer-reentrancy.js b/test/parallel/test-stream-iter-writer-reentrancy.js
new file mode 100644
index 000000000000..119bda269239
--- /dev/null
+++ b/test/parallel/test-stream-iter-writer-reentrancy.js
@@ -0,0 +1,65 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { broadcast, push } = require('stream/iter');
+
+const factories = [
+  () => push({ budget: 16384 }),
+  () => {
+    const { writer, broadcast: bc } = broadcast({ budget: 16384 });
+    return { __proto__: null, writer, readable: bc.push() };
+  },
+];
+
+async function testWritevReentrancy() {
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        assert.strictEqual(
+          writer.writeSync(new Uint8Array(16384)), true);
+        return Uint8Array.of(42);
+      }),
+    });
+
+    let resolved = false;
+    const write = writer.writev(chunks).then(common.mustCall(() => {
+      resolved = true;
+    }));
+    await new Promise(setImmediate);
+    assert.strictEqual(resolved, false);
+
+    const iterator = readable[Symbol.asyncIterator]();
+    assert.strictEqual((await iterator.next()).value[0].byteLength, 16384);
+    await write;
+    assert.strictEqual((await iterator.next()).value[0][0], 42);
+    writer.endSync();
+    assert.strictEqual((await iterator.next()).done, true);
+  }
+
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        writer.endSync();
+        return Uint8Array.of(42);
+      }),
+    });
+
+    await assert.rejects(writer.writev(chunks), {
+      code: 'ERR_INVALID_STATE',
+    });
+    assert.strictEqual(
+      (await readable[Symbol.asyncIterator]().next()).done, true);
+  }
+}
+
+testWritevReentrancy().then(common.mustCall());

From 296412a6858c099829c44ad107efb7bfe0527ab8 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 00:25:27 +0000
Subject: [PATCH 007/202] stream: ensure full-close semantics when closed

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/duplex.js          | 97 +++++++-------------
 test/parallel/test-stream-iter-duplex.js     | 96 ++++++++++++-------
 test/parallel/test-stream-iter-validation.js | 12 +--
 3 files changed, 104 insertions(+), 101 deletions(-)

diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index b37b91279232..50a04961b1f2 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -6,6 +6,7 @@
 // channel's writer appears in the other channel's readable.
 
 const {
+  SafePromiseAllReturnVoid,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
 } = primordials;
@@ -50,68 +51,8 @@ function duplex(options = { __proto__: null }) {
     backpressure: b?.backpressure ?? backpressure,
   });
 
-  let aClosed = false;
-  let bClosed = false;
-  // Track active iterators so close() can call .return() on them
-  let aReadableIterator = null;
-  let bReadableIterator = null;
-
-  const channelA = {
-    __proto__: null,
-    get writer() { return aWriter; },
-    // Wrap readable to track the iterator for cleanup on close()
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = aReadable[SymbolAsyncIterator]();
-          aReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (aClosed) return;
-      aClosed = true;
-      // End the writer (signals end-of-stream to B's readable)
-      aWriter.endSync();
-      // Stop iteration of this channel's readable
-      if (aReadableIterator?.return) {
-        await aReadableIterator.return();
-        aReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
-
-  const channelB = {
-    __proto__: null,
-    get writer() { return bWriter; },
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = bReadable[SymbolAsyncIterator]();
-          bReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (bClosed) return;
-      bClosed = true;
-      bWriter.endSync();
-      if (bReadableIterator?.return) {
-        await bReadableIterator.return();
-        bReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
+  const channelA = createDuplexChannel(aWriter, aReadable);
+  const channelB = createDuplexChannel(bWriter, bReadable);
 
   // Signal handler: fail both writers with the abort reason so consumers
   // see the error. This is an error-path shutdown, not a clean close.
@@ -132,6 +73,38 @@ function duplex(options = { __proto__: null }) {
   return [channelA, channelB];
 }
 
+function createDuplexChannel(writer, readable) {
+  // A push readable has one shared consumer state. Keeping an iterator from
+  // creation lets close() terminate that state even if no caller has iterated.
+  const closeIterator = readable[SymbolAsyncIterator]();
+  let closePromise;
+
+  return {
+    __proto__: null,
+    get writer() { return writer; },
+    get readable() { return readable; },
+    close() {
+      closePromise ??= closeDuplexChannel(writer, closeIterator);
+      return closePromise;
+    },
+    [SymbolAsyncDispose]() {
+      return this.close();
+    },
+  };
+}
+
+async function closeDuplexChannel(writer, closeIterator) {
+  const result = writer.endSync();
+  const endPromise = result < 0 ? writer.end() : undefined;
+  const returnPromise = closeIterator.return();
+
+  if (endPromise !== undefined) {
+    await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+  } else {
+    await returnPromise;
+  }
+}
+
 module.exports = {
   duplex,
 };
diff --git a/test/parallel/test-stream-iter-duplex.js b/test/parallel/test-stream-iter-duplex.js
index 0969b91e7d21..5d617baa9882 100644
--- a/test/parallel/test-stream-iter-duplex.js
+++ b/test/parallel/test-stream-iter-duplex.js
@@ -14,32 +14,26 @@ async function testBasicDuplex() {
 
   // A writes, B reads
   await channelA.writer.write('hello from A');
-  await channelA.close();
-
+  const closing = channelA.close();
   const dataAtB = await text(channelB.readable);
+  await closing;
   assert.strictEqual(dataAtB, 'hello from A');
 }
 
 async function testBidirectional() {
   const [channelA, channelB] = duplex();
 
-  // A writes to B, B writes to A concurrently
-  const writeA = (async () => {
-    await channelA.writer.write('A to B');
-    await channelA.close();
-  })();
-
-  const writeB = (async () => {
-    await channelB.writer.write('B to A');
-    await channelB.close();
-  })();
-
-  const readAtB = text(channelB.readable);
-  const readAtA = text(channelA.readable);
+  await channelA.writer.write('A to B');
+  await channelB.writer.write('B to A');
 
-  await Promise.all([writeA, writeB]);
-
-  const [dataAtA, dataAtB] = await Promise.all([readAtA, readAtB]);
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
+  const [dataAtA, dataAtB] = await Promise.all([
+    text(channelA.readable),
+    text(channelB.readable),
+  ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'A to B');
   assert.strictEqual(dataAtA, 'B to A');
@@ -51,19 +45,29 @@ async function testMultipleWrites() {
   await channelA.writer.write('one');
   await channelA.writer.write('two');
   await channelA.writer.write('three');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'onetwothree');
 }
 
 async function testChannelClose() {
   const [channelA, channelB] = duplex();
-
-  await channelA.close();
-
-  // Should be able to close twice without error
-  await channelA.close();
+  const iteratorA = channelA.readable[Symbol.asyncIterator]();
+  const otherIteratorA = channelA.readable[Symbol.asyncIterator]();
+  const pendingRead = iteratorA.next();
+
+  const closing = channelA.close();
+  assert.strictEqual(channelA.close(), closing);
+  await closing;
+
+  assert.strictEqual((await pendingRead).done, true);
+  assert.strictEqual((await otherIteratorA.next()).done, true);
+  assert.strictEqual(
+    (await channelA.readable[Symbol.asyncIterator]().next()).done, true);
+  await assert.rejects(channelB.writer.write('late'), {
+    code: 'ERR_INVALID_STATE',
+  });
 
   // B's readable should end (A -> B direction is closed)
   const batches = [];
@@ -80,9 +84,9 @@ async function testWithOptions() {
   });
 
   await channelA.writer.write('msg');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'msg');
 }
 
@@ -95,15 +99,17 @@ async function testPerChannelOptions() {
   // Channel A -> B direction uses A's options
   // Channel B -> A direction uses B's options
   await channelA.writer.write('from-a');
-  await channelA.close();
-
   await channelB.writer.write('from-b');
-  await channelB.close();
+
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
 
   const [dataAtA, dataAtB] = await Promise.all([
     text(channelA.readable),
     text(channelB.readable),
   ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'from-a');
   assert.strictEqual(dataAtA, 'from-b');
@@ -146,17 +152,39 @@ async function testWriterEndWithPreAbortedSignal() {
 async function testEmptyDuplex() {
   const [channelA, channelB] = duplex();
 
-  // Close without writing
-  await channelA.close();
-  await channelB.close();
+  await channelA.writer.end();
+  await channelB.writer.end();
 
   const dataAtA = await bytes(channelA.readable);
   const dataAtB = await bytes(channelB.readable);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtA.byteLength, 0);
   assert.strictEqual(dataAtB.byteLength, 0);
 }
 
+async function testCloseWaitsForDrain() {
+  const [channelA, channelB] = duplex();
+  await channelA.writer.write('buffered');
+
+  let closed = false;
+  const closing = channelA.close().then(common.mustCall(() => {
+    closed = true;
+  }));
+  await new Promise(setImmediate);
+  assert.strictEqual(closed, false);
+
+  assert.strictEqual(await text(channelB.readable), 'buffered');
+  await closing;
+}
+
+async function testClosePropagatesWriterFailure() {
+  const [channelA] = duplex();
+  const reason = new Error('writer failed');
+  channelA.writer.fail(reason);
+  await assert.rejects(channelA.close(), (error) => error === reason);
+}
+
 // Channel fail propagation
 async function testChannelFail() {
   const [a, b] = duplex();
@@ -200,6 +228,8 @@ Promise.all([
   testAbortSignal(),
   testWriterEndWithPreAbortedSignal(),
   testEmptyDuplex(),
+  testCloseWaitsForDrain(),
+  testClosePropagatesWriterFailure(),
   testChannelFail(),
   testAbortSignalBothChannels(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index 8dcfb46f173f..b93e6575490f 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -99,16 +99,16 @@ assert.throws(() => duplex({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
   const [a, b] = duplex({ budget: Number.MAX_SAFE_INTEGER });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 // Per-direction overrides
 {
   const [a, b] = duplex({ a: { budget: 16384 }, b: { budget: 32768 } });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 assert.throws(() => duplex({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
@@ -397,8 +397,8 @@ async function testAsyncValidation() {
 // Duplex with valid options
 {
   const [a, b] = duplex({ budget: 16384 });
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 // Broadcast with valid options

From e2507b57e0f83b3a5b11e85c568b692d44bcc07c Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 00:39:33 +0000
Subject: [PATCH 008/202] stream: fix merge settlement tagging and falsy error
 tracking

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/consumers.js        |  55 ++++----
 .../test-stream-iter-consumers-merge.js       | 124 ++++++++++++++++--
 2 files changed, 143 insertions(+), 36 deletions(-)

diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index 30f4eb4f53da..05e159f7e4dc 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -401,6 +401,8 @@ function ondrain(drainable) {
 // Merge Utility
 // =============================================================================
 
+const kNoMergeError = { __proto__: null };
+
 /**
  * Merge multiple async iterables by yielding values in temporal order.
  * @param {...(AsyncIterable<Uint8Array[]>|object)} args
@@ -451,6 +453,7 @@ function merge(...args) {
       let activeCount = normalized.length;
       let waitResolve = null;
       let onAbort;
+      let stopped = false;
 
       if (signal) {
         onAbort = () => {
@@ -468,11 +471,13 @@ function merge(...args) {
       // Called when a source's .next() settles. Pushes the result into
       // the ready queue and wakes the consumer if it's waiting.
       const onSettled = (iterator, result) => {
+        if (stopped) return;
         if (result.done) {
           activeCount--;
         } else {
           ArrayPrototypePush(ready, {
             __proto__: null,
+            kind: 'value',
             iterator,
             value: result.value,
           });
@@ -483,6 +488,19 @@ function merge(...args) {
         }
       };
 
+      const onRejected = (reason) => {
+        if (stopped) return;
+        ArrayPrototypePush(ready, {
+          __proto__: null,
+          kind: 'error',
+          reason,
+        });
+        if (waitResolve) {
+          waitResolve();
+          waitResolve = null;
+        }
+      };
+
       // Start one .next() per source
       const iterators = [];
       for (let i = 0; i < normalized.length; i++) {
@@ -491,17 +509,12 @@ function merge(...args) {
         PromisePrototypeThen(
           iterator.next(),
           (r) => onSettled(iterator, r),
-          (err) => {
-            ArrayPrototypePush(ready, { __proto__: null, error: err });
-            if (waitResolve) {
-              waitResolve();
-              waitResolve = null;
-            }
-          },
+          onRejected,
         );
       }
 
-      let primaryError;
+      let completed = false;
+      let primaryError = kNoMergeError;
       try {
         while (activeCount > 0 || ready.length > 0) {
           signal?.throwIfAborted();
@@ -509,20 +522,14 @@ function merge(...args) {
           // Drain ready queue synchronously
           while (ready.length > 0) {
             const item = ArrayPrototypeShift(ready);
-            if (item?.error) {
-              throw item.error;
+            if (item.kind === 'error') {
+              throw item.reason;
             }
             yield item.value;
             PromisePrototypeThen(
               item.iterator.next(),
               (r) => onSettled(item.iterator, r),
-              (err) => {
-                ArrayPrototypePush(ready, { __proto__: null, error: err });
-                if (waitResolve) {
-                  waitResolve();
-                  waitResolve = null;
-                }
-              },
+              onRejected,
             );
           }
 
@@ -537,9 +544,11 @@ function merge(...args) {
             });
           }
         }
+        completed = true;
       } catch (err) {
         primaryError = err;
       } finally {
+        stopped = true;
         if (onAbort !== undefined) {
           signal.removeEventListener('abort', onAbort);
         }
@@ -549,7 +558,7 @@ function merge(...args) {
         await cleanupIterators(
           iterators,
           primaryError,
-          signal?.aborted && primaryError === signal.reason,
+          !completed,
         );
       }
     },
@@ -557,7 +566,7 @@ function merge(...args) {
 }
 
 async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
-  let cleanupError;
+  let cleanupError = kNoMergeError;
   await SafePromiseAllReturnVoid(iterators, async (iterator) => {
     if (iterator.return) {
       try {
@@ -569,12 +578,12 @@ async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
         }
       } catch (err) {
         // Keep the first cleanup error encountered.
-        cleanupError ??= err;
+        if (cleanupError === kNoMergeError) cleanupError = err;
       }
     }
   });
-  if (cleanupError !== undefined) {
-    if (primaryError !== undefined) {
+  if (cleanupError !== kNoMergeError) {
+    if (primaryError !== kNoMergeError) {
       // Both a primary error and a cleanup error occurred.
       // Wrap in SuppressedError so neither is lost:
       // .error = primaryError, .suppressed = cleanupError.
@@ -584,7 +593,7 @@ async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
     // No primary error - the cleanup error is the only error.
     throw cleanupError;
   }
-  if (primaryError !== undefined) {
+  if (primaryError !== kNoMergeError) {
     throw primaryError;
   }
 }
diff --git a/test/parallel/test-stream-iter-consumers-merge.js b/test/parallel/test-stream-iter-consumers-merge.js
index 84aeb24b6159..e5d20d2dffa3 100644
--- a/test/parallel/test-stream-iter-consumers-merge.js
+++ b/test/parallel/test-stream-iter-consumers-merge.js
@@ -108,6 +108,109 @@ async function testMergeSourceError() {
   );
 }
 
+async function testMergeFalsySourceErrors() {
+  const reasons = [undefined, null, false, 0, '', NaN];
+
+  for (const reason of reasons) {
+    const noError = { __proto__: null };
+    let actual = noError;
+    try {
+      await text(merge(rejectedSource(reason), from('other')));
+    } catch (error) {
+      actual = error;
+    }
+    assert.strictEqual(Object.is(actual, reason), true);
+  }
+}
+
+function rejectedSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return Promise.reject(reason);
+    },
+  };
+}
+
+function pendingSource() {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return new Promise(() => {});
+    },
+    return() {
+      return new Promise(() => {});
+    },
+  };
+}
+
+async function testMergeSourceErrorDoesNotAwaitCleanup() {
+  const reason = new Error('source failed');
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    text(merge(rejectedSource(reason), pendingSource())).then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(outcome.error, reason);
+}
+
+async function testMergeBreakDoesNotAwaitCleanup() {
+  async function* readySource() {
+    yield [Uint8Array.of(1)];
+  }
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    (async () => {
+      for await (const batch of merge(readySource(), pendingSource())) {
+        assert.deepStrictEqual(batch, [Uint8Array.of(1)]);
+        break;
+      }
+      return true;
+    })(),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.strictEqual(outcome, true);
+}
+
+async function testMergeNaNAbortDoesNotAwaitCleanup() {
+  const ac = new AbortController();
+  const iterator = merge(pendingSource(), pendingSource(), {
+    __proto__: null,
+    signal: ac.signal,
+  })[Symbol.asyncIterator]();
+  const next = iterator.next();
+  await new Promise(setImmediate);
+  ac.abort(NaN);
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    next.then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(Object.is(outcome.error, NaN), true);
+}
+
 async function testMergeConsumerBreak() {
   let source1Return = false;
   let source2Return = false;
@@ -296,9 +399,8 @@ async function testMergeCleanupErrorOnly() {
   );
 }
 
-// Primary error + cleanup error: a source throws during iteration AND
-// iterator.return() also throws. Should get a SuppressedError.
-async function testMergePrimaryAndCleanupError() {
+// A primary source error must not wait for asynchronous cleanup failures.
+async function testMergePrimaryErrorPrecedesCleanupError() {
   async function* badSource() {
     yield [new TextEncoder().encode('x')];
     throw new Error('primary boom');
@@ -319,15 +421,7 @@ async function testMergePrimaryAndCleanupError() {
         // Consume until error
       }
     },
-    (err) => {
-      assert.ok(
-        err instanceof SuppressedError,
-        `Expected SuppressedError, got ${err.constructor.name}`,
-      );
-      assert.strictEqual(err.error.message, 'primary boom');
-      assert.strictEqual(err.suppressed.message, 'cleanup boom');
-      return true;
-    },
+    { message: 'primary boom' },
   );
 }
 
@@ -360,6 +454,10 @@ Promise.all([
   testMergeWithAbortSignal(),
   testMergeSyncSources(),
   testMergeSourceError(),
+  testMergeFalsySourceErrors(),
+  testMergeSourceErrorDoesNotAwaitCleanup(),
+  testMergeBreakDoesNotAwaitCleanup(),
+  testMergeNaNAbortDoesNotAwaitCleanup(),
   testMergeConsumerBreak(),
   testMergeSignalMidIteration(),
   testMergeSignalDuringPendingMultiSourceRead(),
@@ -368,6 +466,6 @@ Promise.all([
   testMergeStringSources(),
   testMergeObjectLikeSources(),
   testMergeCleanupErrorOnly(),
-  testMergePrimaryAndCleanupError(),
+  testMergePrimaryErrorPrecedesCleanupError(),
   testMergeBreakWithCleanupError(),
 ]).then(common.mustCall());

From c7447bf30974297539dce32aaf08fc45bce9c221 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 00:47:30 +0000
Subject: [PATCH 009/202] stream: cancel active stream/iter pulls

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/share.js            | 52 ++++++++---
 test/parallel/test-stream-iter-share-async.js | 87 +++++++++++++++++++
 2 files changed, 127 insertions(+), 12 deletions(-)

diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 2cb4ed7fa469..00d9d387ce82 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -10,7 +10,9 @@ const {
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
+  SafePromiseRace,
   SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   SymbolDispose,
   SymbolIterator,
@@ -66,6 +68,9 @@ const {
 // Async Share Implementation
 // =============================================================================
 
+const kNoShareError = Symbol('kNoShareError');
+const kShareCancelled = Symbol('kShareCancelled');
+
 class ShareImpl {
   #source;
   #options;
@@ -78,6 +83,9 @@ class ShareImpl {
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
+  #cancelPromise;
+  #resolveCancel;
+  #cancelError = kNoShareError;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
   /** Cumulative byte size of buffered entries */
@@ -86,6 +94,9 @@ class ShareImpl {
   constructor(source, options) {
     this.#source = source;
     this.#options = options;
+    const { promise, resolve } = PromiseWithResolvers();
+    this.#cancelPromise = promise;
+    this.#resolveCancel = resolve;
   }
 
   get consumerCount() {
@@ -124,6 +135,7 @@ class ShareImpl {
       resolve: null,
       reject: null,
       detached: false,
+      error: kNoShareError,
       pendingNext: PromiseResolve(),
     };
 
@@ -142,25 +154,21 @@ class ShareImpl {
       __proto__: null,
       [SymbolAsyncIterator]() {
         const getNext = async () => {
-          if (self.#sourceError !== undefined) {
-            state.detached = true;
-            self.#consumers.delete(state);
-            throw self.#sourceError;
-          }
-
           // Loop until we get data, source is exhausted, or
           // consumer is detached. Multiple consumers may be woken
           // after a single pull - those that find no data at their
           // cursor must re-pull rather than terminating prematurely.
           for (;;) {
             if (state.detached) {
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             if (self.#cancelled) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -180,7 +188,10 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (self.#sourceError !== undefined) {
+                state.error = self.#sourceError;
+                throw state.error;
+              }
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -188,8 +199,9 @@ class ShareImpl {
             const shouldBuffer = await self.#waitForBufferSpace();
             if (shouldBuffer === null) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -241,14 +253,23 @@ class ShareImpl {
     this.#cancelled = true;
 
     if (reason !== undefined) {
-      this.#sourceError = reason;
+      this.#cancelError = reason;
     }
 
+    this.#resolveCancel(kShareCancelled);
+    this.#resolveCancel = null;
+
     if (this.#sourceIterator?.return) {
-      PromisePrototypeThen(this.#sourceIterator.return(), undefined, () => {});
+      try {
+        PromisePrototypeThen(
+          PromiseResolve(this.#sourceIterator.return()), undefined, () => {});
+      } catch {
+        // Cancellation has precedence over source cleanup errors.
+      }
     }
 
     for (const consumer of this.#consumers) {
+      consumer.error = this.#cancelError;
       if (consumer.resolve) {
         if (reason !== undefined) {
           consumer.reject?.(reason);
@@ -261,6 +282,8 @@ class ShareImpl {
       consumer.detached = true;
     }
     this.#consumers.clear();
+    this.#buffer.clear();
+    this.#bufferedBytes = 0;
 
     for (let i = 0; i < this.#pullWaiters.length; i++) {
       this.#pullWaiters[i]();
@@ -364,7 +387,12 @@ class ShareImpl {
           }
         }
 
-        const result = await this.#sourceIterator.next();
+        const result = await SafePromiseRace([
+          this.#sourceIterator.next(),
+          this.#cancelPromise,
+        ]);
+
+        if (this.#cancelled || result === kShareCancelled) return;
 
         if (result.done) {
           this.#sourceExhausted = true;
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index c96a0cb0f3c3..dafb157a7512 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -143,6 +143,70 @@ async function testShareCancelWithFalsyReason() {
   }
 }
 
+async function testShareCancelWhileSourcePullPending() {
+  const noReason = { __proto__: null };
+
+  for (const reason of [noReason, 0]) {
+    const sourceStarted = Promise.withResolvers();
+    const sourceNext = Promise.withResolvers();
+    let nextCalls = 0;
+    let returnCalls = 0;
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() {
+            nextCalls++;
+            sourceStarted.resolve();
+            return sourceNext.promise;
+          },
+          async return() {
+            returnCalls++;
+            return { __proto__: null, done: true, value: undefined };
+          },
+        };
+      },
+    };
+    const shared = share(source);
+    const iterator = shared.pull()[Symbol.asyncIterator]();
+    const read = iterator.next().then(
+      (value) => ({ __proto__: null, rejected: false, value }),
+      (error) => ({ __proto__: null, rejected: true, error }),
+    );
+
+    await sourceStarted.promise;
+    if (reason === noReason) {
+      shared.cancel();
+    } else {
+      shared.cancel(reason);
+    }
+
+    const timedOut = { __proto__: null };
+    const outcome = await Promise.race([
+      read,
+      new Promise((resolve) => setImmediate(resolve, timedOut)),
+    ]);
+    assert.notStrictEqual(outcome, timedOut);
+    if (reason === noReason) {
+      assert.strictEqual(outcome.rejected, false);
+      assert.strictEqual(outcome.value.done, true);
+    } else {
+      assert.strictEqual(outcome.rejected, true);
+      assert.strictEqual(outcome.error, reason);
+    }
+    assert.strictEqual(nextCalls, 1);
+
+    sourceNext.resolve({
+      __proto__: null,
+      done: false,
+      value: [Uint8Array.of(1)],
+    });
+    await new Promise(setImmediate);
+    assert.strictEqual(returnCalls, 1);
+  }
+}
+
 async function testShareAbortSignal() {
   const ac = new AbortController();
   const reason = new Error('share aborted');
@@ -272,6 +336,27 @@ async function testShareSourceError() {
   }, { message: 'share source boom' });
 }
 
+async function testShareSourceErrorFollowsBufferedData() {
+  const reason = new Error('share source boom');
+  async function* failingSource() {
+    yield [Uint8Array.of(1)];
+    throw reason;
+  }
+
+  const shared = share(failingSource());
+  const fast = shared.pull()[Symbol.asyncIterator]();
+  const slow = shared.pull()[Symbol.asyncIterator]();
+  const returned = shared.pull()[Symbol.asyncIterator]();
+  await returned.return();
+
+  assert.deepStrictEqual((await fast.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(fast.next(), (error) => error === reason);
+
+  assert.deepStrictEqual((await slow.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(slow.next(), (error) => error === reason);
+  assert.strictEqual((await returned.next()).done, true);
+}
+
 async function testShareLateJoiningConsumer() {
   // A consumer that joins after some data has been consumed should only
   // see data remaining in the buffer (not items already trimmed).
@@ -380,12 +465,14 @@ Promise.all([
   testShareCancelMidIteration(),
   testShareCancelWithReason(),
   testShareCancelWithFalsyReason(),
+  testShareCancelWhileSourcePullPending(),
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
   testSharePullPreAbortedSignalDoesNotAddConsumer(),
   testShareAlreadyAborted(),
   testShareSourceError(),
+  testShareSourceErrorFollowsBufferedData(),
   testShareLateJoiningConsumer(),
   testShareConsumerBreak(),
   testShareMultipleConsumersConcurrentPull(),

From 3486489dcef481e860880ce9aeccbb3134cd4b1e Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 00:54:14 +0000
Subject: [PATCH 010/202] stream: ensure pipeToSync requires synchronous close

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/pull.js             | 15 +++++++---
 test/parallel/test-stream-iter-pipeto-edge.js | 30 ++++++++++++-------
 test/parallel/test-stream-iter-pipeto.js      |  5 +++-
 .../test-stream-iter-resizable-buffers.js     |  3 +-
 4 files changed, 36 insertions(+), 17 deletions(-)

diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index a9a77377a84e..c1e42f03dc38 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -24,6 +24,7 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
     ERR_OUT_OF_RANGE,
   },
 } = require('internal/errors');
@@ -981,6 +982,13 @@ function pullWithConsumerCleanup(source, transforms, signal) {
  */
 function pipeToSync(source, ...args) {
   const { transforms, writer, options } = parsePipeToArgs(args, 'writeSync');
+  const hasWritevSync = typeof writer.writevSync === 'function';
+  const endSync = writer.endSync;
+
+  if (!options?.preventClose && typeof endSync !== 'function') {
+    throw new ERR_INVALID_ARG_TYPE(
+      'writer.endSync', 'Function', endSync);
+  }
 
   // Normalize source and create pipeline
   const normalized = fromSync(source);
@@ -989,8 +997,6 @@ function pipeToSync(source, ...args) {
     normalized;
 
   let totalBytes = 0;
-  const hasWritevSync = typeof writer.writevSync === 'function';
-  const hasEndSync = typeof writer.endSync === 'function';
 
   try {
     for (const batch of pipeline) {
@@ -1019,8 +1025,9 @@ function pipeToSync(source, ...args) {
     }
 
     if (!options?.preventClose) {
-      if (!hasEndSync || writer.endSync() < 0) {
-        writer.end?.();
+      if (FunctionPrototypeCall(endSync, writer) < 0) {
+        throw new ERR_INVALID_STATE(
+          'Writer could not be closed synchronously');
       }
     }
   } catch (error) {
diff --git a/test/parallel/test-stream-iter-pipeto-edge.js b/test/parallel/test-stream-iter-pipeto-edge.js
index 3f09c4dfd42d..13223a226a1f 100644
--- a/test/parallel/test-stream-iter-pipeto-edge.js
+++ b/test/parallel/test-stream-iter-pipeto-edge.js
@@ -1,33 +1,41 @@
 // Flags: --experimental-stream-iter
 'use strict';
 
-// Edge case tests for pipeToSync: endSync fallback, preventFail.
+// Edge case tests for pipeToSync close and failure behavior.
 
 const common = require('../common');
 const assert = require('assert');
 const { pipeToSync, fromSync } = require('stream/iter');
 
-// pipeToSync endSync returns negative → falls back to end()
-async function testPipeToSyncEndSyncFallback() {
+// pipeToSync cannot complete when endSync() requires async fallback.
+async function testPipeToSyncEndSyncFailure() {
   let endCalled = false;
   const writer = {
     writeSync() { return true; },
-    endSync() { return -1; }, // Negative → triggers end() fallback
+    endSync() { return -1; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer, { preventFail: true }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual(endCalled, false);
 }
 
-// pipeToSync endSync missing → falls back to end()
+// pipeToSync requires endSync() when closing is enabled.
 async function testPipeToSyncNoEndSync() {
+  let writeCalled = false;
   let endCalled = false;
   const writer = {
-    writeSync() { return true; },
+    writeSync() { writeCalled = true; return true; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(writeCalled, false);
+  assert.strictEqual(endCalled, false);
 }
 
 // pipeToSync with preventFail: true — source error does NOT call fail()
@@ -61,7 +69,7 @@ async function testPipeToSyncPreventClose() {
 }
 
 Promise.all([
-  testPipeToSyncEndSyncFallback(),
+  testPipeToSyncEndSyncFailure(),
   testPipeToSyncNoEndSync(),
   testPipeToSyncPreventFail(),
   testPipeToSyncPreventClose(),
diff --git a/test/parallel/test-stream-iter-pipeto.js b/test/parallel/test-stream-iter-pipeto.js
index 5d8b5088f540..f16d7ae89972 100644
--- a/test/parallel/test-stream-iter-pipeto.js
+++ b/test/parallel/test-stream-iter-pipeto.js
@@ -71,6 +71,7 @@ async function testPipeToSyncSourceError() {
   let failCalled = false;
   const writer = {
     writeSync() { return true; },
+    endSync: common.mustNotCall(),
     fail(reason) { failCalled = true; },
   };
   function* failingSource() {
@@ -127,6 +128,7 @@ async function testPipeToSyncWithTransforms() {
   const chunks = [];
   const writer = {
     writeSync(chunk) { chunks.push(new TextDecoder().decode(chunk)); return true; },
+    endSync() { return 0; },
   };
   const upper = (batch) => {
     if (batch === null) return null;
@@ -160,6 +162,7 @@ async function testPipeToSyncWriterTransformMethodIgnored() {
       chunks.push(new TextDecoder().decode(chunk));
       return true;
     },
+    endSync() { return 0; },
   };
 
   pipeToSync(fromSync('hello'), writer);
@@ -240,7 +243,7 @@ async function testPipeToSyncMinimalWriter() {
     },
   };
 
-  pipeToSync(fromSync('minimal-sync'), minimalWriter);
+  pipeToSync(fromSync('minimal-sync'), minimalWriter, { preventClose: true });
   assert.strictEqual(chunks.length > 0, true);
 }
 
diff --git a/test/parallel/test-stream-iter-resizable-buffers.js b/test/parallel/test-stream-iter-resizable-buffers.js
index c4be26774ac6..b66973393cac 100644
--- a/test/parallel/test-stream-iter-resizable-buffers.js
+++ b/test/parallel/test-stream-iter-resizable-buffers.js
@@ -161,7 +161,8 @@ async function testPipeRejectsWriterResize() {
     fail: common.mustCall(),
   };
   assert.throws(
-    () => pipeToSync([new Uint8Array(syncBuffer)], syncWriter),
+    () => pipeToSync(
+      [new Uint8Array(syncBuffer)], syncWriter, { preventClose: true }),
     kResizeError,
   );
 }

From f5e6cfa965920acdeaf7d5dabd22579289841b33 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:00:22 +0000
Subject: [PATCH 011/202] stream: replace object sentinel with symbol

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/consumers.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index 05e159f7e4dc..446fde1d88e3 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -18,6 +18,7 @@ const {
   Promise,
   PromisePrototypeThen,
   SafePromiseAllReturnVoid,
+  Symbol,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -401,7 +402,7 @@ function ondrain(drainable) {
 // Merge Utility
 // =============================================================================
 
-const kNoMergeError = { __proto__: null };
+const kNoMergeError = Symbol('kNoMergeError');
 
 /**
  * Merge multiple async iterables by yielding values in temporal order.

From d92716080299c6be8c1c7dfe57c9f97320c7c083 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 19:54:01 +0000
Subject: [PATCH 012/202] stream: address stream/iter review feedback

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65652
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/streams/iter/consumers.js        | 20 ++++++++++-------
 lib/internal/streams/iter/duplex.js           |  7 +++++-
 lib/internal/streams/iter/push.js             |  8 +++++++
 .../test-stream-iter-consumers-merge.js       | 22 +++++++++++++++++++
 test/parallel/test-stream-iter-duplex.js      | 15 +++++++++++++
 5 files changed, 63 insertions(+), 9 deletions(-)

diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index 446fde1d88e3..0a317939e8f4 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -18,6 +18,7 @@ const {
   Promise,
   PromisePrototypeThen,
   SafePromiseAllReturnVoid,
+  SafeSet,
   Symbol,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
@@ -451,6 +452,7 @@ function merge(...args) {
       // async tick per batch. Each source has at most one pending .next()
       // at a time. Every batch from every source is preserved.
       const ready = [];
+      const pendingPulls = new SafeSet();
       let activeCount = normalized.length;
       let waitResolve = null;
       let onAbort;
@@ -472,6 +474,7 @@ function merge(...args) {
       // Called when a source's .next() settles. Pushes the result into
       // the ready queue and wakes the consumer if it's waiting.
       const onSettled = (iterator, result) => {
+        pendingPulls.delete(iterator);
         if (stopped) return;
         if (result.done) {
           activeCount--;
@@ -489,7 +492,8 @@ function merge(...args) {
         }
       };
 
-      const onRejected = (reason) => {
+      const onRejected = (iterator, reason) => {
+        pendingPulls.delete(iterator);
         if (stopped) return;
         ArrayPrototypePush(ready, {
           __proto__: null,
@@ -507,14 +511,14 @@ function merge(...args) {
       for (let i = 0; i < normalized.length; i++) {
         const iterator = normalized[i][SymbolAsyncIterator]();
         ArrayPrototypePush(iterators, iterator);
+        pendingPulls.add(iterator);
         PromisePrototypeThen(
           iterator.next(),
           (r) => onSettled(iterator, r),
-          onRejected,
+          (reason) => onRejected(iterator, reason),
         );
       }
 
-      let completed = false;
       let primaryError = kNoMergeError;
       try {
         while (activeCount > 0 || ready.length > 0) {
@@ -527,10 +531,11 @@ function merge(...args) {
               throw item.reason;
             }
             yield item.value;
+            pendingPulls.add(item.iterator);
             PromisePrototypeThen(
               item.iterator.next(),
               (r) => onSettled(item.iterator, r),
-              onRejected,
+              (reason) => onRejected(item.iterator, reason),
             );
           }
 
@@ -545,7 +550,6 @@ function merge(...args) {
             });
           }
         }
-        completed = true;
       } catch (err) {
         primaryError = err;
       } finally {
@@ -559,20 +563,20 @@ function merge(...args) {
         await cleanupIterators(
           iterators,
           primaryError,
-          !completed,
+          pendingPulls,
         );
       }
     },
   };
 }
 
-async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
+async function cleanupIterators(iterators, primaryError, pendingPulls) {
   let cleanupError = kNoMergeError;
   await SafePromiseAllReturnVoid(iterators, async (iterator) => {
     if (iterator.return) {
       try {
         const result = iterator.return();
-        if (skipAwaitCleanup) {
+        if (pendingPulls.has(iterator)) {
           markPromiseAsHandled(result);
         } else {
           await result;
diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index 50a04961b1f2..a60c510c4199 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -12,6 +12,7 @@ const {
 } = primordials;
 
 const {
+  isConsumerReturnError,
   push,
 } = require('internal/streams/iter/push');
 const {
@@ -99,7 +100,11 @@ async function closeDuplexChannel(writer, closeIterator) {
   const returnPromise = closeIterator.return();
 
   if (endPromise !== undefined) {
-    await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+    try {
+      await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+    } catch (error) {
+      if (!isConsumerReturnError(error)) throw error;
+    }
   } else {
     await returnPromise;
   }
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 36a2034e5298..fa84cafdfde7 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -11,6 +11,7 @@ const {
   PromiseReject,
   PromiseResolve,
   PromiseWithResolvers,
+  SafeWeakSet,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
@@ -55,6 +56,11 @@ const {
 } = require('internal/streams/iter/ringbuffer');
 
 const kNoFailReason = Symbol('kNoFailReason');
+const consumerReturnErrors = new SafeWeakSet();
+
+function isConsumerReturnError(error) {
+  return consumerReturnErrors.has(error);
+}
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -471,6 +477,7 @@ class PushQueue {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'returned';
     const error = new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+    consumerReturnErrors.add(error);
     this.#terminateWriterFromConsumer(error);
     this.#resolvePendingReads();
     // Resolve pending drains with false - no more data will be consumed
@@ -791,5 +798,6 @@ function push(...args) {
 }
 
 module.exports = {
+  isConsumerReturnError,
   push,
 };
diff --git a/test/parallel/test-stream-iter-consumers-merge.js b/test/parallel/test-stream-iter-consumers-merge.js
index e5d20d2dffa3..becf68ee63a1 100644
--- a/test/parallel/test-stream-iter-consumers-merge.js
+++ b/test/parallel/test-stream-iter-consumers-merge.js
@@ -447,6 +447,27 @@ async function testMergeBreakWithCleanupError() {
   );
 }
 
+async function testMergeMultiSourceBreakWithCleanupError() {
+  async function* failingReturnSource() {
+    try {
+      yield [new TextEncoder().encode('data')];
+    } finally {
+      await Promise.resolve();
+      throwInFinally('async cleanup on break');
+    }
+  }
+
+  await assert.rejects(
+    async () => {
+      // eslint-disable-next-line no-unused-vars
+      for await (const _ of merge(failingReturnSource(), from('other'))) {
+        break;
+      }
+    },
+    { message: 'async cleanup on break' },
+  );
+}
+
 Promise.all([
   testMergeTwoSources(),
   testMergeSingleSource(),
@@ -468,4 +489,5 @@ Promise.all([
   testMergeCleanupErrorOnly(),
   testMergePrimaryErrorPrecedesCleanupError(),
   testMergeBreakWithCleanupError(),
+  testMergeMultiSourceBreakWithCleanupError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-duplex.js b/test/parallel/test-stream-iter-duplex.js
index 5d617baa9882..354fa28b67a6 100644
--- a/test/parallel/test-stream-iter-duplex.js
+++ b/test/parallel/test-stream-iter-duplex.js
@@ -77,6 +77,20 @@ async function testChannelClose() {
   assert.strictEqual(batches.length, 0);
 }
 
+async function testConcurrentChannelClose() {
+  const [channelA, channelB] = duplex();
+
+  const results = await Promise.allSettled([
+    channelA.close(),
+    channelB.close(),
+  ]);
+
+  assert.deepStrictEqual(results, [
+    { status: 'fulfilled', value: undefined },
+    { status: 'fulfilled', value: undefined },
+  ]);
+}
+
 async function testWithOptions() {
   const [channelA, channelB] = duplex({
     budget: 16384,
@@ -223,6 +237,7 @@ Promise.all([
   testBidirectional(),
   testMultipleWrites(),
   testChannelClose(),
+  testConcurrentChannelClose(),
   testWithOptions(),
   testPerChannelOptions(),
   testAbortSignal(),

From c90e4e73348ac587fde03b080e2ebc671a5a429f Mon Sep 17 00:00:00 2001
From: npm CLI robot <npm-cli+bot@github.com>
Date: Wed, 2 Sep 2026 06:42:27 -0700
Subject: [PATCH 013/202] deps: upgrade npm to 11.19.1

PR-URL: https://github.com/nodejs/node/pull/65573
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 deps/npm/docs/content/commands/npm-ls.md      |   2 +-
 deps/npm/docs/content/commands/npm.md         |   2 +-
 deps/npm/docs/output/commands/npm-access.html |   4 +-
 .../npm/docs/output/commands/npm-adduser.html |   4 +-
 .../output/commands/npm-approve-scripts.html  |   4 +-
 deps/npm/docs/output/commands/npm-audit.html  |   4 +-
 deps/npm/docs/output/commands/npm-bugs.html   |   4 +-
 deps/npm/docs/output/commands/npm-cache.html  |   4 +-
 deps/npm/docs/output/commands/npm-ci.html     |   4 +-
 .../docs/output/commands/npm-completion.html  |   4 +-
 deps/npm/docs/output/commands/npm-config.html |   4 +-
 deps/npm/docs/output/commands/npm-dedupe.html |   4 +-
 .../output/commands/npm-deny-scripts.html     |   4 +-
 .../docs/output/commands/npm-deprecate.html   |   4 +-
 deps/npm/docs/output/commands/npm-diff.html   |   4 +-
 .../docs/output/commands/npm-dist-tag.html    |   4 +-
 deps/npm/docs/output/commands/npm-docs.html   |   4 +-
 deps/npm/docs/output/commands/npm-doctor.html |   4 +-
 deps/npm/docs/output/commands/npm-edit.html   |   4 +-
 deps/npm/docs/output/commands/npm-exec.html   |   4 +-
 .../npm/docs/output/commands/npm-explain.html |   4 +-
 .../npm/docs/output/commands/npm-explore.html |   4 +-
 .../docs/output/commands/npm-find-dupes.html  |   4 +-
 deps/npm/docs/output/commands/npm-fund.html   |   4 +-
 deps/npm/docs/output/commands/npm-get.html    |   4 +-
 .../docs/output/commands/npm-help-search.html |   4 +-
 deps/npm/docs/output/commands/npm-help.html   |   4 +-
 deps/npm/docs/output/commands/npm-init.html   |   4 +-
 .../output/commands/npm-install-ci-test.html  |   4 +-
 .../output/commands/npm-install-scripts.html  |   4 +-
 .../output/commands/npm-install-test.html     |   4 +-
 .../npm/docs/output/commands/npm-install.html |   4 +-
 deps/npm/docs/output/commands/npm-link.html   |   4 +-
 deps/npm/docs/output/commands/npm-ll.html     |   4 +-
 deps/npm/docs/output/commands/npm-login.html  |   4 +-
 deps/npm/docs/output/commands/npm-logout.html |   4 +-
 deps/npm/docs/output/commands/npm-ls.html     |   6 +-
 deps/npm/docs/output/commands/npm-org.html    |   4 +-
 .../docs/output/commands/npm-outdated.html    |   4 +-
 deps/npm/docs/output/commands/npm-owner.html  |   4 +-
 deps/npm/docs/output/commands/npm-pack.html   |   4 +-
 deps/npm/docs/output/commands/npm-ping.html   |   4 +-
 deps/npm/docs/output/commands/npm-pkg.html    |   4 +-
 deps/npm/docs/output/commands/npm-prefix.html |   4 +-
 .../npm/docs/output/commands/npm-profile.html |   4 +-
 deps/npm/docs/output/commands/npm-prune.html  |   4 +-
 .../npm/docs/output/commands/npm-publish.html |   4 +-
 deps/npm/docs/output/commands/npm-query.html  |   4 +-
 .../npm/docs/output/commands/npm-rebuild.html |   4 +-
 deps/npm/docs/output/commands/npm-repo.html   |   4 +-
 .../npm/docs/output/commands/npm-restart.html |   4 +-
 deps/npm/docs/output/commands/npm-root.html   |   4 +-
 deps/npm/docs/output/commands/npm-run.html    |   4 +-
 deps/npm/docs/output/commands/npm-sbom.html   |   4 +-
 deps/npm/docs/output/commands/npm-search.html |   4 +-
 deps/npm/docs/output/commands/npm-set.html    |   4 +-
 .../docs/output/commands/npm-shrinkwrap.html  |   4 +-
 deps/npm/docs/output/commands/npm-stage.html  |   4 +-
 deps/npm/docs/output/commands/npm-star.html   |   4 +-
 deps/npm/docs/output/commands/npm-stars.html  |   4 +-
 deps/npm/docs/output/commands/npm-start.html  |   4 +-
 deps/npm/docs/output/commands/npm-stop.html   |   4 +-
 deps/npm/docs/output/commands/npm-team.html   |   4 +-
 deps/npm/docs/output/commands/npm-test.html   |   4 +-
 deps/npm/docs/output/commands/npm-token.html  |   4 +-
 deps/npm/docs/output/commands/npm-trust.html  |   4 +-
 .../docs/output/commands/npm-undeprecate.html |   4 +-
 .../docs/output/commands/npm-uninstall.html   |   4 +-
 .../docs/output/commands/npm-unpublish.html   |   4 +-
 deps/npm/docs/output/commands/npm-unstar.html |   4 +-
 deps/npm/docs/output/commands/npm-update.html |   4 +-
 .../npm/docs/output/commands/npm-version.html |   4 +-
 deps/npm/docs/output/commands/npm-view.html   |   4 +-
 deps/npm/docs/output/commands/npm-whoami.html |   4 +-
 deps/npm/docs/output/commands/npm.html        |   6 +-
 deps/npm/docs/output/commands/npx.html        |   4 +-
 .../docs/output/configuring-npm/folders.html  |   4 +-
 .../docs/output/configuring-npm/install.html  |   4 +-
 .../output/configuring-npm/npm-global.html    |   4 +-
 .../docs/output/configuring-npm/npm-json.html |   4 +-
 .../configuring-npm/npm-shrinkwrap-json.html  |   4 +-
 .../docs/output/configuring-npm/npmrc.html    |   4 +-
 .../output/configuring-npm/package-json.html  |   4 +-
 .../configuring-npm/package-lock-json.html    |   4 +-
 deps/npm/docs/output/using-npm/config.html    |   4 +-
 .../using-npm/dependency-selectors.html       |   4 +-
 .../npm/docs/output/using-npm/developers.html |   4 +-
 deps/npm/docs/output/using-npm/logging.html   |   4 +-
 deps/npm/docs/output/using-npm/orgs.html      |   4 +-
 .../docs/output/using-npm/package-spec.html   |   4 +-
 deps/npm/docs/output/using-npm/registry.html  |   4 +-
 deps/npm/docs/output/using-npm/removal.html   |   4 +-
 deps/npm/docs/output/using-npm/scope.html     |   4 +-
 deps/npm/docs/output/using-npm/scripts.html   |   4 +-
 .../npm/docs/output/using-npm/workspaces.html |   4 +-
 deps/npm/lib/commands/pack.js                 |   1 +
 deps/npm/man/man1/npm-access.1                |   2 +-
 deps/npm/man/man1/npm-adduser.1               |   2 +-
 deps/npm/man/man1/npm-approve-scripts.1       |   2 +-
 deps/npm/man/man1/npm-audit.1                 |   2 +-
 deps/npm/man/man1/npm-bugs.1                  |   2 +-
 deps/npm/man/man1/npm-cache.1                 |   2 +-
 deps/npm/man/man1/npm-ci.1                    |   2 +-
 deps/npm/man/man1/npm-completion.1            |   2 +-
 deps/npm/man/man1/npm-config.1                |   2 +-
 deps/npm/man/man1/npm-dedupe.1                |   2 +-
 deps/npm/man/man1/npm-deny-scripts.1          |   2 +-
 deps/npm/man/man1/npm-deprecate.1             |   2 +-
 deps/npm/man/man1/npm-diff.1                  |   2 +-
 deps/npm/man/man1/npm-dist-tag.1              |   2 +-
 deps/npm/man/man1/npm-docs.1                  |   2 +-
 deps/npm/man/man1/npm-doctor.1                |   2 +-
 deps/npm/man/man1/npm-edit.1                  |   2 +-
 deps/npm/man/man1/npm-exec.1                  |   2 +-
 deps/npm/man/man1/npm-explain.1               |   2 +-
 deps/npm/man/man1/npm-explore.1               |   2 +-
 deps/npm/man/man1/npm-find-dupes.1            |   2 +-
 deps/npm/man/man1/npm-fund.1                  |   2 +-
 deps/npm/man/man1/npm-get.1                   |   2 +-
 deps/npm/man/man1/npm-help-search.1           |   2 +-
 deps/npm/man/man1/npm-help.1                  |   2 +-
 deps/npm/man/man1/npm-init.1                  |   2 +-
 deps/npm/man/man1/npm-install-ci-test.1       |   2 +-
 deps/npm/man/man1/npm-install-scripts.1       |   2 +-
 deps/npm/man/man1/npm-install-test.1          |   2 +-
 deps/npm/man/man1/npm-install.1               |   2 +-
 deps/npm/man/man1/npm-link.1                  |   2 +-
 deps/npm/man/man1/npm-ll.1                    |   2 +-
 deps/npm/man/man1/npm-login.1                 |   2 +-
 deps/npm/man/man1/npm-logout.1                |   2 +-
 deps/npm/man/man1/npm-ls.1                    |   4 +-
 deps/npm/man/man1/npm-org.1                   |   2 +-
 deps/npm/man/man1/npm-outdated.1              |   2 +-
 deps/npm/man/man1/npm-owner.1                 |   2 +-
 deps/npm/man/man1/npm-pack.1                  |   2 +-
 deps/npm/man/man1/npm-ping.1                  |   2 +-
 deps/npm/man/man1/npm-pkg.1                   |   2 +-
 deps/npm/man/man1/npm-prefix.1                |   2 +-
 deps/npm/man/man1/npm-profile.1               |   2 +-
 deps/npm/man/man1/npm-prune.1                 |   2 +-
 deps/npm/man/man1/npm-publish.1               |   2 +-
 deps/npm/man/man1/npm-query.1                 |   2 +-
 deps/npm/man/man1/npm-rebuild.1               |   2 +-
 deps/npm/man/man1/npm-repo.1                  |   2 +-
 deps/npm/man/man1/npm-restart.1               |   2 +-
 deps/npm/man/man1/npm-root.1                  |   2 +-
 deps/npm/man/man1/npm-run.1                   |   2 +-
 deps/npm/man/man1/npm-sbom.1                  |   2 +-
 deps/npm/man/man1/npm-search.1                |   2 +-
 deps/npm/man/man1/npm-set.1                   |   2 +-
 deps/npm/man/man1/npm-shrinkwrap.1            |   2 +-
 deps/npm/man/man1/npm-stage.1                 |   2 +-
 deps/npm/man/man1/npm-star.1                  |   2 +-
 deps/npm/man/man1/npm-stars.1                 |   2 +-
 deps/npm/man/man1/npm-start.1                 |   2 +-
 deps/npm/man/man1/npm-stop.1                  |   2 +-
 deps/npm/man/man1/npm-team.1                  |   2 +-
 deps/npm/man/man1/npm-test.1                  |   2 +-
 deps/npm/man/man1/npm-token.1                 |   2 +-
 deps/npm/man/man1/npm-trust.1                 |   2 +-
 deps/npm/man/man1/npm-undeprecate.1           |   2 +-
 deps/npm/man/man1/npm-uninstall.1             |   2 +-
 deps/npm/man/man1/npm-unpublish.1             |   2 +-
 deps/npm/man/man1/npm-unstar.1                |   2 +-
 deps/npm/man/man1/npm-update.1                |   2 +-
 deps/npm/man/man1/npm-version.1               |   2 +-
 deps/npm/man/man1/npm-view.1                  |   2 +-
 deps/npm/man/man1/npm-whoami.1                |   2 +-
 deps/npm/man/man1/npm.1                       |   4 +-
 deps/npm/man/man1/npx.1                       |   2 +-
 deps/npm/man/man5/folders.5                   |   2 +-
 deps/npm/man/man5/install.5                   |   2 +-
 deps/npm/man/man5/npm-global.5                |   2 +-
 deps/npm/man/man5/npm-json.5                  |   2 +-
 deps/npm/man/man5/npm-shrinkwrap-json.5       |   2 +-
 deps/npm/man/man5/npmrc.5                     |   2 +-
 deps/npm/man/man5/package-json.5              |   2 +-
 deps/npm/man/man5/package-lock-json.5         |   2 +-
 deps/npm/man/man7/config.7                    |   2 +-
 deps/npm/man/man7/dependency-selectors.7      |   2 +-
 deps/npm/man/man7/developers.7                |   2 +-
 deps/npm/man/man7/logging.7                   |   2 +-
 deps/npm/man/man7/orgs.7                      |   2 +-
 deps/npm/man/man7/package-spec.7              |   2 +-
 deps/npm/man/man7/registry.7                  |   2 +-
 deps/npm/man/man7/removal.7                   |   2 +-
 deps/npm/man/man7/scope.7                     |   2 +-
 deps/npm/man/man7/scripts.7                   |   2 +-
 deps/npm/man/man7/workspaces.7                |   2 +-
 .../brace-expansion/dist/commonjs/index.js    | 246 ++++++++++------
 .../brace-expansion/dist/esm/index.js         | 244 ++++++++++------
 .../node_modules/brace-expansion/package.json |   4 +-
 .../node_modules/ip-address/dist/common.js    |  49 +++-
 deps/npm/node_modules/ip-address/dist/ipv4.js |  68 +++--
 deps/npm/node_modules/ip-address/dist/ipv6.js | 272 +++++++++++++-----
 .../ip-address/dist/v4/constants.js           |   6 +-
 .../ip-address/dist/v6/constants.js           |   5 +-
 deps/npm/node_modules/ip-address/package.json |  10 +-
 deps/npm/node_modules/libnpmpack/lib/index.js |   5 +
 deps/npm/node_modules/libnpmpack/package.json |   2 +-
 .../tar/dist/commonjs/index.min.js            |   4 +-
 .../node_modules/tar/dist/commonjs/list.js    |  12 +-
 .../node_modules/tar/dist/commonjs/parse.js   |  10 +
 .../node_modules/tar/dist/esm/index.min.js    |   4 +-
 deps/npm/node_modules/tar/dist/esm/list.js    |  12 +-
 deps/npm/node_modules/tar/dist/esm/parse.js   |  10 +
 deps/npm/node_modules/tar/package.json        |   2 +-
 .../node_modules/undici/lib/core/request.js   |  13 +-
 .../undici/lib/dispatcher/client-h1.js        |  13 +-
 .../undici/lib/handler/retry-handler.js       |  34 +++
 .../undici/lib/web/cookies/util.js            |  88 +++++-
 deps/npm/node_modules/undici/package.json     |   2 +-
 deps/npm/package.json                         |   6 +-
 deps/npm/test/lib/commands/pack.js            |  19 ++
 deps/npm/test/lib/commands/publish.js         |  19 ++
 215 files changed, 1146 insertions(+), 584 deletions(-)

diff --git a/deps/npm/docs/content/commands/npm-ls.md b/deps/npm/docs/content/commands/npm-ls.md
index 24746c173b7c..b38603c203fc 100644
--- a/deps/npm/docs/content/commands/npm-ls.md
+++ b/deps/npm/docs/content/commands/npm-ls.md
@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```
diff --git a/deps/npm/docs/content/commands/npm.md b/deps/npm/docs/content/commands/npm.md
index 769bb262064e..75157bd7b598 100644
--- a/deps/npm/docs/content/commands/npm.md
+++ b/deps/npm/docs/content/commands/npm.md
@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.19.0
+11.19.1
 
 ### Description
 
diff --git a/deps/npm/docs/output/commands/npm-access.html b/deps/npm/docs/output/commands/npm-access.html
index 2a044ef5ed59..ac6df64b960b 100644
--- a/deps/npm/docs/output/commands/npm-access.html
+++ b/deps/npm/docs/output/commands/npm-access.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----11190">
+<h1 id="----npm-access----11191">
     <span>npm-access</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-adduser.html b/deps/npm/docs/output/commands/npm-adduser.html
index c59e21d94298..29aec6314e96 100644
--- a/deps/npm/docs/output/commands/npm-adduser.html
+++ b/deps/npm/docs/output/commands/npm-adduser.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-adduser----11190">
+<h1 id="----npm-adduser----11191">
     <span>npm-adduser</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Add a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-approve-scripts.html b/deps/npm/docs/output/commands/npm-approve-scripts.html
index 55c9db2b2a2b..3d61cc8ea23a 100644
--- a/deps/npm/docs/output/commands/npm-approve-scripts.html
+++ b/deps/npm/docs/output/commands/npm-approve-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-approve-scripts----11190">
+<h1 id="----npm-approve-scripts----11191">
     <span>npm-approve-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Approve install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-audit.html b/deps/npm/docs/output/commands/npm-audit.html
index 438891b03cbc..9117faa9bed5 100644
--- a/deps/npm/docs/output/commands/npm-audit.html
+++ b/deps/npm/docs/output/commands/npm-audit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----11190">
+<h1 id="----npm-audit----11191">
     <span>npm-audit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-bugs.html b/deps/npm/docs/output/commands/npm-bugs.html
index eb7a91c9457f..63f4c29210a2 100644
--- a/deps/npm/docs/output/commands/npm-bugs.html
+++ b/deps/npm/docs/output/commands/npm-bugs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----11190">
+<h1 id="----npm-bugs----11191">
     <span>npm-bugs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-cache.html b/deps/npm/docs/output/commands/npm-cache.html
index 374878c8d04e..3377b00cc56c 100644
--- a/deps/npm/docs/output/commands/npm-cache.html
+++ b/deps/npm/docs/output/commands/npm-cache.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----11190">
+<h1 id="----npm-cache----11191">
     <span>npm-cache</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ci.html b/deps/npm/docs/output/commands/npm-ci.html
index 0a91d5159b12..edde5bbdef66 100644
--- a/deps/npm/docs/output/commands/npm-ci.html
+++ b/deps/npm/docs/output/commands/npm-ci.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----11190">
+<h1 id="----npm-ci----11191">
     <span>npm-ci</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-completion.html b/deps/npm/docs/output/commands/npm-completion.html
index dc927a82868a..b5a6f445d451 100644
--- a/deps/npm/docs/output/commands/npm-completion.html
+++ b/deps/npm/docs/output/commands/npm-completion.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-completion----11190">
+<h1 id="----npm-completion----11191">
     <span>npm-completion</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Tab Completion for npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-config.html b/deps/npm/docs/output/commands/npm-config.html
index 5b4e3e1204bc..c9ea9080cf78 100644
--- a/deps/npm/docs/output/commands/npm-config.html
+++ b/deps/npm/docs/output/commands/npm-config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-config----11190">
+<h1 id="----npm-config----11191">
     <span>npm-config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage the npm configuration files</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dedupe.html b/deps/npm/docs/output/commands/npm-dedupe.html
index 0f08ae285737..abe4a229e77c 100644
--- a/deps/npm/docs/output/commands/npm-dedupe.html
+++ b/deps/npm/docs/output/commands/npm-dedupe.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dedupe----11190">
+<h1 id="----npm-dedupe----11191">
     <span>npm-dedupe</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Reduce duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deny-scripts.html b/deps/npm/docs/output/commands/npm-deny-scripts.html
index 8b82b3684feb..3a56f32dc977 100644
--- a/deps/npm/docs/output/commands/npm-deny-scripts.html
+++ b/deps/npm/docs/output/commands/npm-deny-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deny-scripts----11190">
+<h1 id="----npm-deny-scripts----11191">
     <span>npm-deny-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deny install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deprecate.html b/deps/npm/docs/output/commands/npm-deprecate.html
index 489345c280bc..90f45466cad9 100644
--- a/deps/npm/docs/output/commands/npm-deprecate.html
+++ b/deps/npm/docs/output/commands/npm-deprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deprecate----11190">
+<h1 id="----npm-deprecate----11191">
     <span>npm-deprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-diff.html b/deps/npm/docs/output/commands/npm-diff.html
index 3bb3d244a198..fba245e3b33a 100644
--- a/deps/npm/docs/output/commands/npm-diff.html
+++ b/deps/npm/docs/output/commands/npm-diff.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-diff----11190">
+<h1 id="----npm-diff----11191">
     <span>npm-diff</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The registry diff command</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dist-tag.html b/deps/npm/docs/output/commands/npm-dist-tag.html
index 9f3aafdf4314..2d42ee8e3e84 100644
--- a/deps/npm/docs/output/commands/npm-dist-tag.html
+++ b/deps/npm/docs/output/commands/npm-dist-tag.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dist-tag----11190">
+<h1 id="----npm-dist-tag----11191">
     <span>npm-dist-tag</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Modify package distribution tags</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-docs.html b/deps/npm/docs/output/commands/npm-docs.html
index fbdd0ad2b626..98295c7943e0 100644
--- a/deps/npm/docs/output/commands/npm-docs.html
+++ b/deps/npm/docs/output/commands/npm-docs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-docs----11190">
+<h1 id="----npm-docs----11191">
     <span>npm-docs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open documentation for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-doctor.html b/deps/npm/docs/output/commands/npm-doctor.html
index b7dc5d2caf84..096f12bf3b80 100644
--- a/deps/npm/docs/output/commands/npm-doctor.html
+++ b/deps/npm/docs/output/commands/npm-doctor.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-doctor----11190">
+<h1 id="----npm-doctor----11191">
     <span>npm-doctor</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check the health of your npm environment</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-edit.html b/deps/npm/docs/output/commands/npm-edit.html
index 3aed53c2677a..7a555a8f39a4 100644
--- a/deps/npm/docs/output/commands/npm-edit.html
+++ b/deps/npm/docs/output/commands/npm-edit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-edit----11190">
+<h1 id="----npm-edit----11191">
     <span>npm-edit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Edit an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-exec.html b/deps/npm/docs/output/commands/npm-exec.html
index a5ea0d54c343..94e8e68c05f1 100644
--- a/deps/npm/docs/output/commands/npm-exec.html
+++ b/deps/npm/docs/output/commands/npm-exec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-exec----11190">
+<h1 id="----npm-exec----11191">
     <span>npm-exec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explain.html b/deps/npm/docs/output/commands/npm-explain.html
index bce1694bcf08..ccf68b227121 100644
--- a/deps/npm/docs/output/commands/npm-explain.html
+++ b/deps/npm/docs/output/commands/npm-explain.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explain----11190">
+<h1 id="----npm-explain----11191">
     <span>npm-explain</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Explain installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explore.html b/deps/npm/docs/output/commands/npm-explore.html
index 872892c9f1d5..7b4d6a2ed2c4 100644
--- a/deps/npm/docs/output/commands/npm-explore.html
+++ b/deps/npm/docs/output/commands/npm-explore.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explore----11190">
+<h1 id="----npm-explore----11191">
     <span>npm-explore</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Browse an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-find-dupes.html b/deps/npm/docs/output/commands/npm-find-dupes.html
index b71cbeb015db..19b5ae4ffcfa 100644
--- a/deps/npm/docs/output/commands/npm-find-dupes.html
+++ b/deps/npm/docs/output/commands/npm-find-dupes.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-find-dupes----11190">
+<h1 id="----npm-find-dupes----11191">
     <span>npm-find-dupes</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Find duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-fund.html b/deps/npm/docs/output/commands/npm-fund.html
index 9f04fd7ea66b..c657d182afd3 100644
--- a/deps/npm/docs/output/commands/npm-fund.html
+++ b/deps/npm/docs/output/commands/npm-fund.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-fund----11190">
+<h1 id="----npm-fund----11191">
     <span>npm-fund</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Retrieve funding information</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-get.html b/deps/npm/docs/output/commands/npm-get.html
index 94a56fd4a81b..59eaf5e577cb 100644
--- a/deps/npm/docs/output/commands/npm-get.html
+++ b/deps/npm/docs/output/commands/npm-get.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-get----11190">
+<h1 id="----npm-get----11191">
     <span>npm-get</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get a value from the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help-search.html b/deps/npm/docs/output/commands/npm-help-search.html
index d3666992d1e9..d4abfb29c360 100644
--- a/deps/npm/docs/output/commands/npm-help-search.html
+++ b/deps/npm/docs/output/commands/npm-help-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help-search----11190">
+<h1 id="----npm-help-search----11191">
     <span>npm-help-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search npm help documentation</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help.html b/deps/npm/docs/output/commands/npm-help.html
index e7fa1b32e601..d4fe535e8bd0 100644
--- a/deps/npm/docs/output/commands/npm-help.html
+++ b/deps/npm/docs/output/commands/npm-help.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help----11190">
+<h1 id="----npm-help----11191">
     <span>npm-help</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get help on npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-init.html b/deps/npm/docs/output/commands/npm-init.html
index 265ee78ad2cf..af686f90a7ac 100644
--- a/deps/npm/docs/output/commands/npm-init.html
+++ b/deps/npm/docs/output/commands/npm-init.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-init----11190">
+<h1 id="----npm-init----11191">
     <span>npm-init</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a package.json file</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-ci-test.html b/deps/npm/docs/output/commands/npm-install-ci-test.html
index 94d4e4a663b8..bdf779e2eef8 100644
--- a/deps/npm/docs/output/commands/npm-install-ci-test.html
+++ b/deps/npm/docs/output/commands/npm-install-ci-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-ci-test----11190">
+<h1 id="----npm-install-ci-test----11191">
     <span>npm-install-ci-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a project with a clean slate and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-scripts.html b/deps/npm/docs/output/commands/npm-install-scripts.html
index d78f5efc1653..8174e90a5094 100644
--- a/deps/npm/docs/output/commands/npm-install-scripts.html
+++ b/deps/npm/docs/output/commands/npm-install-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-scripts----11190">
+<h1 id="----npm-install-scripts----11191">
     <span>npm-install-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage install-script approvals for dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-test.html b/deps/npm/docs/output/commands/npm-install-test.html
index c55b06547a9d..e75fb52d3239 100644
--- a/deps/npm/docs/output/commands/npm-install-test.html
+++ b/deps/npm/docs/output/commands/npm-install-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-test----11190">
+<h1 id="----npm-install-test----11191">
     <span>npm-install-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install package(s) and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install.html b/deps/npm/docs/output/commands/npm-install.html
index 80af90cc3db9..ed78f6576bb7 100644
--- a/deps/npm/docs/output/commands/npm-install.html
+++ b/deps/npm/docs/output/commands/npm-install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install----11190">
+<h1 id="----npm-install----11191">
     <span>npm-install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-link.html b/deps/npm/docs/output/commands/npm-link.html
index 3a5795b866f5..aa01ff7a259a 100644
--- a/deps/npm/docs/output/commands/npm-link.html
+++ b/deps/npm/docs/output/commands/npm-link.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-link----11190">
+<h1 id="----npm-link----11191">
     <span>npm-link</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Symlink a package folder</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ll.html b/deps/npm/docs/output/commands/npm-ll.html
index 601f99e91029..f8df2515bfa4 100644
--- a/deps/npm/docs/output/commands/npm-ll.html
+++ b/deps/npm/docs/output/commands/npm-ll.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ll----11190">
+<h1 id="----npm-ll----11191">
     <span>npm-ll</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-login.html b/deps/npm/docs/output/commands/npm-login.html
index 33d44e488838..1c6d938ec6c1 100644
--- a/deps/npm/docs/output/commands/npm-login.html
+++ b/deps/npm/docs/output/commands/npm-login.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-login----11190">
+<h1 id="----npm-login----11191">
     <span>npm-login</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Login to a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-logout.html b/deps/npm/docs/output/commands/npm-logout.html
index 0be803c18ae7..cf319a086f89 100644
--- a/deps/npm/docs/output/commands/npm-logout.html
+++ b/deps/npm/docs/output/commands/npm-logout.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-logout----11190">
+<h1 id="----npm-logout----11191">
     <span>npm-logout</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Log out of the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ls.html b/deps/npm/docs/output/commands/npm-ls.html
index bda454a04c77..b733762be373 100644
--- a/deps/npm/docs/output/commands/npm-ls.html
+++ b/deps/npm/docs/output/commands/npm-ls.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ls----11190">
+<h1 id="----npm-ls----11191">
     <span>npm-ls</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
@@ -209,7 +209,7 @@ <h3 id="description">Description</h3>
 <p>Positional arguments are <code>name@version-range</code> identifiers, which will limit the results to only the paths to the packages named.
 Note that nested packages will <em>also</em> show the paths to the specified packages.
 For example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@11.19.0 /path/to/npm
+<pre><code class="language-bash">npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
diff --git a/deps/npm/docs/output/commands/npm-org.html b/deps/npm/docs/output/commands/npm-org.html
index 32df155d69ce..6a2c22951a60 100644
--- a/deps/npm/docs/output/commands/npm-org.html
+++ b/deps/npm/docs/output/commands/npm-org.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-org----11190">
+<h1 id="----npm-org----11191">
     <span>npm-org</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage orgs</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-outdated.html b/deps/npm/docs/output/commands/npm-outdated.html
index 5355d7dd09aa..b85880371cdf 100644
--- a/deps/npm/docs/output/commands/npm-outdated.html
+++ b/deps/npm/docs/output/commands/npm-outdated.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-outdated----11190">
+<h1 id="----npm-outdated----11191">
     <span>npm-outdated</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check for outdated packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-owner.html b/deps/npm/docs/output/commands/npm-owner.html
index 7dc17627f50a..6b8afff7ba36 100644
--- a/deps/npm/docs/output/commands/npm-owner.html
+++ b/deps/npm/docs/output/commands/npm-owner.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-owner----11190">
+<h1 id="----npm-owner----11191">
     <span>npm-owner</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage package owners</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pack.html b/deps/npm/docs/output/commands/npm-pack.html
index 3f92c3ff7579..d7f148d92ed7 100644
--- a/deps/npm/docs/output/commands/npm-pack.html
+++ b/deps/npm/docs/output/commands/npm-pack.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pack----11190">
+<h1 id="----npm-pack----11191">
     <span>npm-pack</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a tarball from a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ping.html b/deps/npm/docs/output/commands/npm-ping.html
index 84d634064212..3c49a0713166 100644
--- a/deps/npm/docs/output/commands/npm-ping.html
+++ b/deps/npm/docs/output/commands/npm-ping.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ping----11190">
+<h1 id="----npm-ping----11191">
     <span>npm-ping</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Ping npm registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pkg.html b/deps/npm/docs/output/commands/npm-pkg.html
index cf995cca7679..d80ac21f9af3 100644
--- a/deps/npm/docs/output/commands/npm-pkg.html
+++ b/deps/npm/docs/output/commands/npm-pkg.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pkg----11190">
+<h1 id="----npm-pkg----11191">
     <span>npm-pkg</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manages your package.json</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prefix.html b/deps/npm/docs/output/commands/npm-prefix.html
index 0336ac659020..1592a1d3048d 100644
--- a/deps/npm/docs/output/commands/npm-prefix.html
+++ b/deps/npm/docs/output/commands/npm-prefix.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prefix----11190">
+<h1 id="----npm-prefix----11191">
     <span>npm-prefix</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display prefix</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-profile.html b/deps/npm/docs/output/commands/npm-profile.html
index 8c0d0a337c8c..24f5db6d7f37 100644
--- a/deps/npm/docs/output/commands/npm-profile.html
+++ b/deps/npm/docs/output/commands/npm-profile.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-profile----11190">
+<h1 id="----npm-profile----11191">
     <span>npm-profile</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Change settings on your registry profile</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prune.html b/deps/npm/docs/output/commands/npm-prune.html
index d340e0fd84a6..736620c0a24a 100644
--- a/deps/npm/docs/output/commands/npm-prune.html
+++ b/deps/npm/docs/output/commands/npm-prune.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prune----11190">
+<h1 id="----npm-prune----11191">
     <span>npm-prune</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove extraneous packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-publish.html b/deps/npm/docs/output/commands/npm-publish.html
index d1ee0efa5d16..a20d56b8d10e 100644
--- a/deps/npm/docs/output/commands/npm-publish.html
+++ b/deps/npm/docs/output/commands/npm-publish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-publish----11190">
+<h1 id="----npm-publish----11191">
     <span>npm-publish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Publish a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-query.html b/deps/npm/docs/output/commands/npm-query.html
index a8347390a34a..a74342cf2782 100644
--- a/deps/npm/docs/output/commands/npm-query.html
+++ b/deps/npm/docs/output/commands/npm-query.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-query----11190">
+<h1 id="----npm-query----11191">
     <span>npm-query</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency selector query</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-rebuild.html b/deps/npm/docs/output/commands/npm-rebuild.html
index 8c2277d8a914..39403a70941d 100644
--- a/deps/npm/docs/output/commands/npm-rebuild.html
+++ b/deps/npm/docs/output/commands/npm-rebuild.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-rebuild----11190">
+<h1 id="----npm-rebuild----11191">
     <span>npm-rebuild</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Rebuild a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-repo.html b/deps/npm/docs/output/commands/npm-repo.html
index b60cd8bc1ddd..5337679c8248 100644
--- a/deps/npm/docs/output/commands/npm-repo.html
+++ b/deps/npm/docs/output/commands/npm-repo.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-repo----11190">
+<h1 id="----npm-repo----11191">
     <span>npm-repo</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open package repository page in the browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-restart.html b/deps/npm/docs/output/commands/npm-restart.html
index 960530ad2975..0786bdc34a54 100644
--- a/deps/npm/docs/output/commands/npm-restart.html
+++ b/deps/npm/docs/output/commands/npm-restart.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-restart----11190">
+<h1 id="----npm-restart----11191">
     <span>npm-restart</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Restart a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-root.html b/deps/npm/docs/output/commands/npm-root.html
index b5ad8c5c1389..165223c6fdb6 100644
--- a/deps/npm/docs/output/commands/npm-root.html
+++ b/deps/npm/docs/output/commands/npm-root.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-root----11190">
+<h1 id="----npm-root----11191">
     <span>npm-root</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm root</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-run.html b/deps/npm/docs/output/commands/npm-run.html
index 985df67fddef..15ca998eb8a8 100644
--- a/deps/npm/docs/output/commands/npm-run.html
+++ b/deps/npm/docs/output/commands/npm-run.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-run----11190">
+<h1 id="----npm-run----11191">
     <span>npm-run</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run arbitrary package scripts</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-sbom.html b/deps/npm/docs/output/commands/npm-sbom.html
index db72c21adc4f..fe84c36327a6 100644
--- a/deps/npm/docs/output/commands/npm-sbom.html
+++ b/deps/npm/docs/output/commands/npm-sbom.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-sbom----11190">
+<h1 id="----npm-sbom----11191">
     <span>npm-sbom</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Generate a Software Bill of Materials (SBOM)</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-search.html b/deps/npm/docs/output/commands/npm-search.html
index f4764833e25a..98006e7d2253 100644
--- a/deps/npm/docs/output/commands/npm-search.html
+++ b/deps/npm/docs/output/commands/npm-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-search----11190">
+<h1 id="----npm-search----11191">
     <span>npm-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search for packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-set.html b/deps/npm/docs/output/commands/npm-set.html
index d0fe94ba7e98..6202cdf7b3cd 100644
--- a/deps/npm/docs/output/commands/npm-set.html
+++ b/deps/npm/docs/output/commands/npm-set.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-set----11190">
+<h1 id="----npm-set----11191">
     <span>npm-set</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set a value in the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-shrinkwrap.html b/deps/npm/docs/output/commands/npm-shrinkwrap.html
index 85fb2b99986f..abb9c216e6da 100644
--- a/deps/npm/docs/output/commands/npm-shrinkwrap.html
+++ b/deps/npm/docs/output/commands/npm-shrinkwrap.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrap----11190">
+<h1 id="----npm-shrinkwrap----11191">
     <span>npm-shrinkwrap</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Lock down dependency versions for publication</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stage.html b/deps/npm/docs/output/commands/npm-stage.html
index 225d4970fad3..74c4f7acddf0 100644
--- a/deps/npm/docs/output/commands/npm-stage.html
+++ b/deps/npm/docs/output/commands/npm-stage.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stage----11190">
+<h1 id="----npm-stage----11191">
     <span>npm-stage</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stage packages for publishing</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-star.html b/deps/npm/docs/output/commands/npm-star.html
index 5521c413462c..4ba2f61b1797 100644
--- a/deps/npm/docs/output/commands/npm-star.html
+++ b/deps/npm/docs/output/commands/npm-star.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-star----11190">
+<h1 id="----npm-star----11191">
     <span>npm-star</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Mark your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stars.html b/deps/npm/docs/output/commands/npm-stars.html
index 9f497020875d..a1c7c0a4fd9d 100644
--- a/deps/npm/docs/output/commands/npm-stars.html
+++ b/deps/npm/docs/output/commands/npm-stars.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stars----11190">
+<h1 id="----npm-stars----11191">
     <span>npm-stars</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View packages marked as favorites</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-start.html b/deps/npm/docs/output/commands/npm-start.html
index 4a6ec9e7e2c8..063ac6b3d809 100644
--- a/deps/npm/docs/output/commands/npm-start.html
+++ b/deps/npm/docs/output/commands/npm-start.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-start----11190">
+<h1 id="----npm-start----11191">
     <span>npm-start</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Start a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stop.html b/deps/npm/docs/output/commands/npm-stop.html
index 243f702c961e..b4e84d2488de 100644
--- a/deps/npm/docs/output/commands/npm-stop.html
+++ b/deps/npm/docs/output/commands/npm-stop.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stop----11190">
+<h1 id="----npm-stop----11191">
     <span>npm-stop</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stop a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-team.html b/deps/npm/docs/output/commands/npm-team.html
index 0baf06db4b1a..c9a7504b91fa 100644
--- a/deps/npm/docs/output/commands/npm-team.html
+++ b/deps/npm/docs/output/commands/npm-team.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-team----11190">
+<h1 id="----npm-team----11191">
     <span>npm-team</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage organization teams and team memberships</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-test.html b/deps/npm/docs/output/commands/npm-test.html
index 2d46aafd0b14..bbb30678ba8c 100644
--- a/deps/npm/docs/output/commands/npm-test.html
+++ b/deps/npm/docs/output/commands/npm-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-test----11190">
+<h1 id="----npm-test----11191">
     <span>npm-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Test a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-token.html b/deps/npm/docs/output/commands/npm-token.html
index 58a528ce2180..680c2aa534f8 100644
--- a/deps/npm/docs/output/commands/npm-token.html
+++ b/deps/npm/docs/output/commands/npm-token.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-token----11190">
+<h1 id="----npm-token----11191">
     <span>npm-token</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage your authentication tokens</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-trust.html b/deps/npm/docs/output/commands/npm-trust.html
index 429e22957b18..6d531484035c 100644
--- a/deps/npm/docs/output/commands/npm-trust.html
+++ b/deps/npm/docs/output/commands/npm-trust.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-trust----11190">
+<h1 id="----npm-trust----11191">
     <span>npm-trust</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage trusted publishing relationships between packages and CI/CD providers</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-undeprecate.html b/deps/npm/docs/output/commands/npm-undeprecate.html
index 67b6d048c079..d5239ca0cac0 100644
--- a/deps/npm/docs/output/commands/npm-undeprecate.html
+++ b/deps/npm/docs/output/commands/npm-undeprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-undeprecate----11190">
+<h1 id="----npm-undeprecate----11191">
     <span>npm-undeprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Undeprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-uninstall.html b/deps/npm/docs/output/commands/npm-uninstall.html
index 8197d3646c62..26991d034bd4 100644
--- a/deps/npm/docs/output/commands/npm-uninstall.html
+++ b/deps/npm/docs/output/commands/npm-uninstall.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-uninstall----11190">
+<h1 id="----npm-uninstall----11191">
     <span>npm-uninstall</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unpublish.html b/deps/npm/docs/output/commands/npm-unpublish.html
index 21b698cad72e..4fda332a9615 100644
--- a/deps/npm/docs/output/commands/npm-unpublish.html
+++ b/deps/npm/docs/output/commands/npm-unpublish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unpublish----11190">
+<h1 id="----npm-unpublish----11191">
     <span>npm-unpublish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package from the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unstar.html b/deps/npm/docs/output/commands/npm-unstar.html
index 2564643c7435..25db54715ddb 100644
--- a/deps/npm/docs/output/commands/npm-unstar.html
+++ b/deps/npm/docs/output/commands/npm-unstar.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unstar----11190">
+<h1 id="----npm-unstar----11191">
     <span>npm-unstar</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove an item from your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-update.html b/deps/npm/docs/output/commands/npm-update.html
index c89bc400aa3c..fff2f70073cd 100644
--- a/deps/npm/docs/output/commands/npm-update.html
+++ b/deps/npm/docs/output/commands/npm-update.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-update----11190">
+<h1 id="----npm-update----11191">
     <span>npm-update</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Update packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-version.html b/deps/npm/docs/output/commands/npm-version.html
index 2cb36d263256..310abe5db903 100644
--- a/deps/npm/docs/output/commands/npm-version.html
+++ b/deps/npm/docs/output/commands/npm-version.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-version----11190">
+<h1 id="----npm-version----11191">
     <span>npm-version</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Bump a package version</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-view.html b/deps/npm/docs/output/commands/npm-view.html
index 2356b4e79166..18f28fe17077 100644
--- a/deps/npm/docs/output/commands/npm-view.html
+++ b/deps/npm/docs/output/commands/npm-view.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-view----11190">
+<h1 id="----npm-view----11191">
     <span>npm-view</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View registry info</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-whoami.html b/deps/npm/docs/output/commands/npm-whoami.html
index bd768a237695..91a7d6e2288d 100644
--- a/deps/npm/docs/output/commands/npm-whoami.html
+++ b/deps/npm/docs/output/commands/npm-whoami.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-whoami----11190">
+<h1 id="----npm-whoami----11191">
     <span>npm-whoami</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm username</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm.html b/deps/npm/docs/output/commands/npm.html
index cc749dc6e59a..99674e1362df 100644
--- a/deps/npm/docs/output/commands/npm.html
+++ b/deps/npm/docs/output/commands/npm.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm----11190">
+<h1 id="----npm----11191">
     <span>npm</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">javascript package manager</span>
 </header>
@@ -203,7 +203,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>11.19.0</p>
+<p>11.19.1</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.
 It puts modules in place so that node can find them, and manages dependency conflicts intelligently.</p>
diff --git a/deps/npm/docs/output/commands/npx.html b/deps/npm/docs/output/commands/npx.html
index 8abb0349d715..d3cb1e00cc5b 100644
--- a/deps/npm/docs/output/commands/npx.html
+++ b/deps/npm/docs/output/commands/npx.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npx----11190">
+<h1 id="----npx----11191">
     <span>npx</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/folders.html b/deps/npm/docs/output/configuring-npm/folders.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/folders.html
+++ b/deps/npm/docs/output/configuring-npm/folders.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/install.html b/deps/npm/docs/output/configuring-npm/install.html
index d607ef84697b..610fc057a134 100644
--- a/deps/npm/docs/output/configuring-npm/install.html
+++ b/deps/npm/docs/output/configuring-npm/install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----install----11190">
+<h1 id="----install----11191">
     <span>Install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Download and install node and npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-global.html b/deps/npm/docs/output/configuring-npm/npm-global.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/npm-global.html
+++ b/deps/npm/docs/output/configuring-npm/npm-global.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-json.html b/deps/npm/docs/output/configuring-npm/npm-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/npm-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
index f26ba837f409..134524b16af6 100644
--- a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrapjson----11190">
+<h1 id="----npm-shrinkwrapjson----11191">
     <span>npm-shrinkwrap.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A publishable lockfile</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npmrc.html b/deps/npm/docs/output/configuring-npm/npmrc.html
index 6e88197b3fbf..a5eb291b57ca 100644
--- a/deps/npm/docs/output/configuring-npm/npmrc.html
+++ b/deps/npm/docs/output/configuring-npm/npmrc.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npmrc----11190">
+<h1 id="----npmrc----11191">
     <span>.npmrc</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The npm config files</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-json.html b/deps/npm/docs/output/configuring-npm/package-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/package-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-lock-json.html b/deps/npm/docs/output/configuring-npm/package-lock-json.html
index 68476b2f14e4..9a4f1631b337 100644
--- a/deps/npm/docs/output/configuring-npm/package-lock-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-lock-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-lockjson----11190">
+<h1 id="----package-lockjson----11191">
     <span>package-lock.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A manifestation of the manifest</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/config.html b/deps/npm/docs/output/using-npm/config.html
index 9d288a3a2e86..ac5829fba75d 100644
--- a/deps/npm/docs/output/using-npm/config.html
+++ b/deps/npm/docs/output/using-npm/config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----config----11190">
+<h1 id="----config----11191">
     <span>Config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">About npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/dependency-selectors.html b/deps/npm/docs/output/using-npm/dependency-selectors.html
index 80acfdd6ea80..c56b5e6c4027 100644
--- a/deps/npm/docs/output/using-npm/dependency-selectors.html
+++ b/deps/npm/docs/output/using-npm/dependency-selectors.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----dependency-selectors----11190">
+<h1 id="----dependency-selectors----11191">
     <span>Dependency Selectors</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency Selector Syntax &amp; Querying</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/developers.html b/deps/npm/docs/output/using-npm/developers.html
index 5457f4a7943b..984f28bfe7b2 100644
--- a/deps/npm/docs/output/using-npm/developers.html
+++ b/deps/npm/docs/output/using-npm/developers.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----developers----11190">
+<h1 id="----developers----11191">
     <span>Developers</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Developer guide</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/logging.html b/deps/npm/docs/output/using-npm/logging.html
index 62b819e82646..f6f6dd742f12 100644
--- a/deps/npm/docs/output/using-npm/logging.html
+++ b/deps/npm/docs/output/using-npm/logging.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----logging----11190">
+<h1 id="----logging----11191">
     <span>Logging</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Why, What &amp; How we Log</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/orgs.html b/deps/npm/docs/output/using-npm/orgs.html
index 39559c361b78..f579fcbbac1f 100644
--- a/deps/npm/docs/output/using-npm/orgs.html
+++ b/deps/npm/docs/output/using-npm/orgs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----organizations----11190">
+<h1 id="----organizations----11191">
     <span>Organizations</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with teams &amp; organizations</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/package-spec.html b/deps/npm/docs/output/using-npm/package-spec.html
index 82b8d1d9ad2e..620f470d109b 100644
--- a/deps/npm/docs/output/using-npm/package-spec.html
+++ b/deps/npm/docs/output/using-npm/package-spec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-spec----11190">
+<h1 id="----package-spec----11191">
     <span>Package spec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Package name specifier</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/registry.html b/deps/npm/docs/output/using-npm/registry.html
index b3d34df82033..e61715c22e4b 100644
--- a/deps/npm/docs/output/using-npm/registry.html
+++ b/deps/npm/docs/output/using-npm/registry.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----registry----11190">
+<h1 id="----registry----11191">
     <span>Registry</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The JavaScript Package Registry</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/removal.html b/deps/npm/docs/output/using-npm/removal.html
index b85ee02590cc..07ee6c06bc40 100644
--- a/deps/npm/docs/output/using-npm/removal.html
+++ b/deps/npm/docs/output/using-npm/removal.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----removal----11190">
+<h1 id="----removal----11191">
     <span>Removal</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Cleaning the slate</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scope.html b/deps/npm/docs/output/using-npm/scope.html
index f2e733bc9ebf..a08571ebfda3 100644
--- a/deps/npm/docs/output/using-npm/scope.html
+++ b/deps/npm/docs/output/using-npm/scope.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scope----11190">
+<h1 id="----scope----11191">
     <span>Scope</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Scoped packages</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scripts.html b/deps/npm/docs/output/using-npm/scripts.html
index c2a9641f62d2..4e852304a114 100644
--- a/deps/npm/docs/output/using-npm/scripts.html
+++ b/deps/npm/docs/output/using-npm/scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scripts----11190">
+<h1 id="----scripts----11191">
     <span>Scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">How npm handles the "scripts" field</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/workspaces.html b/deps/npm/docs/output/using-npm/workspaces.html
index 3a9986755339..ec3d3abed055 100644
--- a/deps/npm/docs/output/using-npm/workspaces.html
+++ b/deps/npm/docs/output/using-npm/workspaces.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----workspaces----11190">
+<h1 id="----workspaces----11191">
     <span>Workspaces</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with workspaces</span>
 </header>
diff --git a/deps/npm/lib/commands/pack.js b/deps/npm/lib/commands/pack.js
index be4a1b240bea..9c4b59657f4a 100644
--- a/deps/npm/lib/commands/pack.js
+++ b/deps/npm/lib/commands/pack.js
@@ -45,6 +45,7 @@ class Pack extends BaseCommand {
       ) ? { ...this.npm.flatOptions, before: null } : this.npm.flatOptions
       const manifest = await pacote.manifest(spec, {
         ...options,
+        ...(spec.type === 'directory' && { allowDirectory: 'all' }),
         Arborist,
         preferOnline: true,
         _isRoot: true,
diff --git a/deps/npm/man/man1/npm-access.1 b/deps/npm/man/man1/npm-access.1
index 3b7d77d8962f..435819623db2 100644
--- a/deps/npm/man/man1/npm-access.1
+++ b/deps/npm/man/man1/npm-access.1
@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ACCESS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-access\fR - Set access level on published packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-adduser.1 b/deps/npm/man/man1/npm-adduser.1
index 53ed267a0aa4..5cc628784241 100644
--- a/deps/npm/man/man1/npm-adduser.1
+++ b/deps/npm/man/man1/npm-adduser.1
@@ -1,4 +1,4 @@
-.TH "NPM-ADDUSER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ADDUSER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-adduser\fR - Add a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-approve-scripts.1 b/deps/npm/man/man1/npm-approve-scripts.1
index 943459b20562..f874e752ab97 100644
--- a/deps/npm/man/man1/npm-approve-scripts.1
+++ b/deps/npm/man/man1/npm-approve-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-APPROVE-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-APPROVE-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-approve-scripts\fR - Approve install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-audit.1 b/deps/npm/man/man1/npm-audit.1
index 77fbcbe595ef..8c9815292aee 100644
--- a/deps/npm/man/man1/npm-audit.1
+++ b/deps/npm/man/man1/npm-audit.1
@@ -1,4 +1,4 @@
-.TH "NPM-AUDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-AUDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-audit\fR - Run a security audit
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-bugs.1 b/deps/npm/man/man1/npm-bugs.1
index 05a37e504c7e..0113cf310fdb 100644
--- a/deps/npm/man/man1/npm-bugs.1
+++ b/deps/npm/man/man1/npm-bugs.1
@@ -1,4 +1,4 @@
-.TH "NPM-BUGS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-BUGS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-bugs\fR - Report bugs for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-cache.1 b/deps/npm/man/man1/npm-cache.1
index fd725dd57fe2..71eaeccf613d 100644
--- a/deps/npm/man/man1/npm-cache.1
+++ b/deps/npm/man/man1/npm-cache.1
@@ -1,4 +1,4 @@
-.TH "NPM-CACHE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CACHE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-cache\fR - Manipulates packages cache
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ci.1 b/deps/npm/man/man1/npm-ci.1
index bbae51d8e983..2e544d6dfa80 100644
--- a/deps/npm/man/man1/npm-ci.1
+++ b/deps/npm/man/man1/npm-ci.1
@@ -1,4 +1,4 @@
-.TH "NPM-CI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ci\fR - Clean install a project
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-completion.1 b/deps/npm/man/man1/npm-completion.1
index d01c54ab63af..d5cefe61d0c7 100644
--- a/deps/npm/man/man1/npm-completion.1
+++ b/deps/npm/man/man1/npm-completion.1
@@ -1,4 +1,4 @@
-.TH "NPM-COMPLETION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-COMPLETION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-completion\fR - Tab Completion for npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-config.1 b/deps/npm/man/man1/npm-config.1
index 34b79e9d1c57..b0ef989fe726 100644
--- a/deps/npm/man/man1/npm-config.1
+++ b/deps/npm/man/man1/npm-config.1
@@ -1,4 +1,4 @@
-.TH "NPM-CONFIG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CONFIG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-config\fR - Manage the npm configuration files
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dedupe.1 b/deps/npm/man/man1/npm-dedupe.1
index 0b11deb4d467..1fa8e34027fb 100644
--- a/deps/npm/man/man1/npm-dedupe.1
+++ b/deps/npm/man/man1/npm-dedupe.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEDUPE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEDUPE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dedupe\fR - Reduce duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deny-scripts.1 b/deps/npm/man/man1/npm-deny-scripts.1
index d8a41f57479e..70fb96d6fcd2 100644
--- a/deps/npm/man/man1/npm-deny-scripts.1
+++ b/deps/npm/man/man1/npm-deny-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-DENY-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DENY-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deny-scripts\fR - Deny install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deprecate.1 b/deps/npm/man/man1/npm-deprecate.1
index c45dd75584ec..e07bd5829ef7 100644
--- a/deps/npm/man/man1/npm-deprecate.1
+++ b/deps/npm/man/man1/npm-deprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deprecate\fR - Deprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-diff.1 b/deps/npm/man/man1/npm-diff.1
index 45efb60c236c..42c3903bd468 100644
--- a/deps/npm/man/man1/npm-diff.1
+++ b/deps/npm/man/man1/npm-diff.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIFF" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIFF" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-diff\fR - The registry diff command
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dist-tag.1 b/deps/npm/man/man1/npm-dist-tag.1
index 989a2c64d307..8ebc625273cc 100644
--- a/deps/npm/man/man1/npm-dist-tag.1
+++ b/deps/npm/man/man1/npm-dist-tag.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIST-TAG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIST-TAG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR - Modify package distribution tags
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-docs.1 b/deps/npm/man/man1/npm-docs.1
index ee614b710885..26fa80d54d5d 100644
--- a/deps/npm/man/man1/npm-docs.1
+++ b/deps/npm/man/man1/npm-docs.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-docs\fR - Open documentation for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-doctor.1 b/deps/npm/man/man1/npm-doctor.1
index 5344645b17ed..f5b750fd6a3b 100644
--- a/deps/npm/man/man1/npm-doctor.1
+++ b/deps/npm/man/man1/npm-doctor.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCTOR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCTOR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-doctor\fR - Check the health of your npm environment
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-edit.1 b/deps/npm/man/man1/npm-edit.1
index bca15e054f60..5055e6feaa5d 100644
--- a/deps/npm/man/man1/npm-edit.1
+++ b/deps/npm/man/man1/npm-edit.1
@@ -1,4 +1,4 @@
-.TH "NPM-EDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-edit\fR - Edit an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-exec.1 b/deps/npm/man/man1/npm-exec.1
index 4b580f484bc1..5ae0a77e2880 100644
--- a/deps/npm/man/man1/npm-exec.1
+++ b/deps/npm/man/man1/npm-exec.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXEC" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXEC" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-exec\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explain.1 b/deps/npm/man/man1/npm-explain.1
index 20374a8fbb37..7869082b6c6f 100644
--- a/deps/npm/man/man1/npm-explain.1
+++ b/deps/npm/man/man1/npm-explain.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLAIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLAIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explain\fR - Explain installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explore.1 b/deps/npm/man/man1/npm-explore.1
index bee110155bd5..df1fd2dc6517 100644
--- a/deps/npm/man/man1/npm-explore.1
+++ b/deps/npm/man/man1/npm-explore.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLORE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLORE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explore\fR - Browse an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-find-dupes.1 b/deps/npm/man/man1/npm-find-dupes.1
index a1cfc3abd0d2..f1f3970dd1d7 100644
--- a/deps/npm/man/man1/npm-find-dupes.1
+++ b/deps/npm/man/man1/npm-find-dupes.1
@@ -1,4 +1,4 @@
-.TH "NPM-FIND-DUPES" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FIND-DUPES" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-find-dupes\fR - Find duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-fund.1 b/deps/npm/man/man1/npm-fund.1
index ec516b28396d..88bfe299c31f 100644
--- a/deps/npm/man/man1/npm-fund.1
+++ b/deps/npm/man/man1/npm-fund.1
@@ -1,4 +1,4 @@
-.TH "NPM-FUND" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FUND" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-fund\fR - Retrieve funding information
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-get.1 b/deps/npm/man/man1/npm-get.1
index d4763eb28c8c..7982d28e324a 100644
--- a/deps/npm/man/man1/npm-get.1
+++ b/deps/npm/man/man1/npm-get.1
@@ -1,4 +1,4 @@
-.TH "NPM-GET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-GET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-get\fR - Get a value from the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help-search.1 b/deps/npm/man/man1/npm-help-search.1
index 63213fa4188a..e7c7d97ebcea 100644
--- a/deps/npm/man/man1/npm-help-search.1
+++ b/deps/npm/man/man1/npm-help-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help-search\fR - Search npm help documentation
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help.1 b/deps/npm/man/man1/npm-help.1
index 59f2f1df9436..7725a82d09c1 100644
--- a/deps/npm/man/man1/npm-help.1
+++ b/deps/npm/man/man1/npm-help.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help\fR - Get help on npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-init.1 b/deps/npm/man/man1/npm-init.1
index cf4c37761d14..bd984db7d203 100644
--- a/deps/npm/man/man1/npm-init.1
+++ b/deps/npm/man/man1/npm-init.1
@@ -1,4 +1,4 @@
-.TH "NPM-INIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-init\fR - Create a package.json file
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-ci-test.1 b/deps/npm/man/man1/npm-install-ci-test.1
index e30140015a1c..b477b4a8b0eb 100644
--- a/deps/npm/man/man1/npm-install-ci-test.1
+++ b/deps/npm/man/man1/npm-install-ci-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-CI-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-CI-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-ci-test\fR - Install a project with a clean slate and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-scripts.1 b/deps/npm/man/man1/npm-install-scripts.1
index 907b48c50ff5..b634903e3ecc 100644
--- a/deps/npm/man/man1/npm-install-scripts.1
+++ b/deps/npm/man/man1/npm-install-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-scripts\fR - Manage install-script approvals for dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-test.1 b/deps/npm/man/man1/npm-install-test.1
index 88e0ed187377..d6774940ea2f 100644
--- a/deps/npm/man/man1/npm-install-test.1
+++ b/deps/npm/man/man1/npm-install-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-test\fR - Install package(s) and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index b1ccd245238d..c6ca10ab642c 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install\fR - Install a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
index d124bcf66a33..ea482b872b86 100644
--- a/deps/npm/man/man1/npm-link.1
+++ b/deps/npm/man/man1/npm-link.1
@@ -1,4 +1,4 @@
-.TH "NPM-LINK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LINK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-link\fR - Symlink a package folder
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ll.1 b/deps/npm/man/man1/npm-ll.1
index 982d8ee3a6c7..136777491e0f 100644
--- a/deps/npm/man/man1/npm-ll.1
+++ b/deps/npm/man/man1/npm-ll.1
@@ -1,4 +1,4 @@
-.TH "NPM-LL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ll\fR - List installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-login.1 b/deps/npm/man/man1/npm-login.1
index 392c5b25d84d..ecc47d745dee 100644
--- a/deps/npm/man/man1/npm-login.1
+++ b/deps/npm/man/man1/npm-login.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-login\fR - Login to a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-logout.1 b/deps/npm/man/man1/npm-logout.1
index 7ca6be27366c..22d86e96586e 100644
--- a/deps/npm/man/man1/npm-logout.1
+++ b/deps/npm/man/man1/npm-logout.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGOUT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGOUT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-logout\fR - Log out of the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index 6fe6245988fe..52224d908c20 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -1,4 +1,4 @@
-.TH "NPM-LS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ls\fR - List installed packages
 .SS "Synopsis"
@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
 .P
 .RS 2
 .nf
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 .fi
diff --git a/deps/npm/man/man1/npm-org.1 b/deps/npm/man/man1/npm-org.1
index 50e94a589d49..4b7592722da4 100644
--- a/deps/npm/man/man1/npm-org.1
+++ b/deps/npm/man/man1/npm-org.1
@@ -1,4 +1,4 @@
-.TH "NPM-ORG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ORG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-org\fR - Manage orgs
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-outdated.1 b/deps/npm/man/man1/npm-outdated.1
index a2ecbcc50b5c..f83acac0d642 100644
--- a/deps/npm/man/man1/npm-outdated.1
+++ b/deps/npm/man/man1/npm-outdated.1
@@ -1,4 +1,4 @@
-.TH "NPM-OUTDATED" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OUTDATED" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-outdated\fR - Check for outdated packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-owner.1 b/deps/npm/man/man1/npm-owner.1
index 3815d60d8b2b..68a98e734ef5 100644
--- a/deps/npm/man/man1/npm-owner.1
+++ b/deps/npm/man/man1/npm-owner.1
@@ -1,4 +1,4 @@
-.TH "NPM-OWNER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OWNER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-owner\fR - Manage package owners
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pack.1 b/deps/npm/man/man1/npm-pack.1
index f5f159779bdc..58b82df26634 100644
--- a/deps/npm/man/man1/npm-pack.1
+++ b/deps/npm/man/man1/npm-pack.1
@@ -1,4 +1,4 @@
-.TH "NPM-PACK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PACK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pack\fR - Create a tarball from a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ping.1 b/deps/npm/man/man1/npm-ping.1
index e44d02e67e88..4df93fbd993a 100644
--- a/deps/npm/man/man1/npm-ping.1
+++ b/deps/npm/man/man1/npm-ping.1
@@ -1,4 +1,4 @@
-.TH "NPM-PING" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PING" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ping\fR - Ping npm registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pkg.1 b/deps/npm/man/man1/npm-pkg.1
index ad4adfa8c654..ad11f73873aa 100644
--- a/deps/npm/man/man1/npm-pkg.1
+++ b/deps/npm/man/man1/npm-pkg.1
@@ -1,4 +1,4 @@
-.TH "NPM-PKG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PKG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pkg\fR - Manages your package.json
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prefix.1 b/deps/npm/man/man1/npm-prefix.1
index a810bc8c0140..6c990176088b 100644
--- a/deps/npm/man/man1/npm-prefix.1
+++ b/deps/npm/man/man1/npm-prefix.1
@@ -1,4 +1,4 @@
-.TH "NPM-PREFIX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PREFIX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prefix\fR - Display prefix
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-profile.1 b/deps/npm/man/man1/npm-profile.1
index 0593fa483958..0d5d54620f73 100644
--- a/deps/npm/man/man1/npm-profile.1
+++ b/deps/npm/man/man1/npm-profile.1
@@ -1,4 +1,4 @@
-.TH "NPM-PROFILE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PROFILE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-profile\fR - Change settings on your registry profile
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prune.1 b/deps/npm/man/man1/npm-prune.1
index c62e7d6bd395..8f67ca9384f8 100644
--- a/deps/npm/man/man1/npm-prune.1
+++ b/deps/npm/man/man1/npm-prune.1
@@ -1,4 +1,4 @@
-.TH "NPM-PRUNE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PRUNE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prune\fR - Remove extraneous packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-publish.1 b/deps/npm/man/man1/npm-publish.1
index 62676301d5ab..4e738ab0bbd7 100644
--- a/deps/npm/man/man1/npm-publish.1
+++ b/deps/npm/man/man1/npm-publish.1
@@ -1,4 +1,4 @@
-.TH "NPM-PUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-publish\fR - Publish a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-query.1 b/deps/npm/man/man1/npm-query.1
index 3ca4eb1b659f..334fc20660e4 100644
--- a/deps/npm/man/man1/npm-query.1
+++ b/deps/npm/man/man1/npm-query.1
@@ -1,4 +1,4 @@
-.TH "NPM-QUERY" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-QUERY" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-query\fR - Dependency selector query
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-rebuild.1 b/deps/npm/man/man1/npm-rebuild.1
index b0710049573e..6a09726529b4 100644
--- a/deps/npm/man/man1/npm-rebuild.1
+++ b/deps/npm/man/man1/npm-rebuild.1
@@ -1,4 +1,4 @@
-.TH "NPM-REBUILD" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REBUILD" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-rebuild\fR - Rebuild a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-repo.1 b/deps/npm/man/man1/npm-repo.1
index 46fdc0cb111e..5ff08e9eeb4d 100644
--- a/deps/npm/man/man1/npm-repo.1
+++ b/deps/npm/man/man1/npm-repo.1
@@ -1,4 +1,4 @@
-.TH "NPM-REPO" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REPO" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-repo\fR - Open package repository page in the browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-restart.1 b/deps/npm/man/man1/npm-restart.1
index b552a5e2a86a..d4f5f0d3df1f 100644
--- a/deps/npm/man/man1/npm-restart.1
+++ b/deps/npm/man/man1/npm-restart.1
@@ -1,4 +1,4 @@
-.TH "NPM-RESTART" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RESTART" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-restart\fR - Restart a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-root.1 b/deps/npm/man/man1/npm-root.1
index 9d701e336bff..ecd0c64ef6bb 100644
--- a/deps/npm/man/man1/npm-root.1
+++ b/deps/npm/man/man1/npm-root.1
@@ -1,4 +1,4 @@
-.TH "NPM-ROOT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ROOT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-root\fR - Display npm root
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-run.1 b/deps/npm/man/man1/npm-run.1
index 185111dbafbb..8aadcceff7c1 100644
--- a/deps/npm/man/man1/npm-run.1
+++ b/deps/npm/man/man1/npm-run.1
@@ -1,4 +1,4 @@
-.TH "NPM-RUN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RUN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-run\fR - Run arbitrary package scripts
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-sbom.1 b/deps/npm/man/man1/npm-sbom.1
index a8a74f9e02c6..f694d642f9ad 100644
--- a/deps/npm/man/man1/npm-sbom.1
+++ b/deps/npm/man/man1/npm-sbom.1
@@ -1,4 +1,4 @@
-.TH "NPM-SBOM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SBOM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-sbom\fR - Generate a Software Bill of Materials (SBOM)
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-search.1 b/deps/npm/man/man1/npm-search.1
index 2a0fbbc58709..969d0e784902 100644
--- a/deps/npm/man/man1/npm-search.1
+++ b/deps/npm/man/man1/npm-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-search\fR - Search for packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-set.1 b/deps/npm/man/man1/npm-set.1
index 4333006b47ff..4deaf8e01aca 100644
--- a/deps/npm/man/man1/npm-set.1
+++ b/deps/npm/man/man1/npm-set.1
@@ -1,4 +1,4 @@
-.TH "NPM-SET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-set\fR - Set a value in the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-shrinkwrap.1 b/deps/npm/man/man1/npm-shrinkwrap.1
index 0fc20a6ccaeb..35caa20c3dc0 100644
--- a/deps/npm/man/man1/npm-shrinkwrap.1
+++ b/deps/npm/man/man1/npm-shrinkwrap.1
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap\fR - Lock down dependency versions for publication
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stage.1 b/deps/npm/man/man1/npm-stage.1
index 9a677ba6b03e..8c2016052130 100644
--- a/deps/npm/man/man1/npm-stage.1
+++ b/deps/npm/man/man1/npm-stage.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAGE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAGE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stage\fR - Stage packages for publishing
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-star.1 b/deps/npm/man/man1/npm-star.1
index dbabe90b0bd6..a2191c120e35 100644
--- a/deps/npm/man/man1/npm-star.1
+++ b/deps/npm/man/man1/npm-star.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-star\fR - Mark your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stars.1 b/deps/npm/man/man1/npm-stars.1
index 2999dd8abbf0..aca98ed914a5 100644
--- a/deps/npm/man/man1/npm-stars.1
+++ b/deps/npm/man/man1/npm-stars.1
@@ -1,4 +1,4 @@
-.TH "NPM-STARS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STARS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stars\fR - View packages marked as favorites
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-start.1 b/deps/npm/man/man1/npm-start.1
index c8966bd38a68..d2f3b4d87cc8 100644
--- a/deps/npm/man/man1/npm-start.1
+++ b/deps/npm/man/man1/npm-start.1
@@ -1,4 +1,4 @@
-.TH "NPM-START" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-START" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-start\fR - Start a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stop.1 b/deps/npm/man/man1/npm-stop.1
index c900d58437f5..7896dd6acd17 100644
--- a/deps/npm/man/man1/npm-stop.1
+++ b/deps/npm/man/man1/npm-stop.1
@@ -1,4 +1,4 @@
-.TH "NPM-STOP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STOP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stop\fR - Stop a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-team.1 b/deps/npm/man/man1/npm-team.1
index 4de50f8c6b06..21ccc530ad81 100644
--- a/deps/npm/man/man1/npm-team.1
+++ b/deps/npm/man/man1/npm-team.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEAM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEAM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-team\fR - Manage organization teams and team memberships
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-test.1 b/deps/npm/man/man1/npm-test.1
index 311ba399498b..8cae879d8291 100644
--- a/deps/npm/man/man1/npm-test.1
+++ b/deps/npm/man/man1/npm-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-test\fR - Test a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-token.1 b/deps/npm/man/man1/npm-token.1
index 4b1cbae98b24..fc82daf8d0cf 100644
--- a/deps/npm/man/man1/npm-token.1
+++ b/deps/npm/man/man1/npm-token.1
@@ -1,4 +1,4 @@
-.TH "NPM-TOKEN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TOKEN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-token\fR - Manage your authentication tokens
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-trust.1 b/deps/npm/man/man1/npm-trust.1
index f8de6022c0f0..fce69eb33b75 100644
--- a/deps/npm/man/man1/npm-trust.1
+++ b/deps/npm/man/man1/npm-trust.1
@@ -1,4 +1,4 @@
-.TH "NPM-TRUST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TRUST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-trust\fR - Manage trusted publishing relationships between packages and CI/CD providers
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-undeprecate.1 b/deps/npm/man/man1/npm-undeprecate.1
index 1a26688b4530..11f91ee9b913 100644
--- a/deps/npm/man/man1/npm-undeprecate.1
+++ b/deps/npm/man/man1/npm-undeprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNDEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNDEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-undeprecate\fR - Undeprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-uninstall.1 b/deps/npm/man/man1/npm-uninstall.1
index 39791e588e7e..b9ff997229dc 100644
--- a/deps/npm/man/man1/npm-uninstall.1
+++ b/deps/npm/man/man1/npm-uninstall.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNINSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNINSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-uninstall\fR - Remove a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unpublish.1 b/deps/npm/man/man1/npm-unpublish.1
index f839376efe0f..5bbb86e8c8f3 100644
--- a/deps/npm/man/man1/npm-unpublish.1
+++ b/deps/npm/man/man1/npm-unpublish.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNPUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNPUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unpublish\fR - Remove a package from the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unstar.1 b/deps/npm/man/man1/npm-unstar.1
index 555868c3fb68..0d0e2f2c9e6a 100644
--- a/deps/npm/man/man1/npm-unstar.1
+++ b/deps/npm/man/man1/npm-unstar.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNSTAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNSTAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unstar\fR - Remove an item from your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-update.1 b/deps/npm/man/man1/npm-update.1
index 55b4191e801b..4f5e015b20d7 100644
--- a/deps/npm/man/man1/npm-update.1
+++ b/deps/npm/man/man1/npm-update.1
@@ -1,4 +1,4 @@
-.TH "NPM-UPDATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UPDATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-update\fR - Update packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-version.1 b/deps/npm/man/man1/npm-version.1
index fd261b5cd42a..c15a0d19acfa 100644
--- a/deps/npm/man/man1/npm-version.1
+++ b/deps/npm/man/man1/npm-version.1
@@ -1,4 +1,4 @@
-.TH "NPM-VERSION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VERSION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-version\fR - Bump a package version
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-view.1 b/deps/npm/man/man1/npm-view.1
index a150ce2d979d..b9210c424cd2 100644
--- a/deps/npm/man/man1/npm-view.1
+++ b/deps/npm/man/man1/npm-view.1
@@ -1,4 +1,4 @@
-.TH "NPM-VIEW" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VIEW" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-view\fR - View registry info
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-whoami.1 b/deps/npm/man/man1/npm-whoami.1
index 920d19146bd3..5d44c35a7f48 100644
--- a/deps/npm/man/man1/npm-whoami.1
+++ b/deps/npm/man/man1/npm-whoami.1
@@ -1,4 +1,4 @@
-.TH "NPM-WHOAMI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-WHOAMI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-whoami\fR - Display npm username
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 9791f5f274f5..25a9e19288c9 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm\fR - javascript package manager
 .SS "Synopsis"
@@ -12,7 +12,7 @@ npm
 Note: This command is unaware of workspaces.
 .SS "Version"
 .P
-11.19.0
+11.19.1
 .SS "Description"
 .P
 npm is the package manager for the Node JavaScript platform. It puts modules in place so that node can find them, and manages dependency conflicts intelligently.
diff --git a/deps/npm/man/man1/npx.1 b/deps/npm/man/man1/npx.1
index 3c4afb8aec51..39fcb358f7ce 100644
--- a/deps/npm/man/man1/npx.1
+++ b/deps/npm/man/man1/npx.1
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpx\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man5/folders.5 b/deps/npm/man/man5/folders.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/folders.5
+++ b/deps/npm/man/man5/folders.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/install.5 b/deps/npm/man/man5/install.5
index 200dcc3dfd3a..b54f427c5da9 100644
--- a/deps/npm/man/man5/install.5
+++ b/deps/npm/man/man5/install.5
@@ -1,4 +1,4 @@
-.TH "INSTALL" "5" "July 2026" "NPM@11.19.0" ""
+.TH "INSTALL" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBInstall\fR - Download and install node and npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-global.5 b/deps/npm/man/man5/npm-global.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/npm-global.5
+++ b/deps/npm/man/man5/npm-global.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-json.5 b/deps/npm/man/man5/npm-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/npm-json.5
+++ b/deps/npm/man/man5/npm-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-shrinkwrap-json.5 b/deps/npm/man/man5/npm-shrinkwrap-json.5
index 9f3d7597d161..1af7bf467c03 100644
--- a/deps/npm/man/man5/npm-shrinkwrap-json.5
+++ b/deps/npm/man/man5/npm-shrinkwrap-json.5
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap.json\fR - A publishable lockfile
 .SS "Description"
diff --git a/deps/npm/man/man5/npmrc.5 b/deps/npm/man/man5/npmrc.5
index 83578c624089..9d2361126088 100644
--- a/deps/npm/man/man5/npmrc.5
+++ b/deps/npm/man/man5/npmrc.5
@@ -1,4 +1,4 @@
-.TH ".NPMRC" "5" "July 2026" "NPM@11.19.0" ""
+.TH ".NPMRC" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fB.npmrc\fR - The npm config files
 .SS "Description"
diff --git a/deps/npm/man/man5/package-json.5 b/deps/npm/man/man5/package-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/package-json.5
+++ b/deps/npm/man/man5/package-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/package-lock-json.5 b/deps/npm/man/man5/package-lock-json.5
index 7bc632269f50..ace3d4d69594 100644
--- a/deps/npm/man/man5/package-lock-json.5
+++ b/deps/npm/man/man5/package-lock-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE-LOCK.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE-LOCK.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage-lock.json\fR - A manifestation of the manifest
 .SS "Description"
diff --git a/deps/npm/man/man7/config.7 b/deps/npm/man/man7/config.7
index b68980abc38f..684663e33757 100644
--- a/deps/npm/man/man7/config.7
+++ b/deps/npm/man/man7/config.7
@@ -1,4 +1,4 @@
-.TH "CONFIG" "7" "July 2026" "NPM@11.19.0" ""
+.TH "CONFIG" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBConfig\fR - About npm configuration
 .SS "Description"
diff --git a/deps/npm/man/man7/dependency-selectors.7 b/deps/npm/man/man7/dependency-selectors.7
index 4d242ab6e6c4..ec08ce0750b3 100644
--- a/deps/npm/man/man7/dependency-selectors.7
+++ b/deps/npm/man/man7/dependency-selectors.7
@@ -1,4 +1,4 @@
-.TH "SELECTORS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SELECTORS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBSelectors\fR - Dependency Selector Syntax & Querying
 .SS "Description"
diff --git a/deps/npm/man/man7/developers.7 b/deps/npm/man/man7/developers.7
index 201aedc081dd..aebb1f99a74a 100644
--- a/deps/npm/man/man7/developers.7
+++ b/deps/npm/man/man7/developers.7
@@ -1,4 +1,4 @@
-.TH "DEVELOPERS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "DEVELOPERS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBDevelopers\fR - Developer guide
 .SS "Description"
diff --git a/deps/npm/man/man7/logging.7 b/deps/npm/man/man7/logging.7
index be1e6ea6fffa..7fab6e089256 100644
--- a/deps/npm/man/man7/logging.7
+++ b/deps/npm/man/man7/logging.7
@@ -1,4 +1,4 @@
-.TH "LOGGING" "7" "July 2026" "NPM@11.19.0" ""
+.TH "LOGGING" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBLogging\fR - Why, What & How we Log
 .SS "Description"
diff --git a/deps/npm/man/man7/orgs.7 b/deps/npm/man/man7/orgs.7
index 43732ecdb5cb..975eded22dfc 100644
--- a/deps/npm/man/man7/orgs.7
+++ b/deps/npm/man/man7/orgs.7
@@ -1,4 +1,4 @@
-.TH "ORGANIZATIONS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "ORGANIZATIONS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBOrganizations\fR - Working with teams & organizations
 .SS "Description"
diff --git a/deps/npm/man/man7/package-spec.7 b/deps/npm/man/man7/package-spec.7
index d76da151b48e..a68e9b8f7e74 100644
--- a/deps/npm/man/man7/package-spec.7
+++ b/deps/npm/man/man7/package-spec.7
@@ -1,4 +1,4 @@
-.TH "SPEC" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SPEC" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBspec\fR - Package name specifier
 .SS "Description"
diff --git a/deps/npm/man/man7/registry.7 b/deps/npm/man/man7/registry.7
index 16e295f6ac11..a91c60c14565 100644
--- a/deps/npm/man/man7/registry.7
+++ b/deps/npm/man/man7/registry.7
@@ -1,4 +1,4 @@
-.TH "REGISTRY" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REGISTRY" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRegistry\fR - The JavaScript Package Registry
 .SS "Description"
diff --git a/deps/npm/man/man7/removal.7 b/deps/npm/man/man7/removal.7
index 1e0a0ddd0cf3..bb4d7a8d4365 100644
--- a/deps/npm/man/man7/removal.7
+++ b/deps/npm/man/man7/removal.7
@@ -1,4 +1,4 @@
-.TH "REMOVAL" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REMOVAL" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRemoval\fR - Cleaning the slate
 .SS "Synopsis"
diff --git a/deps/npm/man/man7/scope.7 b/deps/npm/man/man7/scope.7
index 6bb685d20984..f2744feb1343 100644
--- a/deps/npm/man/man7/scope.7
+++ b/deps/npm/man/man7/scope.7
@@ -1,4 +1,4 @@
-.TH "SCOPE" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCOPE" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScope\fR - Scoped packages
 .SS "Description"
diff --git a/deps/npm/man/man7/scripts.7 b/deps/npm/man/man7/scripts.7
index 797e70b65138..4af3522042ba 100644
--- a/deps/npm/man/man7/scripts.7
+++ b/deps/npm/man/man7/scripts.7
@@ -1,4 +1,4 @@
-.TH "SCRIPTS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCRIPTS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScripts\fR - How npm handles the "scripts" field
 .SS "Description"
diff --git a/deps/npm/man/man7/workspaces.7 b/deps/npm/man/man7/workspaces.7
index fb9807cdfe4c..b31d897d2f3d 100644
--- a/deps/npm/man/man7/workspaces.7
+++ b/deps/npm/man/man7/workspaces.7
@@ -1,4 +1,4 @@
-.TH "WORKSPACES" "7" "July 2026" "NPM@11.19.0" ""
+.TH "WORKSPACES" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBWorkspaces\fR - Working with workspaces
 .SS "Description"
diff --git a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
index e4e5bd87666d..869a6bee2380 100644
--- a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = require("balanced-match");
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -19,6 +19,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+exports.EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -68,7 +79,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -78,7 +89,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -92,25 +103,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = (0, balanced_match_1.balanced)('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -123,89 +225,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/dist/esm/index.js b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
index b2d2aa91bb1c..fd68f5702920 100644
--- a/deps/npm/node_modules/brace-expansion/dist/esm/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
@@ -15,6 +15,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 export const EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+export const EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -64,7 +75,7 @@ export function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = EXPANSION_MAX } = options;
+    const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -74,7 +85,7 @@ export function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -88,25 +99,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = balanced('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -119,89 +221,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/package.json b/deps/npm/node_modules/brace-expansion/package.json
index a5142f2787b6..4376400796c9 100644
--- a/deps/npm/node_modules/brace-expansion/package.json
+++ b/deps/npm/node_modules/brace-expansion/package.json
@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.7",
+  "version": "5.0.9",
   "files": [
     "dist"
   ],
@@ -46,7 +46,7 @@
   },
   "license": "MIT",
   "engines": {
-    "node": "18 || 20 || >=22"
+    "node": "20 || >=22"
   },
   "tshy": {
     "exports": {
diff --git a/deps/npm/node_modules/ip-address/dist/common.js b/deps/npm/node_modules/ip-address/dist/common.js
index 6b76e051b44e..0c15d21e3a39 100644
--- a/deps/npm/node_modules/ip-address/dist/common.js
+++ b/deps/npm/node_modules/ip-address/dist/common.js
@@ -1,23 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isInSubnet = isInSubnet;
+exports.isHostInSubnet = isHostInSubnet;
 exports.isCorrect = isCorrect;
 exports.prefixLengthFromMask = prefixLengthFromMask;
+exports.assertByteArray = assertByteArray;
 exports.numberToPaddedHex = numberToPaddedHex;
 exports.stringToPaddedHex = stringToPaddedHex;
 exports.testBit = testBit;
 const address_error_1 = require("./address-error");
+/**
+ * Returns whether this address's *network* is contained within `address`,
+ * i.e. whether every address this one can represent also falls inside
+ * `address`. A network wider than `address` is not contained in it, so
+ * `10.0.0.0/8` is not in `10.0.0.0/16`.
+ *
+ * To ask whether the address itself falls inside a range, ignoring any CIDR
+ * suffix it was written with, use {@link isHostInSubnet} instead. That is the
+ * question the special-use classifiers ask.
+ */
 function isInSubnet(address) {
     if (this.subnetMask < address.subnetMask) {
         return false;
     }
-    if (this.mask(address.subnetMask) === address.mask()) {
-        return true;
-    }
-    return false;
+    return isHostInSubnet.call(this, address);
+}
+/**
+ * Returns whether this address's host bits fall inside `address`, ignoring
+ * this address's own subnet mask.
+ *
+ * This is the primitive the special-use classifiers (`isLoopback`,
+ * `isPrivate`, `isLinkLocal`, `getType`, …) are built on: they answer a
+ * question about the address, so the answer must not change with the CIDR
+ * suffix the caller happened to write. Use this rather than
+ * {@link isInSubnet} when classifying a single address — notably when the
+ * address came from untrusted input and the result backs a trust-boundary
+ * decision such as an SSRF allow/deny filter.
+ */
+function isHostInSubnet(address) {
+    return this.mask(address.subnetMask) === address.mask();
 }
 function isCorrect(defaultBits) {
-    return function () {
+    return function isCorrectForm() {
         if (this.addressMinusSuffix !== this.correctForm()) {
             return false;
         }
@@ -46,6 +70,21 @@ function prefixLengthFromMask(value, totalBits) {
     }
     return firstZero;
 }
+/**
+ * Throws `AddressError` unless `bytes` holds exactly `byteCount` integers,
+ * each from `minimum` to 255. Pass a `minimum` of `-128` where signed bytes
+ * are accepted and folded to unsigned, and `0` where they are not.
+ */
+function assertByteArray(bytes, byteCount, family, minimum) {
+    if (bytes.length !== byteCount) {
+        throw new address_error_1.AddressError(`${family} addresses require exactly ${byteCount} bytes`);
+    }
+    for (let i = 0; i < bytes.length; i++) {
+        if (!Number.isInteger(bytes[i]) || bytes[i] < minimum || bytes[i] > 255) {
+            throw new address_error_1.AddressError(`All bytes must be integers between ${minimum} and 255`);
+        }
+    }
+}
 function numberToPaddedHex(number) {
     return number.toString(16).padStart(2, '0');
 }
diff --git a/deps/npm/node_modules/ip-address/dist/ipv4.js b/deps/npm/node_modules/ip-address/dist/ipv4.js
index 2c0fd182086d..1360e1836a0d 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv4.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv4.js
@@ -35,6 +35,7 @@ const isCorrect4 = common.isCorrect(constants.BITS);
  */
 class Address4 {
     constructor(address) {
+        this.addressMinusSuffix = '';
         this.groups = constants.GROUPS;
         this.parsedAddress = [];
         this.parsedSubnet = '';
@@ -51,6 +52,15 @@ class Address4 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         this.address = address;
         const subnet = constants.RE_SUBNET_STRING.exec(address);
         if (subnet) {
@@ -78,7 +88,7 @@ class Address4 {
             new Address4(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -90,6 +100,11 @@ class Address4 {
      */
     parse(address) {
         const groups = address.split('.');
+        // Checked before the general match so the error names the actual problem.
+        // Address6 rejects the same notation on its v4-in-v6 path.
+        if (groups.some((group) => /^0\d/.test(group))) {
+            throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
+        }
         if (!address.match(constants.RE_ADDRESS)) {
             throw new address_error_1.AddressError('Invalid IPv4 address.');
         }
@@ -128,7 +143,6 @@ class Address4 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address4(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants.BITS);
         return new Address4(`${address}/${bits}`);
@@ -328,32 +342,32 @@ class Address4 {
      * @returns {Address4}
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > 0xffffffffn) {
+        if (bigInt < BigInt(0) || bigInt > BigInt(0xffffffff)) {
             throw new address_error_1.AddressError('IPv4 BigInt must be in the range 0 to 2**32 - 1');
         }
         return Address4.fromHex(bigInt.toString(16).padStart(8, '0'));
     }
     /**
-     * Convert a byte array to an Address4 object.
+     * Convert a byte array to an Address4 object. Throws `AddressError` unless
+     * given exactly 4 integers from 0 to 255. Signed bytes are rejected, so
+     * this differs from `Address6.fromByteArray`, which folds them; the two
+     * contracts converge on this stricter form in the next major version.
      *
      * To convert from a Node.js `Buffer`, spread it: `Address4.fromByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 bytes (0-255)
      * @returns {Address4}
      */
     static fromByteArray(bytes) {
-        if (bytes.length !== 4) {
-            throw new address_error_1.AddressError('IPv4 addresses require exactly 4 bytes');
-        }
-        // Validate that all bytes are within valid range (0-255)
-        for (let i = 0; i < bytes.length; i++) {
-            if (!Number.isInteger(bytes[i]) || bytes[i] < 0 || bytes[i] > 255) {
-                throw new address_error_1.AddressError('All bytes must be integers between 0 and 255');
-            }
-        }
+        common.assertByteArray(bytes, 4, 'IPv4', 0);
         return this.fromUnsignedByteArray(bytes);
     }
     /**
-     * Convert an unsigned byte array to an Address4 object
+     * Convert an unsigned byte array to an Address4 object. Throws
+     * `AddressError` unless given exactly 4 bytes, and rejects values outside
+     * 0 to 255 when parsing the resulting address.
+     *
+     * To convert from a Node.js `Buffer`, spread it:
+     * `Address4.fromUnsignedByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 unsigned bytes (0-255)
      * @returns {Address4}
      */
@@ -383,7 +397,8 @@ class Address4 {
         return this.binaryZeroPad().slice(start, end);
     }
     /**
-     * Return the reversed ip6.arpa form of the address
+     * Return the reversed in-addr.arpa form of the address, e.g.
+     * `42.2.0.192.in-addr.arpa.` for `192.0.2.42`.
      * @param {Object} options
      * @param {boolean} options.omitSuffix - omit the "in-addr.arpa" suffix
      * @returns {String}
@@ -403,49 +418,49 @@ class Address4 {
      * @returns {boolean}
      */
     isMulticast() {
-        return this.isInSubnet(MULTICAST_V4);
+        return this.isHostInSubnet(MULTICAST_V4);
     }
     /**
      * Returns true if the address is in one of the [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private address ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).
      * @returns {boolean}
      */
     isPrivate() {
-        return PRIVATE_V4.some((subnet) => this.isInSubnet(subnet));
+        return PRIVATE_V4.some((subnet) => this.isHostInSubnet(subnet));
     }
     /**
      * Returns true if the address is in the loopback range `127.0.0.0/8` ([RFC 1122](https://datatracker.ietf.org/doc/html/rfc1122)).
      * @returns {boolean}
      */
     isLoopback() {
-        return this.isInSubnet(LOOPBACK_V4);
+        return this.isHostInSubnet(LOOPBACK_V4);
     }
     /**
      * Returns true if the address is in the link-local range `169.254.0.0/16` ([RFC 3927](https://datatracker.ietf.org/doc/html/rfc3927)).
      * @returns {boolean}
      */
     isLinkLocal() {
-        return this.isInSubnet(LINK_LOCAL_V4);
+        return this.isHostInSubnet(LINK_LOCAL_V4);
     }
     /**
      * Returns true if the address is the unspecified address `0.0.0.0`.
      * @returns {boolean}
      */
     isUnspecified() {
-        return this.isInSubnet(UNSPECIFIED_V4);
+        return this.isHostInSubnet(UNSPECIFIED_V4);
     }
     /**
      * Returns true if the address is the limited broadcast address `255.255.255.255` ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)).
      * @returns {boolean}
      */
     isBroadcast() {
-        return this.isInSubnet(BROADCAST_V4);
+        return this.isHostInSubnet(BROADCAST_V4);
     }
     /**
      * Returns true if the address is in the carrier-grade NAT range `100.64.0.0/10` ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)).
      * @returns {boolean}
      */
     isCGNAT() {
-        return this.isInSubnet(CGNAT_V4);
+        return this.isHostInSubnet(CGNAT_V4);
     }
     /**
      * Returns a zero-padded base-2 string representation of the address
@@ -458,12 +473,17 @@ class Address4 {
         return this._binaryZeroPad;
     }
     /**
-     * Groups an IPv4 address for inclusion at the end of an IPv6 address
+     * Groups an IPv4 address for inclusion at the end of an IPv6 address.
+     *
+     * Returns an HTML fragment: each half of the address is wrapped in a
+     * `<span>` carrying the group classes an address-inspector UI hovers on.
+     * The address content is HTML-escaped; anything you concatenate around it
+     * is your responsibility.
      * @returns {String}
      */
     groupForV6() {
         const segments = this.parsedAddress;
-        return this.address.replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
+        return this.correctForm().replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
             .slice(0, 2)
             .join('.')}</span>.<span class="hover-group group-v4 group-7">${segments
             .slice(2, 4)
diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
index a78020ee7886..d5f4fdb9c87a 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
@@ -73,7 +73,6 @@ function paddedHex(octet) {
     return parseInt(octet, 16).toString(16).padStart(4, '0');
 }
 function unsignByte(b) {
-    // eslint-disable-next-line no-bitwise
     return b & 0xff;
 }
 /**
@@ -97,6 +96,15 @@ class Address6 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         /**
          * Returns true if the address is correct, false otherwise
          * @returns {boolean}
@@ -121,7 +129,10 @@ class Address6 {
             }
             address = address.replace(constants6.RE_SUBNET_STRING, '');
         }
-        else if (/\//.test(address)) {
+        // RE_SUBNET_STRING anchors on the end of the address, so it strips only
+        // the trailing suffix. A second one left behind (`::/0/1`) is malformed
+        // and must be rejected rather than parsed as an address group.
+        if (/\//.test(address)) {
             throw new address_error_1.AddressError('Invalid subnet mask.');
         }
         const zone = constants6.RE_ZONE_STRING.exec(address);
@@ -145,7 +156,7 @@ class Address6 {
             new Address6(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -160,7 +171,7 @@ class Address6 {
      * address.correctForm(); // '::e8:d4a5:1000'
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > (1n << BigInt(constants6.BITS)) - 1n) {
+        if (bigInt < BigInt(0) || bigInt > (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1)) {
             throw new address_error_1.AddressError('IPv6 BigInt must be in the range 0 to 2**128 - 1');
         }
         const hex = bigInt.toString(16).padStart(32, '0');
@@ -181,46 +192,36 @@ class Address6 {
      * addressAndPort.port; // 8080
      */
     static fromURL(url) {
+        var _a;
         let host;
         let port = null;
         let result;
+        let error;
+        // Remove the protocol prefix, if any
+        const stripped = url.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
         // If we have brackets parse them and find a port
-        if (url.indexOf('[') !== -1 && url.indexOf(']:') !== -1) {
-            result = constants6.RE_URL_WITH_PORT.exec(url);
+        if (stripped.indexOf('[') !== -1 && stripped.indexOf(']:') !== -1) {
+            error = 'failed to parse address with port';
+            result = constants6.RE_URL_WITH_PORT.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address with port',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
             host = result[1];
             port = result[2];
-            // If there's a URL extract the address
         }
-        else if (url.indexOf('/') !== -1) {
-            // Remove the protocol prefix
-            url = url.replace(/^[a-z0-9]+:\/\//, '');
-            // Parse the address
-            result = constants6.RE_URL.exec(url);
+        else {
+            error = 'failed to parse address from URL';
+            result = constants6.RE_URL.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address from URL',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
-            host = result[1];
-            // Otherwise just assign the URL to the host and let the library parse it
-        }
-        else {
-            host = url;
+            host = (_a = result[1]) !== null && _a !== void 0 ? _a : result[2];
         }
         // If there's a port convert it to an integer
         if (port) {
             port = parseInt(port, 10);
-            // squelch out of range ports
-            if (port < 0 || port > 65536) {
+            // squelch out of range ports (valid ports are 0-65535)
+            if (port < 0 || port > 65535) {
                 port = null;
             }
         }
@@ -228,10 +229,17 @@ class Address6 {
             // Standardize `undefined` to `null`
             port = null;
         }
-        return {
-            address: new Address6(host),
-            port,
-        };
+        // The URL character class is a superset of valid IPv6, so a host the
+        // regex accepted (an IPv4 literal, bare punctuation, too many groups)
+        // can still be rejected by the parser
+        let address;
+        try {
+            address = new Address6(host);
+        }
+        catch {
+            return { error, address: null, port: null };
+        }
+        return { address, port };
     }
     /**
      * Construct an `Address6` from an address and a hex subnet mask given as
@@ -258,7 +266,6 @@ class Address6 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address6(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants6.BITS);
         return new Address6(`${address}/${bits}`);
@@ -493,7 +500,7 @@ class Address6 {
     getType() {
         for (let i = 0; i < TYPE_SUBNETS.length; i++) {
             const entry = TYPE_SUBNETS[i];
-            if (this.isInSubnet(entry[0])) {
+            if (this.isHostInSubnet(entry[0])) {
                 return entry[1];
             }
         }
@@ -635,20 +642,27 @@ class Address6 {
         }
         const groups = address.split(':');
         const lastGroup = groups.slice(-1)[0];
+        // RE_ADDRESS rejects octets with a leading zero, so a dotted-quad tail is
+        // matched permissively first: that way this notation still gets its own
+        // message with the offending octet highlighted, rather than falling
+        // through as an unrecognized group.
+        const v4Octets = lastGroup.split('.');
+        if (v4Octets.length === constants4.GROUPS &&
+            v4Octets.every((octet) => /^\d{1,3}$/.test(octet))) {
+            if (v4Octets.some((octet) => /^0\d/.test(octet))) {
+                // The prefix groups haven't been through the bad-character check
+                // yet, so escape them before including in the error HTML.
+                const highlighted = v4Octets.map(spanLeadingZeroes4).join('.');
+                const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
+                const separator = groups.length > 1 ? ':' : '';
+                throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
+            }
+        }
         const address4 = lastGroup.match(constants4.RE_ADDRESS);
         if (address4) {
             this.parsedAddress4 = address4[0];
-            this.address4 = new ipv4_1.Address4(this.parsedAddress4);
-            for (let i = 0; i < this.address4.groups; i++) {
-                if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
-                    // The prefix groups haven't been through the bad-character check
-                    // yet, so escape them before including in the error HTML.
-                    const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
-                    const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
-                    const separator = groups.length > 1 ? ':' : '';
-                    throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
-                }
-            }
+            const v4Suffix = this.subnetMask >= 96 ? `/${this.subnetMask - 96}` : '';
+            this.address4 = new ipv4_1.Address4(`${this.parsedAddress4}${v4Suffix}`);
             this.v4 = true;
             groups[groups.length - 1] = this.address4.toGroup6();
             address = groups.join(':');
@@ -734,7 +748,11 @@ class Address6 {
         return BigInt(`0x${this.parsedAddress.map(paddedHex).join('')}`);
     }
     /**
-     * Return the last two groups of this address as an IPv4 address string
+     * Return the last two groups of this address as an IPv4 address string.
+     * If this address carries a CIDR prefix that covers the trailing 32 bits
+     * (i.e. `subnetMask >= 96`), the resulting `Address4` inherits the
+     * corresponding v4 prefix (`subnetMask - 96`); otherwise it defaults to
+     * `/32`.
      * @returns {Address4}
      * @example
      * var address = new Address6('2001:4860:4001::1825:bf11');
@@ -742,7 +760,18 @@ class Address6 {
      */
     to4() {
         const binary = this.binaryZeroPad().split('');
-        return ipv4_1.Address4.fromHex(BigInt(`0b${binary.slice(96, 128).join('')}`).toString(16).padStart(8, '0'));
+        const hex = BigInt(`0b${binary.slice(96, 128).join('')}`)
+            .toString(16)
+            .padStart(8, '0');
+        if (this.subnetMask >= 96) {
+            const v4Mask = this.subnetMask - 96;
+            const groups = [];
+            for (let i = 0; i < 8; i += 2) {
+                groups.push(parseInt(hex.slice(i, i + 2), 16));
+            }
+            return new ipv4_1.Address4(`${groups.join('.')}/${v4Mask}`);
+        }
+        return ipv4_1.Address4.fromHex(hex);
     }
     /**
      * Return the v4-in-v6 form of the address
@@ -756,7 +785,7 @@ class Address6 {
         if (!/:$/.test(correct)) {
             infix = ':';
         }
-        return correct + infix + address4.address;
+        return correct + infix + address4.correctForm();
     }
     /**
      * Decodes the Teredo tunneling fields embedded in this address. Returns the
@@ -788,11 +817,9 @@ class Address6 {
         */
         const prefix = this.getBitsBase16(0, 32);
         const bitsForUdpPort = this.getBits(80, 96);
-        // eslint-disable-next-line no-bitwise
         const udpPort = (bitsForUdpPort ^ BigInt('0xffff')).toString();
         const server4 = ipv4_1.Address4.fromHex(this.getBitsBase16(32, 64));
         const bitsForClient4 = this.getBits(96, 128);
-        // eslint-disable-next-line no-bitwise
         const client4 = ipv4_1.Address4.fromHex((bitsForClient4 ^ BigInt('0xffffffff')).toString(16).padStart(8, '0'));
         const flagsBase2 = this.getBitsBase2(64, 80);
         const coneNat = (0, common_1.testBit)(flagsBase2, 15);
@@ -874,12 +901,14 @@ class Address6 {
         }
         else {
             const beforeU = 64 - pl;
-            bits =
-                prefixBits.slice(0, pl) +
-                    v4Bits.slice(0, beforeU) +
-                    '00000000' +
-                    v4Bits.slice(beforeU) +
-                    '0'.repeat(128 - 72 - (32 - beforeU));
+            bits = [
+                prefixBits.slice(0, pl),
+                v4Bits.slice(0, beforeU),
+                // Bits 64 to 71 are the reserved u octet and are always zero.
+                '00000000',
+                v4Bits.slice(beforeU),
+                '0'.repeat(128 - 72 - (32 - beforeU)),
+            ].join('');
         }
         const hex = BigInt(`0b${bits}`).toString(16).padStart(32, '0');
         const groups = [];
@@ -902,7 +931,7 @@ class Address6 {
         if (pl !== 32 && pl !== 40 && pl !== 48 && pl !== 56 && pl !== 64 && pl !== 96) {
             throw new address_error_1.AddressError('NAT64 prefix length must be 32, 40, 48, 56, 64, or 96');
         }
-        if (!this.isInSubnet(prefix6)) {
+        if (!this.isHostInSubnet(prefix6)) {
             return null;
         }
         const bits = this.binaryZeroPad();
@@ -927,9 +956,9 @@ class Address6 {
      * @returns {Array}
      */
     toByteArray() {
-        const valueWithoutPadding = this.bigInt().toString(16);
-        const leadingPad = '0'.repeat(valueWithoutPadding.length % 2);
-        const value = `${leadingPad}${valueWithoutPadding}`;
+        const value = this.bigInt()
+            .toString(16)
+            .padStart(constants6.BITS / 4, '0');
         const bytes = [];
         for (let i = 0, length = value.length; i < length; i += 2) {
             bytes.push(parseInt(value.substring(i, i + 2), 16));
@@ -943,24 +972,39 @@ class Address6 {
      * @returns {Array}
      */
     toUnsignedByteArray() {
+        // toByteArray() emits 0 to 255, so unsigning it is an identity mapping and
+        // the two methods return equal arrays. 11.0.0 keeps one of them and makes
+        // this a deprecated alias; test/common-test.ts fails at that version.
         return this.toByteArray().map(unsignByte);
     }
     /**
      * Convert a byte array to an Address6 object.
      *
+     * Accepts unsigned bytes (0 to 255) or signed bytes (-128 to 127, as an
+     * `Int8Array` or a Java `byte[]` holds them), folding signed values to their
+     * unsigned equivalent. Throws `AddressError` unless given exactly 16
+     * integers from -128 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromByteArray(bytes) {
+        // Address4.fromByteArray takes unsigned bytes only. 11.0.0 aligns this
+        // method with it, at which point the -128 floor here, unsignByte, and the
+        // mapping below all go; test/common-test.ts fails at that version.
+        common.assertByteArray(bytes, 16, 'IPv6', -128);
         return this.fromUnsignedByteArray(bytes.map(unsignByte));
     }
     /**
      * Convert an unsigned byte array to an Address6 object.
      *
+     * Throws `AddressError` unless given exactly 16 integers from 0 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromUnsignedByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromUnsignedByteArray(bytes) {
+        common.assertByteArray(bytes, 16, 'IPv6', 0);
         const BYTE_MAX = BigInt('256');
         let result = BigInt('0');
         let multiplier = BigInt('1');
@@ -982,7 +1026,11 @@ class Address6 {
      * @returns {boolean}
      */
     isLinkLocal() {
-        // Zeroes are required, i.e. we can't check isInSubnet with 'fe80::/10'
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLinkLocal();
+        }
+        // Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'
         if (this.getBitsBase2(0, 64) ===
             '1111111010000000000000000000000000000000000000000000000000000000') {
             return true;
@@ -994,6 +1042,10 @@ class Address6 {
      * @returns {boolean}
      */
     isMulticast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isMulticast();
+        }
         const type = this.getType();
         return type === 'Multicast' || type.startsWith('Multicast ');
     }
@@ -1016,27 +1068,54 @@ class Address6 {
      * @returns {boolean}
      */
     isMapped4() {
-        return this.isInSubnet(IPV4_MAPPED_SUBNET);
+        return this.isHostInSubnet(IPV4_MAPPED_SUBNET);
+    }
+    /**
+     * If this address embeds a routable IPv4 address — i.e. it is IPv4-mapped
+     * (`::ffff:0:0/96`) or sits in the NAT64 well-known prefix (`64:ff9b::/96`,
+     * [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052)) — return that
+     * embedded address as an {@link Address4}; otherwise return null.
+     *
+     * The special-property checks (`isLoopback`, `isLinkLocal`, `isMulticast`,
+     * `isUnspecified`, `isPrivate`, `isCGNAT`, `isBroadcast`) call this first and
+     * delegate to the embedded {@link Address4} when present, so a literal such as
+     * `::ffff:127.0.0.1` is classified by what it actually reaches (loopback)
+     * rather than by its IPv6 wrapper (which `getType()` reports as IPv4-mapped).
+     * This matters wherever the checks back a trust-boundary decision (e.g. an
+     * SSRF allow/deny filter): without normalization, `::ffff:10.0.0.1`,
+     * `::ffff:169.254.169.254`, `64:ff9b::7f00:1`, etc. would all read as
+     * non-internal.
+     * @returns {Address4 | null}
+     */
+    embeddedIPv4() {
+        if (this.isMapped4() || this.isHostInSubnet(NAT64_WELL_KNOWN_SUBNET)) {
+            return this.to4();
+        }
+        return null;
     }
     /**
      * Returns true if the address is a Teredo address, false otherwise
      * @returns {boolean}
      */
     isTeredo() {
-        return this.isInSubnet(TEREDO_SUBNET);
+        return this.isHostInSubnet(TEREDO_SUBNET);
     }
     /**
      * Returns true if the address is a 6to4 address, false otherwise
      * @returns {boolean}
      */
     is6to4() {
-        return this.isInSubnet(SIX_TO_FOUR_SUBNET);
+        return this.isHostInSubnet(SIX_TO_FOUR_SUBNET);
     }
     /**
      * Returns true if the address is a loopback address, false otherwise
      * @returns {boolean}
      */
     isLoopback() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLoopback();
+        }
         return this.getType() === 'Loopback';
     }
     /**
@@ -1044,13 +1123,64 @@ class Address6 {
      * @returns {boolean}
      */
     isULA() {
-        return this.isInSubnet(ULA_SUBNET);
+        return this.isHostInSubnet(ULA_SUBNET);
+    }
+    /**
+     * Returns true if the address is private, i.e. a Unique Local Address in
+     * `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)) or an
+     * IPv4-mapped / NAT64 address whose embedded IPv4 address is in one of the
+     * [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private ranges
+     * (e.g. `::ffff:10.0.0.1`). This is the IPv6 counterpart to
+     * {@link Address4.isPrivate}; use it instead of {@link isULA} when you need to
+     * catch mapped RFC 1918 addresses as well as native ULAs.
+     * @returns {boolean}
+     */
+    isPrivate() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isPrivate();
+        }
+        return this.isULA();
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is in the carrier-grade NAT range `100.64.0.0/10`
+     * ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)), false
+     * otherwise. There is no native IPv6 CGNAT range, so this only ever returns
+     * true for an embedded IPv4 address (e.g. `::ffff:100.64.0.1`).
+     * @returns {boolean}
+     */
+    isCGNAT() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isCGNAT();
+        }
+        return false;
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is the limited broadcast address `255.255.255.255`
+     * ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)), false otherwise.
+     * There is no IPv6 broadcast, so this only ever returns true for an embedded
+     * IPv4 address (e.g. `::ffff:255.255.255.255`).
+     * @returns {boolean}
+     */
+    isBroadcast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isBroadcast();
+        }
+        return false;
     }
     /**
      * Returns true if the address is the unspecified address `::`.
      * @returns {boolean}
      */
     isUnspecified() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isUnspecified();
+        }
         return this.getType() === 'Unspecified';
     }
     /**
@@ -1058,7 +1188,7 @@ class Address6 {
      * @returns {boolean}
      */
     isDocumentation() {
-        return this.isInSubnet(DOCUMENTATION_SUBNET);
+        return this.isHostInSubnet(DOCUMENTATION_SUBNET);
     }
     // #endregion
     // #region HTML
@@ -1111,7 +1241,12 @@ class Address6 {
         return `<a href="${safeHref}">${safeForm}</a>`;
     }
     /**
-     * Groups an address
+     * Groups an address.
+     *
+     * Returns an HTML fragment: each group is wrapped in a `<span>` carrying
+     * the group classes an address-inspector UI hovers on. The address content
+     * is HTML-escaped; anything you concatenate around it is your
+     * responsibility.
      * @returns {String}
      */
     group() {
@@ -1214,4 +1349,5 @@ const SIX_TO_FOUR_SUBNET = new Address6('2002::/16');
 const ULA_SUBNET = new Address6('fc00::/7');
 const DOCUMENTATION_SUBNET = new Address6('2001:db8::/32');
 const IPV4_MAPPED_SUBNET = new Address6('::ffff:0:0/96');
+const NAT64_WELL_KNOWN_SUBNET = new Address6('64:ff9b::/96');
 //# sourceMappingURL=ipv6.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v4/constants.js b/deps/npm/node_modules/ip-address/dist/v4/constants.js
index 6fa2518f9649..158288b7de65 100644
--- a/deps/npm/node_modules/ip-address/dist/v4/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v4/constants.js
@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
 exports.BITS = 32;
 exports.GROUPS = 4;
-exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g;
+// Each octet is 0-255 written without a leading zero. A leading zero is
+// octal to the WHATWG URL parser, inet_aton, and getaddrinfo, but decimal to
+// parseInt(part, 10), so accepting the notation would make this library
+// disagree with the network stack about which host a string names.
+exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g;
 exports.RE_SUBNET_STRING = /\/\d{1,2}$/;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v6/constants.js b/deps/npm/node_modules/ip-address/dist/v6/constants.js
index 1a8cd1dd616e..4616cad66b6a 100644
--- a/deps/npm/node_modules/ip-address/dist/v6/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v6/constants.js
@@ -44,6 +44,7 @@ exports.TYPES = {
     'ff05::1:3/128': 'Multicast (All DHCP servers in this site)',
     '::/128': 'Unspecified',
     '::1/128': 'Loopback',
+    '::ffff:0:0/96': 'IPv4-mapped',
     'ff00::/8': 'Multicast',
     'fe80::/10': 'Link-local unicast',
     'fc00::/7': 'Unique local',
@@ -76,6 +77,6 @@ exports.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/;
  * @static
  */
 exports.RE_ZONE_STRING = /%.*$/;
-exports.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/;
-exports.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
+exports.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i;
+exports.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
index 47d109ec6f34..6ea2d24bd62b 100644
--- a/deps/npm/node_modules/ip-address/package.json
+++ b/deps/npm/node_modules/ip-address/package.json
@@ -16,7 +16,7 @@
     "bigint",
     "browser"
   ],
-  "version": "10.2.0",
+  "version": "10.5.0",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",
@@ -25,6 +25,9 @@
     "docs": "tsx scripts/build-readme.ts",
     "build": "rm -rf dist; mkdir dist; tsc",
     "prepack": "npm run docs && npm run build",
+    "prepare": "git config core.hooksPath hooks || true",
+    "lint": "prettier --check . && eslint . --ext .ts,.js --max-warnings 0",
+    "lint:fix": "prettier --write . && eslint . --ext .ts,.js --max-warnings 0 --fix",
     "test-ci": "c8 --experimental-monocart mocha",
     "test": "mocha",
     "watch": "mocha --watch"
@@ -54,7 +57,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git://github.com/beaugunderson/ip-address.git"
+    "url": "https://github.com/beaugunderson/ip-address.git"
   },
   "overrides": {
     "diff": "^8.0.3",
@@ -70,11 +73,10 @@
     "chai": "^6.2.2",
     "eslint": "^8.57.1",
     "eslint_d": "^14.0.4",
-    "eslint-config-airbnb": "^19.0.4",
+    "eslint-config-airbnb-base": "^15.0.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-filenames": "^1.3.2",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-sort-imports-es6-autofix": "^0.6.0",
     "mocha": "^11.7.5",
diff --git a/deps/npm/node_modules/libnpmpack/lib/index.js b/deps/npm/node_modules/libnpmpack/lib/index.js
index 6c8ee3fd6334..ce6707938bb3 100644
--- a/deps/npm/node_modules/libnpmpack/lib/index.js
+++ b/deps/npm/node_modules/libnpmpack/lib/index.js
@@ -12,6 +12,11 @@ async function pack (spec = 'file:.', opts = {}) {
   // gets spec
   spec = npa(spec)
 
+  // An explicit directory is the package being packed, not a dependency fetch.
+  if (spec.type === 'directory') {
+    opts = { ...opts, allowDirectory: 'all' }
+  }
+
   const manifest = await pacote.manifest(spec, { ...opts, Arborist, _isRoot: true })
 
   const stdio = opts.foregroundScripts ? 'inherit' : 'pipe'
diff --git a/deps/npm/node_modules/libnpmpack/package.json b/deps/npm/node_modules/libnpmpack/package.json
index 5741c8522c19..54c31fccd635 100644
--- a/deps/npm/node_modules/libnpmpack/package.json
+++ b/deps/npm/node_modules/libnpmpack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.12",
+  "version": "9.1.13",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
diff --git a/deps/npm/node_modules/tar/dist/commonjs/index.min.js b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
index 1a229a01e5a5..c1fe035f48f3 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/index.min.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
@@ -1,4 +1,4 @@
-"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),y=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[y]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[y])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[y])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[y]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[y]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[y])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[y]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==y&&this[y])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[y])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(y,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(y,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(y,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(y,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,E)=>{o=E,n=u,this.once(y,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(y,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(y,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[y])return e?this.emit("error",e):this.emit(y),this;this[y]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(y),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.dealias=b.isNoFile=b.isFile=b.isAsync=b.isSync=b.isAsyncNoFile=b.isSyncNoFile=b.isAsyncFile=b.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;b.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;b.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;b.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;b.isAsyncNoFile=Go;var Zo=s=>!!s.sync;b.isSync=Zo;var Yo=s=>!s.sync;b.isAsync=Yo;var Ko=s=>!!s.file;b.isFile=Ko;var Vo=s=>!s.file;b.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};b.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
+"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),E=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[E]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[E])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[E])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[E]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[E]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[E])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[E]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==E&&this[E])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[E])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(E,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(E,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(E,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(E,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,b)=>{o=b,n=u,this.once(E,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(E,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(E,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[E])return e?this.emit("error",e):this.emit(E),this;this[E]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(E),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.dealias=S.isNoFile=S.isFile=S.isAsync=S.isSync=S.isAsyncNoFile=S.isSyncNoFile=S.isAsyncFile=S.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;S.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;S.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;S.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;S.isAsyncNoFile=Go;var Zo=s=>!!s.sync;S.isSync=Zo;var Yo=s=>!s.sync;S.isAsync=Yo;var Ko=s=>!!s.file;S.isFile=Ko;var Vo=s=>!s.file;S.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};S.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(e,t,i=!1){return new s(Aa(Ia(e),t),i)}};ii.Pax=Is;var Aa=(s,e)=>e?Object.assign({},e,s):s,Ia=s=>s.replace(/\n$/,"").split(`
-`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),S=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[S];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){this[ne]||(this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1}))}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[S]===void 0||this.brotli===void 0&&this[S]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[S]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[S]=!1);let o=!1;if(this[S]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[S]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[S]===void 0||this[S]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[S]=this[S]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[S].on("data",c=>{this[nn](c)&&this[li](c)}),this[S].on("error",c=>{this[ne]||this.abort(c)}),this[S].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[S][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[S]?(this[Ot]+=e.length,this[S].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[S]?(e&&(this[Ot]+=e.length,this[S].write(e)),this[S].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(n=>[(0,Gs.stripTrailingSlashes)(n),!0])),i=s.filter,r=(n,o="")=>{let a=o||(0,on.parse)(n).root||".",h;if(n===a)h=!1;else{let l=t.get(n);h=l!==void 0?l:r((0,on.dirname)(n),a)}return t.set(n,h),h};s.filter=i?(n,o)=>i(n,o)&&r((0,Gs.stripTrailingSlashes)(n)):n=>r((0,Gs.stripTrailingSlashes)(n))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),E=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>E(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,E);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>E(null,w??void 0),E);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,E)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,E=>E?m.default.utimes(h,c,u,D=>o(D&&E)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,E=>E?m.default.chown(h,c,u,D=>o(D&&E)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),E=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,E);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,E)};q.default.read(n,u,0,512,l,E)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,E)=>{if(u)return q.default.close(c,()=>o(u));i(c,E.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
+`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),y=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[y];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){if(!this[ne]){if(this[y]){let t=this[y];t.write=()=>!0,t.end=()=>t,t.emit=()=>!1,t.destroy?.()}this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1})}}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[y]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[y]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[y]=this[y]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[y].on("data",c=>{this[nn](c)&&this[li](c)}),this[y].on("error",c=>{this[ne]||this.abort(c)}),this[y].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[y][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[y]?(this[Ot]+=e.length,this[y].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[y]?(e&&(this[Ot]+=e.length,this[y].write(e)),this[y].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(o=>[(0,Gs.stripTrailingSlashes)(o),!0])),i=s.filter,r=100,n=(o,a="",h=0)=>{if(h>=r)return t.set(o,!1),!1;let l=a||(0,on.parse)(o).root||".",c;if(o===l)c=!1;else{let u=t.get(o);c=u!==void 0?u:n((0,on.dirname)(o),l,h+1)}return t.set(o,c),c};s.filter=i?(o,a)=>i(o,a)&&n((0,Gs.stripTrailingSlashes)(o)):o=>n((0,Gs.stripTrailingSlashes)(o))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),b=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>b(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,b);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>b(null,w??void 0),b);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,b)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,b=>b?m.default.utimes(h,c,u,D=>o(D&&b)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,b=>b?m.default.chown(h,c,u,D=>o(D&&b)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),b=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,b);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,b)};q.default.read(n,u,0,512,l,b)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,b)=>{if(u)return q.default.close(c,()=>o(u));i(c,b.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/commonjs/list.js b/deps/npm/node_modules/tar/dist/commonjs/list.js
index 700030a0ac10..5dfdb985cd78 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/list.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/list.js
@@ -59,14 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root);
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/commonjs/parse.js b/deps/npm/node_modules/tar/dist/commonjs/parse.js
index 2968e861ee68..6ab1e333458c 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/parse.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/parse.js
@@ -376,6 +376,16 @@ class Parser extends events_1.EventEmitter {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/dist/esm/index.min.js b/deps/npm/node_modules/tar/dist/esm/index.min.js
index bf4036b4115e..9d9044ce85e3 100644
--- a/deps/npm/node_modules/tar/dist/esm/index.min.js
+++ b/deps/npm/node_modules/tar/dist/esm/index.min.js
@@ -1,4 +1,4 @@
-var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),w=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[w]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[w])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[w])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[w]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[w]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[w])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[w]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==w&&this[w])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[w])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(w,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(w,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(w,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(w,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,S)=>{o=S,n=d,this.once(w,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(w,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(w,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[w])return t?this.emit("error",t):this.emit(w),this;this[w]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(w),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),u=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[u];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[u]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[u]=="number"?this[zt]():this[at]()}get fd(){return this[u]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[u]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[u],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[u]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[u],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[u];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[u]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[u]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[u]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[u]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[u]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[u]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[u],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[u],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[u],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var mn=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=mn(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=un(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},un=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
+var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),S=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[S]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[S])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[S])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[S]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[S]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[S])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[S]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==S&&this[S])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[S])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(S,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(S,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(S,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(S,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,y)=>{o=y,n=d,this.once(S,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(S,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(S,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[S])return t?this.emit("error",t):this.emit(S),this;this[S]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(S),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),m=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[m];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[m]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[m]=="number"?this[zt]():this[at]()}get fd(){return this[m]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[m]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[m],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[m]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[m],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[m];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[m]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[m]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[m]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[m]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[m]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[m]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[m],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[m],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[m],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var un=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=un(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=mn(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},mn=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(t,e,i=!1){return new s(On(Tn(t),e),i)}},On=(s,t)=>t?Object.assign({},t,s):s,Tn=s=>s.replace(/\n$/,"").split(`
-`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),mt=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),y=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[mt]=!1;[y];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){this[$]||(this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1}))}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[y]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[y]===!1&&h)if(t.length<512)if(this[mt])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let a=this[mt];this[mt]=!1,this[y]=this[y]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[y].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[y].on("error",c=>{this[$]||this.abort(c)}),this[y].on("end",()=>{this[mt]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[y][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[y]?(this[le]+=t.length,this[y].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[mt]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[mt])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[y]?(t&&(this[le]+=t.length,this[y].write(t)),this[y].end()):(this[mt]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var ut=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(n=>[ut(n),!0])),i=s.filter,r=(n,o="")=>{let h=o||kn(n).root||".",a;if(n===h)a=!1;else{let l=e.get(n);a=l!==void 0?l:r(Fn(n),h)}return e.set(n,a),a};s.filter=i?(n,o)=>i(n,o)&&r(ut(n)):n=>r(ut(n))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import ui from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),ut(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new me(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new me(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new me(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var me=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),ue=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),ms=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),mi=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[mi];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[ue]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[mi]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[ue]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[ue]=!0,this[Ft](),i&&i(),this}write(t){if(this[ue])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";ui[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[ms](t){t.pending=!0,this[G]+=1,ui.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[ue]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[ms](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[mi](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[mi]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,ui[e](t.absolute))}[ms](t){this[fi](t,ui.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import m from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:mr,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,ur=!Er&&typeof mr=="number"?mr|Sr|wr|yr:null,us=ur!==null?()=>ur:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),S=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>S(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,S);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>S(null,E??void 0),S);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,S)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>ut(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",mo=1024,uo=(s,t)=>{if(!Te)return m.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");m.rename(s,e,i=>{if(i)return t(i);m.unlink(e,t)})},po=s=>{if(!Te)return m.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");m.renameSync(s,t),m.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:mo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:us(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&m.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&m.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&m.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;m.futimes(l,c,d,S=>S?m.utimes(a,c,d,T=>o(T&&S)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&m.fchown(l,c,d,S=>S?m.chown(a,c,d,T=>o(T&&S)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,m.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,m.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);m.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{m.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?m.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return m.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);uo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){m[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>m.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{m.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>m.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{m.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=m.openSync(String(t.absolute),us(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{m.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{m.futimesSync(n,a,l)}catch(c){try{m.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{m.fchownSync(n,Number(a),Number(l))}catch(c){try{m.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{m.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{m.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>m.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{m[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),S=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,S);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,S)};v.read(n,d,0,512,l,S)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,S)=>{if(d)return v.close(c,()=>o(d));i(c,S.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
+`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),ut=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),w=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[ut]=!1;[w];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){if(!this[$]){if(this[w]){let e=this[w];e.write=()=>!0,e.end=()=>e,e.emit=()=>!1,e.destroy?.()}this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1})}}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[w]===void 0||this.brotli===void 0&&this[w]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[w]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[w]=!1);let o=!1;if(this[w]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[w]===!1&&h)if(t.length<512)if(this[ut])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[w]===void 0||this[w]===!1&&(this.brotli||o)){let a=this[ut];this[ut]=!1,this[w]=this[w]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[w].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[w].on("error",c=>{this[$]||this.abort(c)}),this[w].on("end",()=>{this[ut]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[w][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[w]?(this[le]+=t.length,this[w].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[ut]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[ut])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[w]?(t&&(this[le]+=t.length,this[w].write(t)),this[w].end()):(this[ut]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var mt=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(o=>[mt(o),!0])),i=s.filter,r=100,n=(o,h="",a=0)=>{if(a>=r)return e.set(o,!1),!1;let l=h||kn(o).root||".",c;if(o===l)c=!1;else{let d=e.get(o);c=d!==void 0?d:n(Fn(o),l,a+1)}return e.set(o,c),c};s.filter=i?(o,h)=>i(o,h)&&n(mt(o)):o=>n(mt(o))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import mi from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),mt(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new ue(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new ue(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new ue(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ue=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),me=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),us=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),ui=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[ui];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[me]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[ui]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[me]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[me]=!0,this[Ft](),i&&i(),this}write(t){if(this[me])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";mi[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[us](t){t.pending=!0,this[G]+=1,mi.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[me]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[us](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[ui](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[ui]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,mi[e](t.absolute))}[us](t){this[fi](t,mi.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import u from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:ur,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,mr=!Er&&typeof ur=="number"?ur|Sr|wr|yr:null,ms=mr!==null?()=>mr:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),y=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>y(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,y);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>y(null,E??void 0),y);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,y)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>mt(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",uo=1024,mo=(s,t)=>{if(!Te)return u.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");u.rename(s,e,i=>{if(i)return t(i);u.unlink(e,t)})},po=s=>{if(!Te)return u.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");u.renameSync(s,t),u.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:uo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:ms(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&u.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&u.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&u.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;u.futimes(l,c,d,y=>y?u.utimes(a,c,d,T=>o(T&&y)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&u.fchown(l,c,d,y=>y?u.chown(a,c,d,T=>o(T&&y)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,u.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,u.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);u.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{u.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?u.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return u.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);mo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){u[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>u.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{u.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>u.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{u.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=u.openSync(String(t.absolute),ms(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{u.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{u.futimesSync(n,a,l)}catch(c){try{u.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{u.fchownSync(n,Number(a),Number(l))}catch(c){try{u.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{u.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{u.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>u.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{u[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),y=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,y);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,y)};v.read(n,d,0,512,l,y)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,y)=>{if(d)return v.close(c,()=>o(d));i(c,y.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/esm/list.js b/deps/npm/node_modules/tar/dist/esm/list.js
index 4c3af58192ec..08bdbe4ad85c 100644
--- a/deps/npm/node_modules/tar/dist/esm/list.js
+++ b/deps/npm/node_modules/tar/dist/esm/list.js
@@ -20,14 +20,22 @@ const onReadEntryFunction = (opt) => {
 export const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [stripTrailingSlashes(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || parse(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas(dirname(file), root);
+            ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/esm/parse.js b/deps/npm/node_modules/tar/dist/esm/parse.js
index fb303a5171be..92add3a903fd 100644
--- a/deps/npm/node_modules/tar/dist/esm/parse.js
+++ b/deps/npm/node_modules/tar/dist/esm/parse.js
@@ -373,6 +373,16 @@ export class Parser extends EE {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/package.json b/deps/npm/node_modules/tar/package.json
index 9d082e440494..f19ece377d9d 100644
--- a/deps/npm/node_modules/tar/package.json
+++ b/deps/npm/node_modules/tar/package.json
@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.19",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"
diff --git a/deps/npm/node_modules/undici/lib/core/request.js b/deps/npm/node_modules/undici/lib/core/request.js
index 4da60667ec29..8e7ecc73084b 100644
--- a/deps/npm/node_modules/undici/lib/core/request.js
+++ b/deps/npm/node_modules/undici/lib/core/request.js
@@ -350,7 +350,13 @@ function processHeader (request, key, val) {
       } else if (typeof val[i] === 'object') {
         throw new InvalidArgumentError(`invalid ${key} header`)
       } else {
-        arr.push(`${val[i]}`)
+        // Coerce primitives (and reject unsafe coercions such as functions
+        // with a crafted toString/Symbol.toPrimitive).
+        const str = `${val[i]}`
+        if (!isValidHeaderValue(str)) {
+          throw new InvalidArgumentError(`invalid ${key} header`)
+        }
+        arr.push(str)
       }
     }
     val = arr
@@ -361,7 +367,12 @@ function processHeader (request, key, val) {
   } else if (val === null) {
     val = ''
   } else {
+    // Coerce primitives (and reject unsafe coercions such as functions
+    // with a crafted toString/Symbol.toPrimitive).
     val = `${val}`
+    if (!isValidHeaderValue(val)) {
+      throw new InvalidArgumentError(`invalid ${key} header`)
+    }
   }
 
   if (headerName === 'host') {
diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
index 9455517a19b1..a801ecb36046 100644
--- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
+++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
@@ -10,6 +10,7 @@ const {
   RequestContentLengthMismatchError,
   ResponseContentLengthMismatchError,
   RequestAbortedError,
+  InvalidArgumentError,
   HeadersTimeoutError,
   HeadersOverflowError,
   SocketError,
@@ -993,8 +994,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }
 
   if (body && typeof body.read === 'function') {
diff --git a/deps/npm/node_modules/undici/lib/handler/retry-handler.js b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
index 5d1ccf005387..c62a2409f3ae 100644
--- a/deps/npm/node_modules/undici/lib/handler/retry-handler.js
+++ b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
@@ -15,6 +15,28 @@ function calculateRetryAfterHeader (retryAfter) {
   return new Date(retryAfter).getTime() - current
 }
 
+function validatePartialResponseContentLength (headers, range, statusCode, retryCount) {
+  const contentLength = headers['content-length']
+  if (contentLength == null) {
+    return null
+  }
+
+  if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+    return null
+  }
+
+  const length = Number(contentLength)
+  const expectedLength = range.end - range.start + 1
+  if (!Number.isFinite(length) || length !== expectedLength) {
+    return new RequestRetryError('Content-Length mismatch', statusCode, {
+      headers,
+      data: { count: retryCount }
+    })
+  }
+
+  return null
+}
+
 class RetryHandler {
   constructor (opts, handlers) {
     const { retryOptions, ...dispatchOpts } = opts
@@ -229,6 +251,12 @@ class RetryHandler {
         return false
       }
 
+      const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount)
+      if (contentLengthError != null) {
+        this.abort(contentLengthError)
+        return false
+      }
+
       const { start, size, end = size - 1 } = contentRange
 
       assert(this.start === start, 'content-range mismatch')
@@ -252,6 +280,12 @@ class RetryHandler {
           )
         }
 
+        const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount)
+        if (contentLengthError != null) {
+          this.abort(contentLengthError)
+          return false
+        }
+
         const { start, size, end = size - 1 } = range
         assert(
           start != null && Number.isFinite(start),
diff --git a/deps/npm/node_modules/undici/lib/web/cookies/util.js b/deps/npm/node_modules/undici/lib/web/cookies/util.js
index 254f5419e905..ca408e153abb 100644
--- a/deps/npm/node_modules/undici/lib/web/cookies/util.js
+++ b/deps/npm/node_modules/undici/lib/web/cookies/util.js
@@ -105,7 +105,7 @@ function validateCookiePath (path) {
 
     if (
       code < 0x20 || // exclude CTLs (0-31)
-      code === 0x7F || // DEL
+      code > 0x7E || // exclude DEL and non-ascii
       code === 0x3B // ;
     ) {
       throw new Error('Invalid cookie path')
@@ -114,16 +114,80 @@ function validateCookiePath (path) {
 }
 
 /**
- * I have no idea why these values aren't allowed to be honest,
- * but Deno tests these. - Khafra
+ * <let-dig> ::= <letter> | <digit>
+ *
+ * <letter> ::= any one of the 52 alphabetic characters A through Z in
+ * upper case and a through z in lower case
+ *
+ * <digit> ::= any one of the ten digits 0 through 9r
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @param {number} code
+ */
+function isLetterOrDigit (code) {
+  return (
+    (code >= 0x30 && code <= 0x39) || // 0-9
+    (code >= 0x41 && code <= 0x5A) || // A-Z
+    (code >= 0x61 && code <= 0x7A) // a-z
+  )
+}
+
+/**
+ * Validates a cookie domain against the "preferred name syntax".
+ *
+ * <domain>      ::= <subdomain> | " "
+ * <subdomain>   ::= <label> | <subdomain> "." <label>
+ * <label>       ::= <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ * <ldh-str>     ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp> ::= <let-dig> | "-"
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @see https://www.rfc-editor.org/rfc/rfc1123#section-2.1
+ * @see https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4
  * @param {string} domain
  */
 function validateCookieDomain (domain) {
-  if (
-    domain.startsWith('-') ||
-    domain.endsWith('.') ||
-    domain.endsWith('-')
-  ) {
+  // <domain> ::= <subdomain> | " "
+  if (domain === ' ') {
+    return
+  }
+
+  if (domain.length > 255) {
+    throw new Error('Invalid cookie domain')
+  }
+
+  let labelLength = 0
+
+  for (let i = 0; i < domain.length; ++i) {
+    const code = domain.charCodeAt(i)
+
+    if (code === 0x2E) {
+      if (labelLength === 0) {
+        throw new Error('Invalid cookie domain')
+      }
+
+      if (domain.charCodeAt(i - 1) === 0x2D) { // "-"
+        throw new Error('Invalid cookie domain')
+      }
+
+      labelLength = 0
+      continue
+    }
+
+    if (labelLength === 0 && !isLetterOrDigit(code)) {
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (!isLetterOrDigit(code) && code !== 0x2D) { // "-"
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (++labelLength > 63) {
+      throw new Error('Invalid cookie domain')
+    }
+  }
+
+  if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 0x2D) { // "-"
     throw new Error('Invalid cookie domain')
   }
 }
@@ -266,7 +330,13 @@ function stringify (cookie) {
 
     const [key, ...value] = part.split('=')
 
-    out.push(`${key.trim()}=${value.join('=')}`)
+    const trimmedKey = key.trim()
+    const joinedValue = value.join('=')
+
+    validateCookieName(trimmedKey)
+    validateCookieValue(joinedValue)
+
+    out.push(`${trimmedKey}=${joinedValue}`)
   }
 
   return out.join('; ')
diff --git a/deps/npm/node_modules/undici/package.json b/deps/npm/node_modules/undici/package.json
index 3c2001f391e3..cd46deca2448 100644
--- a/deps/npm/node_modules/undici/package.json
+++ b/deps/npm/node_modules/undici/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "6.27.0",
+  "version": "6.28.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
diff --git a/deps/npm/package.json b/deps/npm/package.json
index 5ce61281a2b0..a67f34569558 100644
--- a/deps/npm/package.json
+++ b/deps/npm/package.json
@@ -1,5 +1,5 @@
 {
-  "version": "11.19.0",
+  "version": "11.19.1",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -81,7 +81,7 @@
     "libnpmexec": "^10.3.2",
     "libnpmfund": "^7.0.26",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.12",
+    "libnpmpack": "^9.1.13",
     "libnpmpublish": "^11.2.0",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",
@@ -110,7 +110,7 @@
     "spdx-expression-parse": "^4.0.0",
     "ssri": "^13.0.1",
     "supports-color": "^10.2.2",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^2.0.2",
     "treeverse": "^3.0.0",
diff --git a/deps/npm/test/lib/commands/pack.js b/deps/npm/test/lib/commands/pack.js
index 9805427de4f6..21d961ebef6e 100644
--- a/deps/npm/test/lib/commands/pack.js
+++ b/deps/npm/test/lib/commands/pack.js
@@ -113,6 +113,25 @@ t.test('dry run', async t => {
   t.throws(() => fs.statSync(path.resolve(npm.prefix, filename)))
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry run with allow-directory=${allowDirectory}`, async t => {
+    const { npm, outputs } = await loadMockNpm(t, {
+      prefixDir: {
+        'package.json': JSON.stringify({
+          name: 'test-package',
+          version: '1.0.0',
+        }),
+      },
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+      },
+    })
+    await npm.exec('pack', [])
+    t.strictSame(outputs, ['test-package-1.0.0.tgz'])
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { npm, outputs, logs } = await loadMockNpm(t, {
     prefixDir: {
diff --git a/deps/npm/test/lib/commands/publish.js b/deps/npm/test/lib/commands/publish.js
index b204f7452a65..98576b08ea30 100644
--- a/deps/npm/test/lib/commands/publish.js
+++ b/deps/npm/test/lib/commands/publish.js
@@ -151,6 +151,25 @@ t.test('dry-run', async t => {
   t.matchSnapshot(logs.notice)
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry-run with allow-directory=${allowDirectory}`, async t => {
+    const { joinedOutput, npm, registry } = await loadNpmWithRegistry(t, {
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+        ...auth,
+      },
+      prefixDir: {
+        'package.json': JSON.stringify(pkgJson, null, 2),
+      },
+      authorization: token,
+    })
+    registry.publish(pkg, { noPut: true })
+    await npm.exec('publish', [])
+    t.equal(joinedOutput(), `+ ${pkg}@1.0.0`)
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { outputs, npm, logs, registry } = await loadNpmWithRegistry(t, {
     config: {

From 26bd28cbdb1c020445d94c82e5136b98ada9eefc Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sun, 16 Aug 2026 20:45:18 +0000
Subject: [PATCH 014/202] src: let embedders supply a builtin code cache
 without a snapshot

Environments created from the built-in snapshot get the builtins' code
cache from that snapshot. An embedder that bootstraps an Environment
from scratch (its own isolate and context, no EmbedderSnapshotData) has
no way to provide one: every builtin the bootstrap touches is compiled
from source in every such process, and each of them then serializes a
fresh cache (SaveCodeCache) that only a later worker thread would ever
consume.

Add node::EmbedderBuiltinCodeCache for that case. Its entries pair a
builtin id with a v8::ScriptCompiler::CachedData; Generate(context)
compiles every builtin in a context of the right kind of isolate and
returns them for a build step to embed, and
SetBuiltinCodeCache(isolate_data, cache) attaches them to an
IsolateData, next to where a snapshot's code cache lives, so that every
Environment created from it afterwards starts with them. The setter
runs CachedData::CompatibilityCheck() against the isolate first and
returns the result, leaving the IsolateData untouched for a cache made
with another V8 version, flag set or read-only snapshot. Entries from a
snapshot still merge with it (RefreshCodeCache() now merges instead of
assuming a single call). CreateEnvironment() plus LoadEnvironment() of
an empty script goes from about 38 ms to 13 ms with a cache attached.

ProcessInitializationFlags::kNoHarvestBuiltinCodeCache stops
serializing caches for builtins compiled without one, for embedders
that supply their own or never create workers. The default is
unchanged because worker threads copy the harvested cache.

A cctest generates a cache, attaches it, checks that a new
Environment's bootstrap compiles from it and that a corrupted cache is
refused; embedtest gains --no-harvest-builtin-code-cache for a test
that a worker does or does not find a harvested cache depending on the
flag.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65352
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 src/env.cc                                    |  3 +
 src/env.h                                     |  8 ++
 src/node.cc                                   |  4 +
 src/node.h                                    | 42 ++++++++
 src/node_builtins.cc                          | 95 +++++++++++++++++--
 src/node_builtins.h                           |  8 ++
 test/cctest/test_environment.cc               | 36 +++++++
 test/cctest/test_per_process.cc               | 45 +++++++++
 test/embedding/embedtest.cc                   | 27 +++---
 ...st-embedding-builtin-code-cache-harvest.js | 25 +++++
 10 files changed, 276 insertions(+), 17 deletions(-)
 create mode 100644 test/embedding/test-embedding-builtin-code-cache-harvest.js

diff --git a/src/env.cc b/src/env.cc
index 57e2849b25aa..842ffebf2b2c 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -909,6 +909,9 @@ Environment::Environment(IsolateData* isolate_data,
           isolate_data->snapshot_data()->code_cache);
     }
   }
+  if (is_main_thread() && !isolate_data->builtin_code_cache().empty()) {
+    builtin_loader()->RefreshCodeCache(isolate_data->builtin_code_cache());
+  }
 
   // Compile builtins eagerly when building the snapshot so that inner functions
   // of essential builtins that are loaded in the snapshot can have faster first
diff --git a/src/env.h b/src/env.h
index a866604cdda8..4410ccb3e101 100644
--- a/src/env.h
+++ b/src/env.h
@@ -168,6 +168,13 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   inline uv_loop_t* event_loop() const;
   inline MultiIsolatePlatform* platform() const;
   inline const SnapshotData* snapshot_data() const;
+  // See node::SetBuiltinCodeCache().
+  const std::vector<builtins::CodeCacheInfo>& builtin_code_cache() const {
+    return builtin_code_cache_;
+  }
+  void set_builtin_code_cache(std::vector<builtins::CodeCacheInfo> entries) {
+    builtin_code_cache_ = std::move(entries);
+  }
   inline std::shared_ptr<PerIsolateOptions> options();
 
   inline NodeArrayBufferAllocator* node_allocator() const;
@@ -257,6 +264,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   MultiIsolatePlatform* platform_;
 
   const SnapshotData* snapshot_data_;
+  std::vector<builtins::CodeCacheInfo> builtin_code_cache_;
   std::optional<SnapshotConfig> snapshot_config_;
 
   std::shared_ptr<PerIsolateOptions> options_;
diff --git a/src/node.cc b/src/node.cc
index e1a8ed517c05..5a926fa775a3 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1290,6 +1290,10 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     cppgc::InitializeProcess(allocator);
   }
 
+  if (flags & ProcessInitializationFlags::kNoHarvestBuiltinCodeCache) {
+    builtins::BuiltinLoader::SetHarvestCodeCache(false);
+  }
+
   if (!(flags & ProcessInitializationFlags::kNoInitializeV8)) {
     V8::Initialize();
 
diff --git a/src/node.h b/src/node.h
index e827a46e14dd..8e7d1e6a2516 100644
--- a/src/node.h
+++ b/src/node.h
@@ -234,6 +234,11 @@ enum Flags : uint32_t {
   kNoInitializeCppgc = 1 << 13,
   // Initialize the process for predictable snapshot generation.
   kGeneratePredictableSnapshot = 1 << 14,
+  // Do not serialize a code cache for builtins that had to be compiled without
+  // one. By default such caches are kept so that worker threads created later
+  // start faster; an embedder that supplies an EmbedderBuiltinCodeCache or
+  // never creates workers only pays for the serialization.
+  kNoHarvestBuiltinCodeCache = 1 << 15,
 
   // Emulate the behavior of InitializeNodeWithArgs() when passing
   // a flags argument to the InitializeOncePerProcess() replacement
@@ -686,6 +691,43 @@ struct InspectorParentHandle {
   virtual ~InspectorParentHandle() = default;
 };
 
+// Code cache for the built-in JavaScript of Environments that are bootstrapped
+// rather than deserialized from a snapshot; see SetBuiltinCodeCache().
+class NODE_EXTERN EmbedderBuiltinCodeCache {
+ public:
+  struct Entry {
+    std::string id;  // e.g. "internal/bootstrap/node"
+    std::unique_ptr<v8::ScriptCompiler::CachedData> data;
+  };
+  explicit EmbedderBuiltinCodeCache(std::vector<Entry> entries);
+  ~EmbedderBuiltinCodeCache();
+
+  // Compiles every built-in module in `context`, which must come from
+  // NewContext(), and returns their code caches; empty on failure.
+  static std::vector<Entry> Generate(v8::Local<v8::Context> context);
+
+  v8::ScriptCompiler::CachedData::CompatibilityCheckResult CompatibilityCheck(
+      v8::Isolate* isolate) const;
+
+  EmbedderBuiltinCodeCache(const EmbedderBuiltinCodeCache&) = delete;
+  EmbedderBuiltinCodeCache& operator=(const EmbedderBuiltinCodeCache&) = delete;
+
+  struct Impl;
+
+ private:
+  std::unique_ptr<Impl> impl_;
+  friend NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+  SetBuiltinCodeCache(IsolateData*, const EmbedderBuiltinCodeCache*);
+};
+
+// Environments created from `isolate_data` afterwards start with `cache`'s
+// entries (they share its buffers; `cache` itself may be freed after the call);
+// nullptr clears it. Returns the result of `cache->CompatibilityCheck()` and
+// leaves `isolate_data` unchanged unless that is kSuccess.
+NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+SetBuiltinCodeCache(IsolateData* isolate_data,
+                    const EmbedderBuiltinCodeCache* cache);
+
 // TODO(addaleax): Maybe move per-Environment options parsing here.
 // Returns nullptr when the Environment cannot be created e.g. there are
 // pending JavaScript exceptions.
diff --git a/src/node_builtins.cc b/src/node_builtins.cc
index 43a9a388c2ba..2cefc8d74e1a 100644
--- a/src/node_builtins.cc
+++ b/src/node_builtins.cc
@@ -1,4 +1,6 @@
 #include "node_builtins.h"
+#include <atomic>
+#include <cstring>
 #include "debug_utils-inl.h"
 #include "env-inl.h"
 #include "module_wrap.h"
@@ -12,7 +14,6 @@
 #include "v8-value.h"
 
 namespace node {
-namespace builtins {
 
 using loader::HostDefinedOptions;
 using v8::Boolean;
@@ -44,6 +45,16 @@ using v8::TryCatch;
 using v8::Undefined;
 using v8::Value;
 
+namespace builtins {
+
+namespace {
+std::atomic<bool> harvest_code_cache{true};
+}  // namespace
+
+void BuiltinLoader::SetHarvestCodeCache(bool on) {
+  harvest_code_cache = on;
+}
+
 BuiltinLoader::BuiltinLoader()
     : config_(GetConfig()), code_cache_(std::make_shared<BuiltinCodeCache>()) {
   LoadJavaScriptSource();
@@ -422,6 +433,7 @@ MaybeLocal<Data> BuiltinLoader::LookupAndCompile(
   }
 
   if (result == Result::kWithoutCache && optional_realm != nullptr &&
+      harvest_code_cache &&
       !optional_realm->env()->isolate_data()->is_building_snapshot()) {
     // We failed to accept this cache, maybe because it was rejected, maybe
     // because it wasn't present. Either way, we'll attempt to replace this
@@ -593,12 +605,13 @@ bool BuiltinLoader::CompileAllBuiltinsAndCopyCodeCache(
 
 void BuiltinLoader::RefreshCodeCache(const std::vector<CodeCacheInfo>& in) {
   RwLock::ScopedLock lock(code_cache_->mutex);
-  code_cache_->map.reserve(in.size());
-  DCHECK(code_cache_->map.empty());
+  // May be called more than once, e.g. first with the code cache carried by
+  // the snapshot and then by an embedder with caches it built for additional
+  // (or the same) builtin ids against this isolate: merge, and let the entry
+  // supplied last win for an id present in both.
+  code_cache_->map.reserve(code_cache_->map.size() + in.size());
   for (auto const& [id, data] : in) {
-    auto result = code_cache_->map.emplace(id, data);
-    USE(result.second);
-    DCHECK(result.second);
+    code_cache_->map.insert_or_assign(id, data);
   }
   code_cache_->has_code_cache = true;
 }
@@ -918,6 +931,76 @@ void BuiltinLoader::RegisterExternalReferences(
 }
 
 }  // namespace builtins
+
+struct EmbedderBuiltinCodeCache::Impl {
+  std::vector<builtins::CodeCacheInfo> entries;
+};
+
+EmbedderBuiltinCodeCache::EmbedderBuiltinCodeCache(std::vector<Entry> entries)
+    : impl_(std::make_unique<Impl>()) {
+  impl_->entries.reserve(entries.size());
+  for (Entry& e : entries) {
+    impl_->entries.push_back(
+        {std::move(e.id),
+         builtins::BuiltinCodeCacheData(
+             std::shared_ptr<ScriptCompiler::CachedData>(std::move(e.data)))});
+  }
+}
+
+EmbedderBuiltinCodeCache::~EmbedderBuiltinCodeCache() = default;
+
+ScriptCompiler::CachedData::CompatibilityCheckResult
+EmbedderBuiltinCodeCache::CompatibilityCheck(Isolate* isolate) const {
+  for (const builtins::CodeCacheInfo& info : impl_->entries) {
+    ScriptCompiler::CachedData probe(
+        info.data.data,
+        static_cast<int>(info.data.length),
+        ScriptCompiler::CachedData::BufferNotOwned);
+    auto result = probe.CompatibilityCheck(isolate);
+    if (result != ScriptCompiler::CachedData::kSuccess) return result;
+  }
+  return ScriptCompiler::CachedData::kSuccess;
+}
+
+std::vector<EmbedderBuiltinCodeCache::Entry> EmbedderBuiltinCodeCache::Generate(
+    Local<Context> context) {
+  std::vector<Entry> out;
+  builtins::BuiltinLoader loader;
+  loader.SetEagerCompile();
+  std::vector<builtins::CodeCacheInfo> infos;
+  if (!loader.CompileAllBuiltinsAndCopyCodeCache(context, {}, &infos)) {
+    return out;
+  }
+  out.reserve(infos.size());
+  for (const builtins::CodeCacheInfo& info : infos) {
+    uint8_t* copy = new uint8_t[info.data.length];
+    memcpy(copy, info.data.data, info.data.length);
+    out.push_back({info.id,
+                   std::make_unique<ScriptCompiler::CachedData>(
+                       copy,
+                       static_cast<int>(info.data.length),
+                       ScriptCompiler::CachedData::BufferOwned)});
+  }
+  return out;
+}
+
+ScriptCompiler::CachedData::CompatibilityCheckResult SetBuiltinCodeCache(
+    IsolateData* isolate_data, const EmbedderBuiltinCodeCache* cache) {
+  if (cache == nullptr) {
+    isolate_data->set_builtin_code_cache({});
+    return ScriptCompiler::CachedData::kSuccess;
+  }
+  auto check = cache->CompatibilityCheck(isolate_data->isolate());
+  if (check == ScriptCompiler::CachedData::kSuccess) {
+    isolate_data->set_builtin_code_cache(cache->impl_->entries);
+  } else {
+    per_process::Debug(DebugCategory::CODE_CACHE,
+                       "EmbedderBuiltinCodeCache rejected: %d\n",
+                       static_cast<int>(check));
+  }
+  return check;
+}
+
 }  // namespace node
 
 NODE_BINDING_PER_ISOLATE_INIT(
diff --git a/src/node_builtins.h b/src/node_builtins.h
index b51b85ff6f23..89fe7f5c1aa7 100644
--- a/src/node_builtins.h
+++ b/src/node_builtins.h
@@ -125,8 +125,16 @@ class NODE_EXTERN_PRIVATE BuiltinLoader {
       v8::Local<v8::Context> context,
       const std::vector<std::string>& lazy_builtins,
       std::vector<CodeCacheInfo>* out);
+  // Adds the given code cache entries, replacing existing entries with the
+  // same id. Can be called more than once (e.g. with the snapshot's code cache
+  // and then with caches an embedder built for further builtin ids).
   void RefreshCodeCache(const std::vector<CodeCacheInfo>& in);
 
+  // Whether builtins compiled without a cache serialize one for later
+  // consumers (worker threads copy it). See
+  // ProcessInitializationFlags::kNoHarvestBuiltinCodeCache.
+  static void SetHarvestCodeCache(bool on);
+
   void CopySourceAndCodeCacheReferenceFrom(const BuiltinLoader* other);
 
   [[nodiscard]] std::ranges::keys_view<
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 109e224f788d..36fbc0e79d46 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -1,6 +1,7 @@
 #include "libplatform/libplatform.h"
 #include "node_buffer.h"
 #include "node_internals.h"
+#include "node_realm-inl.h"
 #include "node_url.h"
 #include "util.h"
 
@@ -869,6 +870,41 @@ TEST_F(EnvironmentTest, RequestInterruptAtExit) {
   context->Exit();
 }
 
+TEST_F(EnvironmentTest, EmbedderBuiltinCodeCache) {
+  v8::HandleScope handle_scope(isolate_);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> entries =
+      node::EmbedderBuiltinCodeCache::Generate(context);
+  ASSERT_GT(entries.size(), 100u);
+  {
+    node::EmbedderBuiltinCodeCache cache(std::move(entries));
+    EXPECT_EQ(node::SetBuiltinCodeCache(isolate_data_, &cache),
+              v8::ScriptCompiler::CachedData::kSuccess);
+  }
+  std::unique_ptr<node::Environment, decltype(&node::FreeEnvironment)> env(
+      node::CreateEnvironment(isolate_data_, context, {}, {}),
+      node::FreeEnvironment);
+  node::Realm* realm = env->principal_realm();
+  EXPECT_EQ(realm->builtins_with_cache.count("internal/bootstrap/node"), 1u);
+  for (const std::string& id : realm->builtins_without_cache) {
+    EXPECT_EQ(id.rfind("internal/per_context/", 0), 0u) << id;
+  }
+
+  uint8_t* bytes = new uint8_t[64]();
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> bad;
+  bad.push_back({"internal/bootstrap/node",
+                 std::make_unique<v8::ScriptCompiler::CachedData>(
+                     bytes, 64, v8::ScriptCompiler::CachedData::BufferOwned)});
+  node::EmbedderBuiltinCodeCache bad_cache(std::move(bad));
+  EXPECT_NE(node::SetBuiltinCodeCache(isolate_data_, &bad_cache),
+            v8::ScriptCompiler::CachedData::kSuccess);
+  EXPECT_FALSE(isolate_data_->builtin_code_cache().empty());
+  node::SetBuiltinCodeCache(isolate_data_, nullptr);
+  EXPECT_TRUE(isolate_data_->builtin_code_cache().empty());
+}
+
 TEST_F(EnvironmentTest, EmbedderPreload) {
   v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = node::NewContext(isolate_);
diff --git a/test/cctest/test_per_process.cc b/test/cctest/test_per_process.cc
index 7a6f53d56222..937e9cab54dd 100644
--- a/test/cctest/test_per_process.cc
+++ b/test/cctest/test_per_process.cc
@@ -4,18 +4,45 @@
 #include "gtest/gtest.h"
 #include "node_test_fixture.h"
 
+#include <algorithm>
+#include <memory>
 #include <string>
+#include <vector>
 
+using node::builtins::BuiltinCodeCacheData;
 using node::builtins::BuiltinLoader;
 using node::builtins::BuiltinSourceMap;
+using node::builtins::CodeCacheInfo;
 
 class PerProcessTest : public ::testing::Test {
  protected:
   static const BuiltinSourceMap get_sources_for_test() {
     return *BuiltinLoader().source_.read();
   }
+
+  // id -> first byte of the cached data, after feeding `batches` in order.
+  static std::vector<std::pair<std::string, uint8_t>> RefreshCodeCacheWith(
+      const std::vector<std::vector<CodeCacheInfo>>& batches) {
+    BuiltinLoader loader;
+    for (const auto& batch : batches) loader.RefreshCodeCache(batch);
+    std::vector<std::pair<std::string, uint8_t>> out;
+    node::RwLock::ScopedReadLock lock(loader.code_cache_->mutex);
+    EXPECT_TRUE(loader.code_cache_->has_code_cache);
+    for (const auto& [id, data] : loader.code_cache_->map) {
+      out.emplace_back(id, data.data[0]);
+    }
+    std::sort(out.begin(), out.end());
+    return out;
+  }
 };
 
+CodeCacheInfo MakeCodeCacheInfo(const std::string& id, uint8_t marker) {
+  auto* bytes = new uint8_t[4]{marker, marker, marker, marker};
+  auto cached_data = std::make_shared<v8::ScriptCompiler::CachedData>(
+      bytes, 4, v8::ScriptCompiler::CachedData::BufferOwned);
+  return CodeCacheInfo{id, BuiltinCodeCacheData(std::move(cached_data))};
+}
+
 namespace {
 
 TEST_F(PerProcessTest, EmbeddedSources) {
@@ -29,4 +56,22 @@ TEST_F(PerProcessTest, EmbeddedSources) {
   })) << "BuiltinLoader::source_ should have some 16bit items";
 }
 
+// RefreshCodeCache() merges: it can be fed the snapshot's code cache and then
+// an embedder's, and the entry supplied last wins for a shared id.
+TEST_F(PerProcessTest, RefreshCodeCacheMerges) {
+  const auto merged = PerProcessTest::RefreshCodeCacheWith({
+      {MakeCodeCacheInfo("internal/a", 1), MakeCodeCacheInfo("internal/b", 1)},
+      {MakeCodeCacheInfo("internal/b", 2), MakeCodeCacheInfo("embedder/c", 2)},
+  });
+  const std::vector<std::pair<std::string, uint8_t>> expected = {
+      {"embedder/c", 2}, {"internal/a", 1}, {"internal/b", 2}};
+  EXPECT_EQ(merged, expected);
+
+  // A single call still behaves as before.
+  const auto single = PerProcessTest::RefreshCodeCacheWith(
+      {{MakeCodeCacheInfo("internal/a", 7)}});
+  ASSERT_EQ(single.size(), 1u);
+  EXPECT_EQ(single[0].second, 7);
+}
+
 }  // end namespace
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index b3225e5d3ae4..007781754ab9 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -85,19 +85,24 @@ NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   node::FixupMain(argc, raw_argv, &argv);
 
   std::vector<std::string> args(argv, argv + argc);
+  uint32_t flags =
+      node::ProcessInitializationFlags::kNoInitializeV8 |
+      node::ProcessInitializationFlags::kNoInitializeNodeV8Platform |
+      // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
+      // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
+      // support in the future, split this configuration out as a
+      // command line option.
+      node::ProcessInitializationFlags::kDisableNodeOptionsEnv |
+      node::ProcessInitializationFlags::kNoInitializeCppgc;
+  auto it =
+      std::find(args.begin(), args.end(), "--no-harvest-builtin-code-cache");
+  if (it != args.end()) {
+    args.erase(it);
+    flags |= node::ProcessInitializationFlags::kNoHarvestBuiltinCodeCache;
+  }
   std::shared_ptr<node::InitializationResult> result =
       node::InitializeOncePerProcess(
-          args,
-          {
-              node::ProcessInitializationFlags::kNoInitializeV8,
-              node::ProcessInitializationFlags::kNoInitializeNodeV8Platform,
-              // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
-              // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
-              // support in the future, split this configuration out as a
-              // command line option.
-              node::ProcessInitializationFlags::kDisableNodeOptionsEnv,
-              node::ProcessInitializationFlags::kNoInitializeCppgc,
-          });
+          args, static_cast<node::ProcessInitializationFlags::Flags>(flags));
 
   for (const std::string& error : result->errors())
     fprintf(stderr, "%s: %s\n", args[0].c_str(), error.c_str());
diff --git a/test/embedding/test-embedding-builtin-code-cache-harvest.js b/test/embedding/test-embedding-builtin-code-cache-harvest.js
new file mode 100644
index 000000000000..19cdd499c6ea
--- /dev/null
+++ b/test/embedding/test-embedding-builtin-code-cache-harvest.js
@@ -0,0 +1,25 @@
+'use strict';
+// By default a builtin compiled without a code cache serializes one that worker
+// threads then start from; with kNoHarvestBuiltinCodeCache it does not.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+tmpdir.refresh();
+const embedtest = common.resolveBuiltBinary('embedtest');
+const workerScript = 'new (require("worker_threads").Worker)("", { eval: true })';
+
+function workerCompileLog(args) {
+  let log;
+  spawnSyncAndAssert(
+    embedtest, ['--', ...args, workerScript],
+    { cwd: tmpdir.path, env: { ...process.env, NODE_DEBUG_NATIVE: 'CODE_CACHE' } },
+    { stderr(output) { log = output; return true; } });
+  const worker = log.slice(log.lastIndexOf('Compiling internal/bootstrap/realm'));
+  assert.notStrictEqual(worker, log);
+  return worker;
+}
+assert.match(workerCompileLog([]), /Code cache of internal\/bootstrap\/node \(\w+\) is accepted/);
+assert.match(workerCompileLog(['--no-harvest-builtin-code-cache']),
+             /Compiling internal\/bootstrap\/node without code cache/);

From b0afbf5f0beacea2522fb3405da7331efd698e71 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 2 Sep 2026 16:25:07 +0200
Subject: [PATCH 015/202] tools: do not hardcode path to Ruff

Allows user to get Ruff from other source than Pip (e.g. Nix).

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65681
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 Makefile               | 9 +++++----
 shell.nix              | 8 ++++++++
 tools/nix/devTools.nix | 1 +
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index ed049893a243..df31980e4fc6 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,7 @@
 
 BUILDTYPE ?= Release
 PYTHON ?= python3
+RUFF ?= tools/pip/site-packages/bin/ruff
 DESTDIR ?=
 SIGN ?=
 PREFIX ?= /usr/local
@@ -1694,15 +1695,15 @@ lint-py-build: ## Build resources needed to lint python files.
 		$(PYTHON) -m pip install --upgrade --system --target tools/pip/site-packages ruff==0.13.1
 
 .PHONY: lint-py lint-py-fix lint-py-fix-unsafe
-ifneq ("","$(wildcard tools/pip/site-packages/ruff)")
+ifneq ("","$(wildcard $(RUFF))")
 # Lint the Python code with ruff.
 lint-py:
 	$(info Running Python linter...)
-	tools/pip/site-packages/bin/ruff check .
+	$(RUFF) check .
 lint-py-fix:
-	tools/pip/site-packages/bin/ruff check . --fix
+	$(RUFF) check . --fix
 lint-py-fix-unsafe:
-	tools/pip/site-packages/bin/ruff check . --fix --unsafe-fixes
+	$(RUFF) check . --fix --unsafe-fixes
 else
 lint-py lint-py-fix lint-py-fix-unsafe:
 	$(warning Python linting with ruff is not available)
diff --git a/shell.nix b/shell.nix
index 96fcccbc1914..9b4d9da55855 100644
--- a/shell.nix
+++ b/shell.nix
@@ -141,6 +141,14 @@ pkgs.mkShell {
           )
     );
   }
+  // (
+    let
+      ruff = pkgs.lib.lists.findFirst (p: p.meta.mainProgram == "ruff") null devTools;
+    in
+    pkgs.lib.optionalAttrs (ruff != null) {
+      RUFF = pkgs.lib.getExe ruff;
+    }
+  )
   // pkgs.lib.optionalAttrs (!withSQLite) {
     NOSQLITE = "1";
   }
diff --git a/tools/nix/devTools.nix b/tools/nix/devTools.nix
index 474e365ceb4e..0ead37da9108 100644
--- a/tools/nix/devTools.nix
+++ b/tools/nix/devTools.nix
@@ -7,6 +7,7 @@
   pkgs.gh
   pkgs.git
   pkgs.jq
+  pkgs.ruff
   pkgs.shellcheck
 ]
 ++ (

From 5b912ed6bd5412877f6970349a328b21302735a0 Mon Sep 17 00:00:00 2001
From: greenhead <greenheadhq@gmail.com>
Date: Wed, 2 Sep 2026 23:59:15 +0900
Subject: [PATCH 016/202] perf_hooks: add missing resource timing attributes

Add the finalResponseHeadersStart, firstInterimResponseStart,
renderBlockingStatus, contentType and contentEncoding getters to
PerformanceResourceTiming and update the WPT status accordingly.

Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65017
Refs: https://github.com/nodejs/node/pull/51589
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 doc/api/perf_hooks.md                         |  79 ++++++++++++
 lib/internal/perf/resource_timing.js          |  41 ++++++-
 ...st-perf-hooks-resourcetiming-attributes.js | 116 ++++++++++++++++++
 .../test-perf-hooks-resourcetiming-fetch.mjs  |  67 ++++++++++
 .../test-perf-hooks-resourcetiming.js         |  19 ++-
 test/wpt/status/resource-timing.json          |  12 +-
 6 files changed, 320 insertions(+), 14 deletions(-)
 create mode 100644 test/parallel/test-perf-hooks-resourcetiming-attributes.js
 create mode 100644 test/parallel/test-perf-hooks-resourcetiming-fetch.mjs

diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index b9e00c63d2aa..34504245421b 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1091,6 +1091,54 @@ changes:
 The high resolution millisecond timestamp representing the time immediately
 before Node.js receives the first byte of the response from the server.
 
+### `performanceResourceTiming.finalResponseHeadersStart`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the final response,
+as opposed to an interim response.
+
+### `performanceResourceTiming.firstInterimResponseStart`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the first interim response, such as
+a `103 Early Hints` response.
+
+### `performanceResourceTiming.responseStart`
+
+<!-- YAML
+added:
+  - v18.2.0
+  - v16.17.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65017
+    description: This property now returns `firstInterimResponseStart`
+                 when it is non-zero.
+  - version: v19.0.0
+    pr-url: https://github.com/nodejs/node/pull/44483
+    description: This property getter must be called with the
+                 `PerformanceResourceTiming` object as the receiver.
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the response from the server. This
+is `firstInterimResponseStart` when it is non-zero, and
+`finalResponseHeadersStart` otherwise.
+
 ### `performanceResourceTiming.responseEnd`
 
 <!-- YAML
@@ -1166,6 +1214,37 @@ A number representing the size (in octets) received from the fetch
 (HTTP or cache), of the message body, after removing any applied
 content-codings.
 
+### `performanceResourceTiming.renderBlockingStatus`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The render blocking status of the resource. It is either `'blocking'` or `'non-blocking'`.
+
+### `performanceResourceTiming.contentType`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The minimized MIME type of the content of the fetched resource, or an empty
+string if it cannot be determined.
+
+### `performanceResourceTiming.contentEncoding`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The content encoding of the fetched resource, such as `'gzip'` or `'br'`.
+
 ### `performanceResourceTiming.toJSON()`
 
 <!-- YAML
diff --git a/lib/internal/perf/resource_timing.js b/lib/internal/perf/resource_timing.js
index f8459efa48e3..6b8f0d2aa524 100644
--- a/lib/internal/perf/resource_timing.js
+++ b/lib/internal/perf/resource_timing.js
@@ -17,6 +17,7 @@ const { enqueue, bufferResourceTiming } = require('internal/perf/observe');
 const { validateThisInternalField } = require('internal/validators');
 const { kEnumerableProperty } = require('internal/util');
 
+const kBodyInfo = Symbol('kBodyInfo');
 const kCacheMode = Symbol('kCacheMode');
 const kRequestedUrl = Symbol('kRequestedUrl');
 const kTimingInfo = Symbol('kTimingInfo');
@@ -110,11 +111,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kTimingInfo].finalNetworkRequestStartTime;
   }
 
-  get responseStart() {
+  get finalResponseHeadersStart() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].finalNetworkResponseStartTime;
   }
 
+  get firstInterimResponseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ?? 0;
+  }
+
+  get responseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ||
+      this[kTimingInfo].finalNetworkResponseStartTime;
+  }
+
   get responseEnd() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].endTime;
@@ -148,6 +160,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kResponseStatus];
   }
 
+  get renderBlockingStatus() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].renderBlocking === true ?
+      'blocking' : 'non-blocking';
+  }
+
+  get contentType() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentType ?? '';
+  }
+
+  get contentEncoding() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentEncoding ?? '';
+  }
+
   toJSON() {
     validateThisInternalField(this, kInitiatorType, 'PerformanceResourceTiming');
     return {
@@ -167,6 +195,8 @@ class PerformanceResourceTiming extends PerformanceEntry {
       connectEnd: this.connectEnd,
       secureConnectionStart: this.secureConnectionStart,
       requestStart: this.requestStart,
+      finalResponseHeadersStart: this.finalResponseHeadersStart,
+      firstInterimResponseStart: this.firstInterimResponseStart,
       responseStart: this.responseStart,
       responseEnd: this.responseEnd,
       transferSize: this.transferSize,
@@ -174,6 +204,9 @@ class PerformanceResourceTiming extends PerformanceEntry {
       decodedBodySize: this.decodedBodySize,
       deliveryType: this.deliveryType,
       responseStatus: this.responseStatus,
+      renderBlockingStatus: this.renderBlockingStatus,
+      contentType: this.contentType,
+      contentEncoding: this.contentEncoding,
     };
   }
 }
@@ -191,6 +224,8 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   connectEnd: kEnumerableProperty,
   secureConnectionStart: kEnumerableProperty,
   requestStart: kEnumerableProperty,
+  finalResponseHeadersStart: kEnumerableProperty,
+  firstInterimResponseStart: kEnumerableProperty,
   responseStart: kEnumerableProperty,
   responseEnd: kEnumerableProperty,
   transferSize: kEnumerableProperty,
@@ -198,6 +233,9 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   decodedBodySize: kEnumerableProperty,
   deliveryType: kEnumerableProperty,
   responseStatus: kEnumerableProperty,
+  renderBlockingStatus: kEnumerableProperty,
+  contentType: kEnumerableProperty,
+  contentEncoding: kEnumerableProperty,
   toJSON: kEnumerableProperty,
   [SymbolToStringTag]: {
     __proto__: null,
@@ -224,6 +262,7 @@ function createPerformanceResourceTiming(
   // The spec doesn't say to validate it in the class construction.
   resourceTiming[kTimingInfo] = timingInfo;
   resourceTiming[kCacheMode] = cacheMode;
+  resourceTiming[kBodyInfo] = bodyInfo;
   resourceTiming[kDeliveryType] = deliveryType;
   resourceTiming[kResponseStatus] = responseStatus;
 
diff --git a/test/parallel/test-perf-hooks-resourcetiming-attributes.js b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
new file mode 100644
index 000000000000..66fee5265cd4
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
@@ -0,0 +1,116 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const {
+  PerformanceResourceTiming,
+  performance,
+} = require('perf_hooks');
+
+// Covers the IDL attributes finalResponseHeadersStart,
+// firstInterimResponseStart, renderBlockingStatus, contentType and contentEncoding,
+// and the spec requirement that responseStart prefers a non-zero
+// firstInterimResponseStart over finalResponseHeadersStart.
+
+function createTimingInfo(overrides = {}) {
+  return {
+    startTime: 0,
+    redirectStartTime: 0,
+    redirectEndTime: 0,
+    postRedirectStartTime: 0,
+    finalServiceWorkerStartTime: 0,
+    finalNetworkRequestStartTime: 0,
+    finalNetworkResponseStartTime: 0,
+    endTime: 0,
+    encodedBodySize: 0,
+    decodedBodySize: 0,
+    finalConnectionTimingInfo: null,
+    ...overrides,
+  };
+}
+
+function markResourceTiming(timingInfo, bodyInfo) {
+  return performance.markResourceTiming(
+    timingInfo,
+    'http://localhost:8080',
+    'fetch',
+    {},
+    '',
+    bodyInfo,
+    200,
+    '',
+  );
+}
+
+// Default values when no optional timing or body metadata is present.
+{
+  const resource = markResourceTiming(createTimingInfo(), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 0);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 0);
+  assert.strictEqual(resource.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(resource.contentType, '');
+  assert.strictEqual(resource.contentEncoding, '');
+}
+
+// responseStart falls back to the final response when no interim response timing was recorded.
+{
+  const resource = markResourceTiming(createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 0,
+  }), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 123);
+}
+
+// Values reflected from timing info and body info.
+{
+  const timingInfo = createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 45,
+    renderBlocking: true,
+  });
+  const bodyInfo = {
+    contentType: 'text/html',
+    contentEncoding: 'gzip',
+  };
+  const resource = markResourceTiming(timingInfo, bodyInfo);
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 45);
+  assert.strictEqual(resource.responseStart, 45);
+  assert.strictEqual(resource.renderBlockingStatus, 'blocking');
+  assert.strictEqual(resource.contentType, 'text/html');
+  assert.strictEqual(resource.contentEncoding, 'gzip');
+
+  const json = resource.toJSON();
+  assert.strictEqual(json.finalResponseHeadersStart, 123);
+  assert.strictEqual(json.firstInterimResponseStart, 45);
+  assert.strictEqual(json.responseStart, 45);
+  assert.strictEqual(json.renderBlockingStatus, 'blocking');
+  assert.strictEqual(json.contentType, 'text/html');
+  assert.strictEqual(json.contentEncoding, 'gzip');
+}
+
+// The attributes are enumerable getters on the prototype and perform a
+// brand check like the other PerformanceResourceTiming attributes.
+for (const name of [
+  'finalResponseHeadersStart',
+  'firstInterimResponseStart',
+  'renderBlockingStatus',
+  'contentType',
+  'contentEncoding',
+]) {
+  const desc = Object.getOwnPropertyDescriptor(
+    PerformanceResourceTiming.prototype, name);
+  assert.strictEqual(desc.enumerable, true, name);
+  assert.strictEqual(typeof desc.get, 'function', name);
+  assert.throws(() => desc.get.call({}), {
+    code: 'ERR_INVALID_THIS',
+  }, name);
+}
+
+performance.clearResourceTimings();
diff --git a/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
new file mode 100644
index 000000000000..40bcd1184a7d
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
@@ -0,0 +1,67 @@
+// The ESM common wrapper does not export localhostIPv4.
+// eslint-disable-next-line node-core/require-common-first
+import common from '../common/index.js';
+
+import assert from 'node:assert';
+import { once } from 'node:events';
+import { createServer } from 'node:http';
+import {
+  PerformanceResourceTiming,
+  performance,
+} from 'node:perf_hooks';
+
+// This test ensures that built-in fetch creates a PerformanceResourceTiming
+// entry with the resource timing attributes exposed by Node.js.
+
+const responseBody = 'Hello world';
+const server = createServer(common.mustCall((req, res) => {
+  res.end(responseBody);
+}));
+
+server.listen(0, common.localhostIPv4);
+await once(server, 'listening');
+
+async function closeServer() {
+  if (server.listening) {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+try {
+  performance.clearResourceTimings();
+
+  const url = `http://${common.localhostIPv4}:${server.address().port}/`;
+  const response = await fetch(url);
+  assert.strictEqual(await response.text(), responseBody);
+  await closeServer();
+
+  const entries = performance.getEntriesByName(url, 'resource');
+  assert.strictEqual(entries.length, 1);
+
+  const [entry] = entries;
+  assert(entry instanceof PerformanceResourceTiming);
+  assert.strictEqual(entry.initiatorType, 'fetch');
+  assert.strictEqual(entry.responseStatus, 200);
+  assert(entry.finalResponseHeadersStart > 0);
+  assert.strictEqual(entry.firstInterimResponseStart, 0);
+  assert.strictEqual(entry.responseStart, entry.finalResponseHeadersStart);
+  assert(entry.responseEnd >= entry.responseStart);
+  assert.strictEqual(entry.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(entry.contentType, '');
+  assert.strictEqual(entry.contentEncoding, '');
+
+  const json = entry.toJSON();
+  for (const name of [
+    'finalResponseHeadersStart',
+    'firstInterimResponseStart',
+    'responseStart',
+    'renderBlockingStatus',
+    'contentType',
+    'contentEncoding',
+  ]) {
+    assert.strictEqual(json[name], entry[name], name);
+  }
+} finally {
+  performance.clearResourceTimings();
+  await closeServer();
+}
diff --git a/test/parallel/test-perf-hooks-resourcetiming.js b/test/parallel/test-perf-hooks-resourcetiming.js
index f76cd669004e..9a94ba795e95 100644
--- a/test/parallel/test-perf-hooks-resourcetiming.js
+++ b/test/parallel/test-perf-hooks-resourcetiming.js
@@ -174,6 +174,8 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
@@ -181,6 +183,9 @@ function createTimingInfo({
     decodedBodySize: 0,
     responseStatus: 200,
     deliveryType: '',
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: '',
   });
   assert.strictEqual(util.inspect(performance.getEntries()), `[
   PerformanceResourceTiming {
@@ -200,13 +205,18 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
     encodedBodySize: 0,
     decodedBodySize: 0,
     deliveryType: '',
-    responseStatus: 200
+    responseStatus: 200,
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: ''
   }
 ]`);
   assert.strictEqual(util.inspect(resource), `PerformanceResourceTiming {
@@ -226,13 +236,18 @@ function createTimingInfo({
   connectEnd: 0,
   secureConnectionStart: 0,
   requestStart: 0,
+  finalResponseHeadersStart: 0,
+  firstInterimResponseStart: 0,
   responseStart: 0,
   responseEnd: 0,
   transferSize: 0,
   encodedBodySize: 0,
   decodedBodySize: 0,
   deliveryType: '',
-  responseStatus: 200
+  responseStatus: 200,
+  renderBlockingStatus: 'non-blocking',
+  contentType: '',
+  contentEncoding: ''
 }`);
 
   assert(resource instanceof PerformanceEntry);
diff --git a/test/wpt/status/resource-timing.json b/test/wpt/status/resource-timing.json
index 74de815387ed..0299d6652047 100644
--- a/test/wpt/status/resource-timing.json
+++ b/test/wpt/status/resource-timing.json
@@ -23,25 +23,15 @@
   "idlharness.any.js": {
     "fail": {
       "expected": [
-        "PerformanceResourceTiming interface: attribute firstInterimResponseStart",
-        "PerformanceResourceTiming interface: attribute finalResponseHeadersStart",
-        "PerformanceResourceTiming interface: resource must inherit property \"finalResponseHeadersStart\" with the proper type",
-        "PerformanceResourceTiming interface: attribute renderBlockingStatus",
-        "PerformanceResourceTiming interface: attribute contentType",
-        "PerformanceResourceTiming interface: resource must inherit property \"firstInterimResponseStart\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"renderBlockingStatus\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentType\" with the proper type",
         "PerformanceResourceTiming interface: default toJSON operation on resource",
         "PerformanceResourceTiming interface: attribute workerRouterEvaluationStart",
         "PerformanceResourceTiming interface: attribute workerCacheLookupStart",
         "PerformanceResourceTiming interface: attribute workerMatchedRouterSource",
         "PerformanceResourceTiming interface: attribute workerFinalRouterSource",
-        "PerformanceResourceTiming interface: attribute contentEncoding",
         "PerformanceResourceTiming interface: resource must inherit property \"workerRouterEvaluationStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerCacheLookupStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerMatchedRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentEncoding\" with the proper type"
+        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type"
       ]
     }
   }

From 8e8ada7f6ba6adb4634435787e83252b7865f791 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 2 Sep 2026 18:26:20 +0200
Subject: [PATCH 017/202] tools: remove nghttp2 pin in `sharedLibDeps.nix`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65687
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 tools/nix/sharedLibDeps.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 788e9efedeb8..14494bbe1648 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -15,6 +15,7 @@
     libuv
     merve
     nbytes
+    nghttp2
     simdjson
     simdutf
     uvwasi
@@ -24,13 +25,6 @@
   cares = pkgs.c-ares;
   hdr-histogram = pkgs.hdrhistogram_c;
   http-parser = pkgs.llhttp;
-  nghttp2 = pkgs.nghttp2.overrideAttrs {
-    version = "1.69.0";
-    src = pkgs.fetchurl {
-      url = "https://github.com/nghttp2/nghttp2/releases/download/v1.69.0/nghttp2-1.69.0.tar.bz2";
-      hash = "sha256-PxhfWxw+d4heuc8/LE2ksan3OiS/WVe4KRg60Tf4Lcg=";
-    };
-  };
 }
 // (pkgs.lib.optionalAttrs withLief {
   inherit (pkgs) lief;

From 2befec51ae74531405257bcd68405427cd6046b1 Mon Sep 17 00:00:00 2001
From: Romain Lanz <2793951+RomainLanz@users.noreply.github.com>
Date: Wed, 2 Sep 2026 18:43:10 +0200
Subject: [PATCH 018/202] diagnostics_channel: lazily create tracing context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Default parameters are evaluated before the function body, so the
tracing context is allocated before the no-subscriber fast path.

Initialize it only for subscribed traces. Preserve method arity with an
undefined default and preserve explicit null behavior.

Add focused regression coverage and reusable TracingChannel benchmarks.

Signed-off-by: Romain Lanz <romain.lanz@pm.me>
PR-URL: https://github.com/nodejs/node/pull/65513
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
---
 .../tracing-channel-promise.js                | 53 ++++++++++++
 .../tracing-channel-sync.js                   | 43 ++++++++++
 lib/diagnostics_channel.js                    | 12 ++-
 ...nostics-channel-tracing-channel-context.js | 85 +++++++++++++++++++
 4 files changed, 191 insertions(+), 2 deletions(-)
 create mode 100644 benchmark/diagnostics_channel/tracing-channel-promise.js
 create mode 100644 benchmark/diagnostics_channel/tracing-channel-sync.js
 create mode 100644 test/parallel/test-diagnostics-channel-tracing-channel-context.js

diff --git a/benchmark/diagnostics_channel/tracing-channel-promise.js b/benchmark/diagnostics_channel/tracing-channel-promise.js
new file mode 100644
index 000000000000..594043d63fe4
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-promise.js
@@ -0,0 +1,53 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+const thenable = {
+  then(onResolve) {
+    onResolve(undefined);
+  },
+};
+
+function returnThenable() {
+  return thenable;
+}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-sync.js b/benchmark/diagnostics_channel/tracing-channel-sync.js
new file mode 100644
index 000000000000..bfd9dd939cc0
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-sync.js
@@ -0,0 +1,43 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 7c1f4fa845ed..54c25839e611 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -522,11 +522,15 @@ class TracingChannel {
     return done;
   }
 
-  traceSync(fn, context = { __proto__: null }, thisArg, ...args) {
+  traceSync(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       return ReflectApply(fn, thisArg, args);
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
 
     // eslint-disable-next-line no-unused-vars
@@ -542,7 +546,7 @@ class TracingChannel {
     }
   }
 
-  tracePromise(fn, context = { __proto__: null }, thisArg, ...args) {
+  tracePromise(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       const result = ReflectApply(fn, thisArg, args);
       if (typeof result?.then !== 'function') {
@@ -551,6 +555,10 @@ class TracingChannel {
       return result;
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
     const continuationWindow = this.#continuationWindow;
 
diff --git a/test/parallel/test-diagnostics-channel-tracing-channel-context.js b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
new file mode 100644
index 000000000000..e0e605854032
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const common = require('../common');
+
+// This test ensures that tracing channels create an independent mutable
+// context for each call while preserving explicitly provided contexts.
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+
+const lengthChannel = dc.tracingChannel('test:length');
+assert.strictEqual(lengthChannel.traceSync.length, 1);
+assert.strictEqual(lengthChannel.tracePromise.length, 1);
+
+function subscribe(channel, contexts, isPromise = false) {
+  let endCalls = 0;
+  let asyncStartCalls = 0;
+  let asyncEndCalls = 0;
+
+  channel.subscribe({
+    start: common.mustCall((context) => {
+      context.invocation = contexts.length;
+      contexts.push(context);
+    }, 4),
+    end: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, endCalls++);
+    }, 4),
+    asyncStart: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncStartCalls++);
+    }, isPromise ? 4 : 0),
+    asyncEnd: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncEndCalls++);
+    }, isPromise ? 4 : 0),
+  });
+}
+
+const syncChannel = dc.tracingChannel('test:sync-context');
+const syncContexts = [];
+subscribe(syncChannel, syncContexts);
+
+const syncProvided = { provided: true };
+assert.strictEqual(syncChannel.traceSync(() => 'omitted'), 'omitted');
+assert.strictEqual(syncChannel.traceSync(() => 'undefined', undefined),
+                   'undefined');
+assert.strictEqual(syncChannel.traceSync(() => 'provided', syncProvided),
+                   'provided');
+
+assert.strictEqual(Object.getPrototypeOf(syncContexts[0]), null);
+assert.strictEqual(Object.getPrototypeOf(syncContexts[1]), null);
+assert.notStrictEqual(syncContexts[0], syncContexts[1]);
+assert.strictEqual(syncContexts[2], syncProvided);
+assert.deepStrictEqual(syncContexts.slice(0, 3).map(({ result }) => result),
+                       ['omitted', 'undefined', 'provided']);
+
+const syncError = new Error('sync');
+assert.throws(() => syncChannel.traceSync(() => {
+  throw syncError;
+}), (error) => error === syncError);
+assert.strictEqual(syncContexts[3].error, syncError);
+
+const promiseChannel = dc.tracingChannel('test:promise-context');
+const promiseContexts = [];
+subscribe(promiseChannel, promiseContexts, true);
+
+const promiseProvided = { provided: true };
+const promiseError = new Error('promise');
+Promise.resolve()
+  .then(() => promiseChannel.tracePromise(() => Promise.resolve('omitted')))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('undefined'), undefined))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('provided'), promiseProvided))
+  .then(() => assert.rejects(
+    promiseChannel.tracePromise(() => Promise.reject(promiseError)),
+    promiseError))
+  .then(common.mustCall(() => {
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[0]), null);
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[1]), null);
+    assert.notStrictEqual(promiseContexts[0], promiseContexts[1]);
+    assert.strictEqual(promiseContexts[2], promiseProvided);
+    assert.deepStrictEqual(
+      promiseContexts.slice(0, 3).map(({ result }) => result),
+      ['omitted', 'undefined', 'provided']);
+    assert.strictEqual(promiseContexts[3].error, promiseError);
+  }));

From 728ae356784429569d36d305012179067ee8503a Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 22 Aug 2026 12:30:29 +0000
Subject: [PATCH 019/202] lib: defer source map payload decoding until first
 use
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With source maps enabled, every module that carries a sourceMappingURL
had its map decoded (or read from disk), JSON-parsed and its sources
resolved to absolute URLs while the module was being loaded, and the
per-line length table used for coverage was built with a per-code-point
loop. None of that is needed unless a stack trace is later mapped.

Keep the URL on the cache entry and resolve the payload on the first
findSourceMap() for that file. Under NODE_V8_COVERAGE the payload is
still resolved at load time, since the cache is serialized during
shutdown. lineLengths() now splits on '\n' with indexOf and only falls
back to the code point walk when the source contains U+2028/U+2029.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65490
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/module/module-require-source-map.js | 77 +++++++++++++++++++
 lib/internal/source_map/source_map_cache.js   | 60 +++++++++++----
 2 files changed, 122 insertions(+), 15 deletions(-)
 create mode 100644 benchmark/module/module-require-source-map.js

diff --git a/benchmark/module/module-require-source-map.js b/benchmark/module/module-require-source-map.js
new file mode 100644
index 000000000000..8353ab39fc82
--- /dev/null
+++ b/benchmark/module/module-require-source-map.js
@@ -0,0 +1,77 @@
+'use strict';
+
+// Loading modules that carry source maps, with source map support enabled.
+// This is the cost paid at startup by applications bundled or transpiled with
+// source maps; the maps are only consulted if a stack trace is generated.
+
+const fs = require('fs');
+const path = require('path');
+const common = require('../common.js');
+const tmpdir = require('../../test/common/tmpdir');
+const benchmarkDirectory = tmpdir.resolve('nodejs-benchmark-module-source-map');
+
+const bench = common.createBenchmark(main, {
+  sourceMap: ['none', 'inline', 'external'],
+  n: [1000],
+}, {
+  setup(configs) {
+    tmpdir.refresh();
+    const maxN = configs.reduce((max, c) => Math.max(max, c.n), 0);
+    createModules(maxN);
+  },
+});
+
+function moduleSource(i) {
+  const methods = [];
+  for (let m = 0; m < 40; m++) {
+    methods.push(`  method${m}(input) { return [].concat(input).map((item) => ({ item, m: ${m}, service: ${i} })); }`);
+  }
+  return `'use strict';
+class Service${i} {
+  constructor(options = {}) { this.options = { retries: 3, ...options }; }
+${methods.join('\n')}
+}
+function helper${i}(list) { return list.filter(Boolean).slice(0, ${i % 7}); }
+module.exports = { Service${i}, helper${i} };
+`;
+}
+
+function sourceMapFor(i, source) {
+  return JSON.stringify({
+    version: 3,
+    file: `${i}.js`,
+    sources: [`../src/${i}.ts`],
+    sourcesContent: [source],
+    names: [],
+    mappings: 'AAAA;' + 'AACA,MAAM;'.repeat(44),
+  });
+}
+
+function createModules(n) {
+  for (const kind of ['none', 'inline', 'external']) {
+    const dir = path.join(benchmarkDirectory, kind);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let i = 0; i < n; i++) {
+      const source = moduleSource(i);
+      let trailer = '';
+      if (kind === 'inline') {
+        const data = Buffer.from(sourceMapFor(i, source)).toString('base64');
+        trailer = `//# sourceMappingURL=data:application/json;base64,${data}\n`;
+      } else if (kind === 'external') {
+        fs.writeFileSync(path.join(dir, `${i}.js.map`), sourceMapFor(i, source));
+        trailer = `//# sourceMappingURL=${i}.js.map\n`;
+      }
+      fs.writeFileSync(path.join(dir, `${i}.js`), source + trailer);
+    }
+  }
+}
+
+function main({ sourceMap, n }) {
+  process.setSourceMapsEnabled(true);
+  const dir = path.join(benchmarkDirectory, sourceMap);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    require(path.join(dir, `${i}.js`));
+  }
+  bench.end(n);
+}
diff --git a/lib/internal/source_map/source_map_cache.js b/lib/internal/source_map/source_map_cache.js
index 95b09090c473..e1fa55c5caba 100644
--- a/lib/internal/source_map/source_map_cache.js
+++ b/lib/internal/source_map/source_map_cache.js
@@ -9,6 +9,7 @@ const {
   RegExpPrototypeSymbolSplit,
   SafeMap,
   StringPrototypeCodePointAt,
+  StringPrototypeIndexOf,
   StringPrototypeSplit,
   StringPrototypeStartsWith,
 } = primordials;
@@ -176,16 +177,14 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   // Normalize the sourceURL to a file URL if it is a path.
   sourceURL = normalizeReferrerURL(sourceURL);
 
-  const data = dataFromUrl(filename, sourceMapURL);
-  // `data` could be null if the source map is invalid.
-  // In this case, create a cache entry with null data with source url for test coverage.
-
+  // The payload is resolved on first use (see sourceMapData()), except under
+  // coverage, where it is serialized at exit when no more JS may run.
   const entry = {
     __proto__: null,
     lineLengths: lineLengths(content),
-    data,
-    // Save the source map url if it is not a data url.
-    sourceMapURL: data ? null : sourceMapURL,
+    data: process.env.NODE_V8_COVERAGE ? dataFromUrl(filename, sourceMapURL) : undefined,
+    filename,
+    sourceMapURL,
     sourceURL,
   };
 
@@ -254,20 +253,36 @@ function dataFromUrl(sourceURL, sourceMappingURL) {
   return sourceMapFromFile(mapURL);
 }
 
+const kUnicodeLineTerminators = /[\u2028\u2029]/;
+
 // Cache the length of each line in the file that a source map was extracted
 // from. This allows translation from byte offset V8 coverage reports,
 // to line/column offset Source Map V3.
 function lineLengths(content) {
+  if (RegExpPrototypeExec(kUnicodeLineTerminators, content) !== null) {
+    return lineLengthsWithUnicodeTerminators(content);
+  }
+  // We purposefully keep \r as part of the line-length calculation, in
+  // cases where there is a \r\n separator, so that this can be taken into
+  // account in coverage calculations.
+  const output = [];
+  let lineStart = 0;
+  let lineEnd;
+  while ((lineEnd = StringPrototypeIndexOf(content, '\n', lineStart)) !== -1) {
+    ArrayPrototypePush(output, lineEnd - lineStart);
+    lineStart = lineEnd + 1;
+  }
+  ArrayPrototypePush(output, content.length - lineStart);
+  return output;
+}
+
+function lineLengthsWithUnicodeTerminators(content) {
   const contentLength = content.length;
   const output = [];
   let lineLength = 0;
   for (let i = 0; i < contentLength; i++, lineLength++) {
     const codePoint = StringPrototypeCodePointAt(content, i);
-
-    // We purposefully keep \r as part of the line-length calculation, in
-    // cases where there is a \r\n separator, so that this can be taken into
-    // account in coverage calculations.
-    // codepoints for \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
+    // \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
     if (codePoint === 10 || codePoint === 0x2028 || codePoint === 0x2029) {
       ArrayPrototypePush(output, lineLength);
       lineLength = -1; // To not count the matched codePoint such as \n character
@@ -351,16 +366,31 @@ function sourceMapCacheToObject() {
 
   const obj = { __proto__: null };
   for (const { 0: k, 1: v } of moduleSourceMapCache) {
+    const data = v.data ?? null;
     obj[k] = {
       __proto__: null,
       lineLengths: v.lineLengths,
-      data: v.data,
-      url: v.sourceMapURL,
+      data,
+      // Save the source map url if it is not a data url.
+      url: data ? null : v.sourceMapURL,
     };
   }
   return obj;
 }
 
+/**
+ * Resolve and parse the payload of a cache entry the first time it is needed;
+ * `null` marks a source map that could not be loaded.
+ * @param {object} entry
+ * @returns {object|null}
+ */
+function sourceMapData(entry) {
+  if (entry.data === undefined) {
+    entry.data = dataFromUrl(entry.filename, entry.sourceMapURL);
+  }
+  return entry.data;
+}
+
 /**
  * Find a source map for a given actual source URL or path.
  *
@@ -390,7 +420,7 @@ function findSourceMap(sourceURL) {
       sourceURL = pathToFileURL(sourceURL).href;
     }
     const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
-    if (entry?.data == null) {
+    if (entry === undefined || sourceMapData(entry) === null) {
       return undefined;
     }
 

From c988b7d3718bc986f15532a23ede862a6bd79dc0 Mon Sep 17 00:00:00 2001
From: Chengzhong Wu <cwu631@bloomberg.net>
Date: Wed, 2 Sep 2026 15:24:50 -0400
Subject: [PATCH 020/202] src: fix startup snapshot reproducibility of
 InternalFieldInfo

`memset` before a placement `new` can be optimized away by GCC due to
lifetime analysis. This causes the buffer in the startup snapshot
vulnerable to ASLR.

Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/65684
Fixes: https://github.com/nodejs/node/issues/65508
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 src/node_snapshotable.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/node_snapshotable.h b/src/node_snapshotable.h
index 18ef5fbd43fd..a9050877a04d 100644
--- a/src/node_snapshotable.h
+++ b/src/node_snapshotable.h
@@ -44,8 +44,11 @@ struct InternalFieldInfoBase {
   template <std::derived_from<InternalFieldInfoBase> T>
   static T* New(EmbedderObjectType type) {
     void* buf = ::operator new[](sizeof(T));
-    memset(buf, 0, sizeof(T));  // Make the padding reproducible.
     T* result = new (buf) T;
+    // Zero the padding to make the bytes handed to V8 reproducible. Must come
+    // after the placement new, or -flifetime-dse drops it as a dead store.
+    // https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
+    memset(static_cast<void*>(result), 0, sizeof(T));
     result->type = type;
     result->length = sizeof(T);
     return result;

From 927dfadf807d09274d828cf735ad727958806b0e Mon Sep 17 00:00:00 2001
From: avivkeller <me@aviv.sh>
Date: Mon, 24 Aug 2026 15:36:37 -0700
Subject: [PATCH 021/202] fs: improve performance of recursive directory read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://github.com/nodejs/node/issues/58892
Refs: https://github.com/nodejs/node/issues/52663
Signed-off-by: avivkeller <me@aviv.sh>
PR-URL: https://github.com/nodejs/node/pull/65524
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 benchmark/fs/bench-readdir-recursive.js       |  47 ++
 benchmark/fs/bench-readdir.js                 |   6 +-
 benchmark/fs/bench-readdirSync.js             |   6 +-
 lib/fs.js                                     | 122 ++---
 lib/internal/fs/promises.js                   |  69 ++-
 lib/internal/fs/utils.js                      |  83 +++
 src/node_file.cc                              | 485 ++++++++++++++++++
 ...s-readdir-promise-recursive-with-buffer.js |   7 +-
 .../test-fs-readdir-recursive-permission.js   |  89 ++++
 .../test-fs-readdir-recursive-tree.js         | 230 +++++++++
 .../test-fs-readdir-recursive-with-buffer.js  |   7 +-
 ...t-fs-readdir-sync-recursive-with-buffer.js |   7 +-
 12 files changed, 1024 insertions(+), 134 deletions(-)
 create mode 100644 benchmark/fs/bench-readdir-recursive.js
 rename test/{known_issues => parallel}/test-fs-readdir-promise-recursive-with-buffer.js (56%)
 create mode 100644 test/parallel/test-fs-readdir-recursive-permission.js
 create mode 100644 test/parallel/test-fs-readdir-recursive-tree.js
 rename test/{known_issues => parallel}/test-fs-readdir-recursive-with-buffer.js (55%)
 rename test/{known_issues => parallel}/test-fs-readdir-sync-recursive-with-buffer.js (52%)

diff --git a/benchmark/fs/bench-readdir-recursive.js b/benchmark/fs/bench-readdir-recursive.js
new file mode 100644
index 000000000000..6ed56995dcea
--- /dev/null
+++ b/benchmark/fs/bench-readdir-recursive.js
@@ -0,0 +1,47 @@
+'use strict';
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+const bench = common.createBenchmark(main, {
+  n: [10],
+  dir: ['lib', 'test/parallel', 'test'],
+  mode: ['sync', 'callback', 'promise'],
+  withFileTypes: ['true', 'false'],
+});
+
+async function main({ n, dir, mode, withFileTypes }) {
+  withFileTypes = withFileTypes === 'true';
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  const options = { recursive: true, withFileTypes };
+  let entries;
+
+  bench.start();
+  switch (mode) {
+    case 'sync':
+      for (let i = 0; i < n; i++) {
+        entries = fs.readdirSync(fullPath, options);
+      }
+      break;
+    case 'callback':
+      for (let i = 0; i < n; i++) {
+        entries = await new Promise((resolve, reject) => {
+          fs.readdir(fullPath, options, (err, result) => {
+            if (err) reject(err);
+            else resolve(result);
+          });
+        });
+      }
+      break;
+    case 'promise':
+      for (let i = 0; i < n; i++) {
+        entries = await fs.promises.readdir(fullPath, options);
+      }
+      break;
+  }
+  bench.end(n);
+
+  assert.ok(entries.length > 0);
+}
diff --git a/benchmark/fs/bench-readdir.js b/benchmark/fs/bench-readdir.js
index e276653f4584..8fa0e7a3cbdc 100644
--- a/benchmark/fs/bench-readdir.js
+++ b/benchmark/fs/bench-readdir.js
@@ -8,18 +8,16 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   (function r(cntr) {
     if (cntr-- <= 0)
       return bench.end(n);
-    fs.readdir(fullPath, { withFileTypes, recursive }, () => {
+    fs.readdir(fullPath, { withFileTypes }, () => {
       r(cntr);
     });
   }(n));
diff --git a/benchmark/fs/bench-readdirSync.js b/benchmark/fs/bench-readdirSync.js
index ce34e083cb53..8ae1d061d1f1 100644
--- a/benchmark/fs/bench-readdirSync.js
+++ b/benchmark/fs/bench-readdirSync.js
@@ -8,17 +8,15 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   for (let i = 0; i < n; i++) {
-    fs.readdirSync(fullPath, { withFileTypes, recursive });
+    fs.readdirSync(fullPath, { withFileTypes });
   }
   bench.end(n);
 }
diff --git a/lib/fs.js b/lib/fs.js
index e1406596c583..f974d808b826 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -28,7 +28,6 @@ const {
   ArrayFromAsync,
   ArrayPrototypePush,
   BigIntPrototypeToString,
-  Boolean,
   FunctionPrototypeCall,
   MathMax,
   Number,
@@ -57,9 +56,6 @@ const {
   F_OK,
   O_WRONLY,
   O_SYMLINK,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const pathModule = require('path');
@@ -103,10 +99,11 @@ const {
     kReadFileBufferLength,
     kMaxUserId,
   },
+  collectRecursiveReaddirResult,
   copyObject,
   Dirent,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getValidatedFd,
   getValidatedPath,
@@ -1744,57 +1741,40 @@ function mkdirSync(path, options) {
 }
 
 /**
- * Appends one directory's entries to `context.results` and the subdirectories
- * still to visit to `context.dirs` (with the prefix their entries get in
- * string results in `context.prefixes`). `result` is a `binding.readdir()`
- * result with file types, so only symbolic links and entries of unknown type
- * need a stat() to find out whether they lead to a directory.
- * @param {string} dir
- * @param {string} prefix
- * @param {[string[], number[]]} result
- * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
- */
-function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
-  const { length } = names;
-  for (let i = 0; i < length; i++) {
-    const name = names[i];
-    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-    let isDirectory;
-    if (context.withFileTypes) {
-      const dirent = getDirent(dir, name, types[i]);
-      ArrayPrototypePush(context.results, dirent);
-      // Follow symbolic links to directories, see https://github.com/nodejs/node/issues/52663
-      isDirectory = dirent.isDirectory() ||
-        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    } else {
-      ArrayPrototypePush(context.results, relative);
-      const type = types[i];
-      isDirectory = type === UV_DIRENT_DIR ||
-        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    }
-    if (isDirectory) {
-      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
-      ArrayPrototypePush(context.prefixes, relative);
-    }
-  }
-}
-
-/*
- * An recursive algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Reads the entire contents of the `basePath` directory. This function does
+ * not validate `basePath` as a directory. It is passed directly to
+ * `binding.readdirRecursive`, or to `binding.readdir` for each directory when
+ * the permission model is enabled, since that checks every directory on the
+ * main thread where the native walk can not.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
  * @param {(
  *   err?: Error,
  *   files?: string[] | Buffer[] | Dirent[]
  * ) => any} callback
  * @returns {void}
-*/
+ */
 function readdirRecursive(basePath, options, callback) {
+  if (permission.isEnabled()) {
+    readdirRecursiveWithPermissionModel(basePath, options, callback);
+    return;
+  }
+  const withFileTypes = !!options.withFileTypes;
+  const req = new FSReqCallback();
+  req.oncomplete = (err, result) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    callback(null, withFileTypes ? getRecursiveDirents(basePath, result) : result);
+  };
+  binding.readdirRecursive(basePath, options.encoding, withFileTypes, req);
+}
+
+function readdirRecursiveWithPermissionModel(basePath, options, callback) {
+  const { encoding } = options;
   const context = {
-    withFileTypes: Boolean(options.withFileTypes),
+    withFileTypes: !!options.withFileTypes,
     results: [],
     dirs: [basePath],
     prefixes: [''],
@@ -1816,11 +1796,6 @@ function readdirRecursive(basePath, options, callback) {
         return;
       }
 
-      if (result === undefined) {
-        callback(null, context.results);
-        return;
-      }
-
       try {
         collectRecursiveReaddirResult(path, prefix, result, context);
       } catch (err) {
@@ -1835,37 +1810,37 @@ function readdirRecursive(basePath, options, callback) {
       }
     };
 
-    binding.readdir(path, options.encoding, true, req);
+    binding.readdir(path, encoding, true, req);
   }
 
   read(context.dirs[i], context.prefixes[i++]);
 }
 
 /**
- * An iterative algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Synchronously reads the entire contents of the `basePath` directory, see
+ * `readdirRecursive`.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
- * @returns {string[] | Dirent[]}
+ * @returns {string[] | Buffer[] | Dirent[]}
  */
 function readdirSyncRecursive(basePath, options) {
-  const context = {
-    withFileTypes: Boolean(options.withFileTypes),
-    results: [],
-    dirs: [basePath],
-    prefixes: [''],
-  };
-
-  for (let i = 0; i < context.dirs.length; i++) {
-    const dir = context.dirs[i];
-    const result = binding.readdir(dir, options.encoding, true);
-    if (result !== undefined) {
+  const withFileTypes = !!options.withFileTypes;
+  if (permission.isEnabled()) {
+    const context = {
+      withFileTypes,
+      results: [],
+      dirs: [basePath],
+      prefixes: [''],
+    };
+    for (let i = 0; i < context.dirs.length; i++) {
+      const dir = context.dirs[i];
+      const result = binding.readdir(dir, options.encoding, true);
       collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
     }
+    return context.results;
   }
-
-  return context.results;
+  const result = binding.readdirRecursive(basePath, options.encoding, withFileTypes);
+  return result !== undefined && withFileTypes ? getRecursiveDirents(basePath, result) : result;
 }
 
 /**
@@ -1899,9 +1874,6 @@ function readdir(path, options, callback) {
   }
 
   if (options.recursive) {
-    // Make shallow copy to prevent mutating options from affecting results
-    options = copyObject(options);
-
     readdirRecursive(path, options, callback);
     return;
   }
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index a9d03ebb1d18..bd9fc871ce75 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayPrototypePop,
   ArrayPrototypePush,
   Error,
   ErrorCaptureStackTrace,
@@ -32,9 +31,6 @@ const {
   O_WRONLY,
   S_IFMT,
   S_IFREG,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const binding = internalBinding('fs');
@@ -65,9 +61,10 @@ const {
     kReadFileUnknownBufferLength,
     kWriteFileMaxChunkSize,
   },
+  collectRecursiveReaddirResult,
   copyObject,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getStatFsFromBinding,
   getStatsFromBinding,
@@ -1648,42 +1645,42 @@ async function mkdir(path, options) {
 }
 
 async function readdirRecursive(originalPath, options) {
+  if (permission.isEnabled()) {
+    return readdirRecursiveWithPermissionModel(originalPath, options);
+  }
   const withFileTypes = !!options.withFileTypes;
-  const readdirWithTypes = (path) => PromisePrototypeThen(
-    binding.readdir(path, options.encoding, true, kUsePromises),
+  const result = await PromisePrototypeThen(
+    binding.readdirRecursive(
+      originalPath,
+      options.encoding,
+      withFileTypes,
+      kUsePromises,
+    ),
     undefined,
     handleErrorFromBinding,
   );
-  const result = [];
-  const queue = [[originalPath, '', await readdirWithTypes(originalPath)]];
-
-  while (queue.length > 0) {
-    // If we want to implement BFS make this a `shift` call instead of `pop`
-    const { 0: path, 1: prefix, 2: { 0: names, 1: types } } = ArrayPrototypePop(queue);
-    for (let i = 0; i < names.length; i++) {
-      const name = names[i];
-      const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-      let isDirectory;
-      if (withFileTypes) {
-        const dirent = getDirent(path, name, types[i]);
-        ArrayPrototypePush(result, dirent);
-        isDirectory = dirent.isDirectory();
-      } else {
-        ArrayPrototypePush(result, relative);
-        // Entries that are, or may be, symbolic links to directories are followed.
-        const type = types[i];
-        isDirectory = type === UV_DIRENT_DIR ||
-          ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-           binding.internalModuleStat(pathModule.join(path, name)) === 1);
-      }
-      if (isDirectory) {
-        const direntPath = pathModule.join(path, name);
-        ArrayPrototypePush(queue, [direntPath, relative, await readdirWithTypes(direntPath)]);
-      }
-    }
-  }
+  return withFileTypes ? getRecursiveDirents(originalPath, result) : result;
+}
 
-  return result;
+// TODO: native?
+async function readdirRecursiveWithPermissionModel(basePath, options) {
+  const { encoding } = options;
+  const context = {
+    withFileTypes: !!options.withFileTypes,
+    results: [],
+    dirs: [basePath],
+    prefixes: [''],
+  };
+  for (let i = 0; i < context.dirs.length; i++) {
+    const dir = context.dirs[i];
+    const result = await PromisePrototypeThen(
+      binding.readdir(dir, encoding, true, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    );
+    collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
+  }
+  return context.results;
 }
 
 async function readdir(path, options) {
diff --git a/lib/internal/fs/utils.js b/lib/internal/fs/utils.js
index 70aaa7e7c58e..3aadc19c4732 100644
--- a/lib/internal/fs/utils.js
+++ b/lib/internal/fs/utils.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayIsArray,
+  ArrayPrototypePush,
   BigInt,
   Date,
   DateNow,
@@ -65,6 +66,11 @@ const {
   validateUint32,
 } = require('internal/validators');
 const pathModule = require('path');
+const binding = internalBinding('fs');
+const {
+  CHAR_BACKWARD_SLASH,
+  CHAR_FORWARD_SLASH,
+} = require('internal/constants');
 const kType = Symbol('type');
 const kStats = Symbol('stats');
 const kPartialAtimeNs = Symbol('partialAtimeNs');
@@ -323,6 +329,81 @@ function getDirent(path, name, type, callback) {
   }
 }
 
+/**
+ * Builds the Dirent objects for a `binding.readdirRecursive()` result, whose
+ * entries are grouped by directory: `counts[i]` entries under `dirs[i]`.
+ * @param {string | Buffer} basePath
+ * @param {[string[] | Buffer[], Uint8Array, Uint32Array, string[] | Buffer[]]} result
+ * @returns {Dirent[]}
+ */
+function getRecursiveDirents(basePath, { 0: names, 1: types, 2: counts, 3: dirs }) {
+  let i = 0;
+  for (let d = 0; d < dirs.length; d++) {
+    // The root keeps the path as given, the directories below it get the
+    // relative directory joined onto it.
+    const parentPath = d === 0 ? basePath : joinParentPath(basePath, dirs[d]);
+    for (const end = i + counts[d]; i < end; i++) {
+      names[i] = new Dirent(names[i], types[i], parentPath);
+    }
+  }
+  return names;
+}
+
+/**
+ * Joins the relative path of a directory onto the path a recursive readdir
+ * was given.
+ * @param {string | Buffer} basePath
+ * @param {string | Buffer} relative
+ * @returns {string | Buffer}
+ */
+function joinParentPath(basePath, relative) {
+  if (typeof basePath === 'string' && typeof relative === 'string') {
+    return pathModule.join(basePath, relative);
+  }
+  const base = typeof basePath === 'string' ? Buffer.from(basePath) : basePath;
+  const parts = [base];
+  const last = base.length === 0 ? -1 : base[base.length - 1];
+  if (last !== CHAR_FORWARD_SLASH && (!isWindows || last !== CHAR_BACKWARD_SLASH)) {
+    ArrayPrototypePush(parts, Buffer.from(pathModule.sep));
+  }
+  ArrayPrototypePush(parts, typeof relative === 'string' ? Buffer.from(relative) : relative);
+  return Buffer.concat(parts);
+}
+
+/**
+ * Appends one directory's entries to `context.results` and the subdirectories
+ * still to visit to `context.dirs`.
+ * @param {string} dir
+ * @param {string} prefix
+ * @param {[string[], number[]]} result
+ * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
+ */
+function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
+  const { length } = names;
+  for (let i = 0; i < length; i++) {
+    const name = names[i];
+    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
+    let isDirectory;
+    if (context.withFileTypes) {
+      const dirent = getDirent(dir, name, types[i]);
+      ArrayPrototypePush(context.results, dirent);
+      // https://github.com/nodejs/node/issues/52663
+      isDirectory = dirent.isDirectory() ||
+        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    } else {
+      ArrayPrototypePush(context.results, relative);
+      const type = types[i];
+      isDirectory = type === UV_DIRENT_DIR ||
+        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
+         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    }
+    if (isDirectory) {
+      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
+      ArrayPrototypePush(context.prefixes, relative);
+    }
+  }
+}
+
 function getOptions(options, defaultOptions = kEmptyObject) {
   if (options == null || typeof options === 'function') {
     return defaultOptions;
@@ -1111,6 +1192,7 @@ const vfsState = { __proto__: null, handlers: null };
 function setVfsHandlers(handlers) { vfsState.handlers = handlers; }
 
 module.exports = {
+  collectRecursiveReaddirResult,
   constants: {
     kIoMaxLength,
     kMaxUserId,
@@ -1128,6 +1210,7 @@ module.exports = {
   getDirent,
   getDirents,
   getOptions,
+  getRecursiveDirents,
   getValidatedFd,
   getValidatedPath,
   handleErrorFromBinding,
diff --git a/src/node_file.cc b/src/node_file.cc
index 8a09b656e5a1..dd372c7f16c7 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -64,6 +64,7 @@ namespace node {
 namespace fs {
 
 using v8::Array;
+using v8::ArrayBuffer;
 using v8::BigInt;
 using v8::Context;
 using v8::EscapableHandleScope;
@@ -86,6 +87,8 @@ using v8::ObjectTemplate;
 using v8::Promise;
 using v8::String;
 using v8::TryCatch;
+using v8::Uint32Array;
+using v8::Uint8Array;
 using v8::Undefined;
 using v8::Value;
 
@@ -2258,6 +2261,486 @@ static void ReadDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+namespace {
+
+// Recursive readdir.
+//
+// The result is breadth-first: every entry of the root, then every entry of
+// the first subdirectory, and so on, each directory's entries in the order
+// uv_fs_scandir() reports them. Symbolic links to directories are followed,
+// see https://github.com/nodejs/node/issues/52663.
+//
+// The tree is walked by one or more threads that share a queue of
+// directories, and the breadth-first order is derived from the tree
+// afterwards, so it does not depend on which thread scanned what. The walk
+// does not touch the Environment; lib does not use it when the permission
+// model is enabled, as every directory would need a check on the main thread.
+
+// Maps an st_mode to the uv_dirent_type_t that uv_fs_scandir would report.
+uv_dirent_type_t DirentTypeFromMode(uint64_t mode) {
+  switch (mode & S_IFMT) {
+    case S_IFREG:
+      return UV_DIRENT_FILE;
+    case S_IFDIR:
+      return UV_DIRENT_DIR;
+    case S_IFLNK:
+      return UV_DIRENT_LINK;
+    case S_IFCHR:
+      return UV_DIRENT_CHAR;
+#ifdef S_IFIFO
+    case S_IFIFO:
+      return UV_DIRENT_FIFO;
+#endif
+#ifdef S_IFSOCK
+    case S_IFSOCK:
+      return UV_DIRENT_SOCKET;
+#endif
+#ifdef S_IFBLK
+    case S_IFBLK:
+      return UV_DIRENT_BLOCK;
+#endif
+    default:
+      return UV_DIRENT_UNKNOWN;
+  }
+}
+
+// Appends `name` to `path`, with a separator unless `path` already ends in
+// one (so that a root of "dir/" does not turn into "dir//name").
+void AppendPathComponent(std::string* path, std::string_view name) {
+  if (name.empty()) return;
+  if (!path->empty()) {
+#ifdef _WIN32
+    const bool has_separator = path->back() == '\\' || path->back() == '/';
+    if (!has_separator) *path += '\\';
+#else
+    const bool has_separator = path->back() == '/';
+    if (!has_separator) *path += '/';
+#endif
+  }
+  path->append(name);
+}
+
+struct ReadDirEntry {
+  // Offset and length of the name within ScannedDirectory::names.
+  uint32_t name_offset;
+  uint32_t name_length;
+  uint8_t type;  // A uv_dirent_type_t.
+  // Whether the walk descends into this entry (a directory, or a symbolic
+  // link to one).
+  bool is_dir = false;
+};
+
+// One directory of the tree.
+struct ScannedDirectory {
+  explicit ScannedDirectory(std::string relative)
+      : relative(std::move(relative)) {}
+
+  std::string_view name(const ReadDirEntry& entry) const {
+    return std::string_view(names).substr(entry.name_offset, entry.name_length);
+  }
+
+  // Path relative to the root; empty for the root itself.
+  const std::string relative;
+  // The entry names, concatenated.
+  std::string names;
+  std::vector<ReadDirEntry> entries;
+  // Indices (into RecursiveReadDir::dirs()) of the subdirectories, in entry
+  // order.
+  std::vector<uint32_t> subdirs;
+};
+
+class RecursiveReadDir {
+ public:
+  explicit RecursiveReadDir(std::string root) : root_(std::move(root)) {
+    dirs_.push_back(std::make_unique<ScannedDirectory>(""));
+  }
+
+  // Scans directories until none are left or an error occurred. May be
+  // called from several threads at once, which then share the work.
+  void Run();
+  void RunWithHelpers(int max_helpers);
+
+  // The following are only valid once every Run() has returned.
+
+  // 0 or a uv error code; error_path() is then the directory that failed.
+  int error() const { return error_; }
+  const std::string& error_path() const { return error_path_; }
+
+  const std::vector<std::unique_ptr<ScannedDirectory>>& dirs() const {
+    return dirs_;
+  }
+
+  // The indices of dirs() in breadth-first order.
+  std::vector<uint32_t> BreadthFirstOrder() const {
+    std::vector<uint32_t> order;
+    order.reserve(dirs_.size());
+    order.push_back(0);
+    for (size_t i = 0; i < order.size(); i++) {
+      for (uint32_t subdir : dirs_[order[i]]->subdirs) order.push_back(subdir);
+    }
+    return order;
+  }
+
+ private:
+  // Reads the directory at `path` into `dir`, resolving the type of entries
+  // where needed, and creates the ScannedDirectory of each subdirectory.
+  static int Scan(const std::string& path,
+                  ScannedDirectory* dir,
+                  std::vector<std::unique_ptr<ScannedDirectory>>* subdirs);
+
+  // Called with the lock held.
+  void MaybeStartHelper();
+
+  // The number of entries a walk has to have seen, with directories still
+  // to scan, before RunWithHelpers() starts a helper thread.
+  static constexpr size_t kHelperThreshold = 1024;
+
+  const std::string root_;
+
+  Mutex mutex_;
+  ConditionVariable cv_;
+  // Directories in the order they were found; the first next_ have been or
+  // are being scanned by one of the active_ threads.
+  std::vector<std::unique_ptr<ScannedDirectory>> dirs_;
+  size_t next_ = 0;
+  size_t active_ = 0;
+  size_t entries_seen_ = 0;
+  int error_ = 0;
+  std::string error_path_;
+  size_t max_helpers_ = 0;
+  std::vector<uv_thread_t> helpers_;
+};
+
+void RecursiveReadDir::RunWithHelpers(int max_helpers) {
+  max_helpers_ = max_helpers;
+  Run();
+  for (uv_thread_t& helper : helpers_) CHECK_EQ(uv_thread_join(&helper), 0);
+}
+
+void RecursiveReadDir::Run() {
+  std::vector<std::unique_ptr<ScannedDirectory>> subdirs;
+  std::string path;
+  Mutex::ScopedLock lock(mutex_);
+  for (;;) {
+    while (next_ == dirs_.size() && active_ > 0 && error_ == 0) {
+      cv_.Wait(lock);
+    }
+    if (next_ == dirs_.size() || error_ != 0) return;
+
+    ScannedDirectory* dir = dirs_[next_++].get();
+    active_++;
+    int r;
+    {
+      Mutex::ScopedUnlock unlock(lock);
+      path = root_;
+      AppendPathComponent(&path, dir->relative);
+      r = Scan(path, dir, &subdirs);
+    }
+    active_--;
+
+    if (r != 0) {
+      if (error_ == 0) {
+        error_ = r;
+        error_path_ = std::move(path);
+      }
+    } else {
+      for (std::unique_ptr<ScannedDirectory>& subdir : subdirs) {
+        dir->subdirs.push_back(static_cast<uint32_t>(dirs_.size()));
+        dirs_.push_back(std::move(subdir));
+      }
+      entries_seen_ += dir->entries.size();
+    }
+    // Wake the others if there is new work, or nothing left to wait for.
+    if (!subdirs.empty() || active_ == 0 || error_ != 0) cv_.Broadcast(lock);
+    subdirs.clear();
+    MaybeStartHelper();
+  }
+}
+
+void RecursiveReadDir::MaybeStartHelper() {
+  if (helpers_.size() >= max_helpers_ || entries_seen_ < kHelperThreshold ||
+      dirs_.size() - next_ < 2) {
+    return;
+  }
+  uv_thread_t helper;
+  int r = uv_thread_create(
+      &helper,
+      [](void* arg) { static_cast<RecursiveReadDir*>(arg)->Run(); },
+      this);
+  if (r == 0) {
+    helpers_.push_back(helper);
+  } else {
+    max_helpers_ = 0;  // Carry on alone.
+  }
+}
+
+int RecursiveReadDir::Scan(
+    const std::string& path,
+    ScannedDirectory* dir,
+    std::vector<std::unique_ptr<ScannedDirectory>>* subdirs) {
+  uv_fs_t req;
+  int r = uv_fs_scandir(nullptr, &req, path.c_str(), 0, nullptr);
+  if (r >= 0) {
+    dir->entries.reserve(r);
+    uv_dirent_t ent;
+    while ((r = uv_fs_scandir_next(&req, &ent)) == 0) {
+      const size_t length = strlen(ent.name);
+      dir->entries.push_back({static_cast<uint32_t>(dir->names.size()),
+                              static_cast<uint32_t>(length),
+                              static_cast<uint8_t>(ent.type)});
+      dir->names.append(ent.name, length);
+    }
+    if (r == UV_EOF) r = 0;
+  }
+  uv_fs_req_cleanup(&req);
+  if (r != 0) return r;
+
+  std::string child;
+  for (ReadDirEntry& entry : dir->entries) {
+    const std::string_view name = dir->name(entry);
+    if (entry.type == UV_DIRENT_UNKNOWN || entry.type == UV_DIRENT_LINK) {
+      // The file system did not report a type, or the entry is a symbolic
+      // link that may point at a directory.
+      child = path;
+      AppendPathComponent(&child, name);
+      if (entry.type == UV_DIRENT_UNKNOWN) {
+        if (uv_fs_lstat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.type = DirentTypeFromMode(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+      if (entry.type == UV_DIRENT_LINK) {
+        if (uv_fs_stat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.is_dir = S_ISDIR(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+    }
+    if (entry.type == UV_DIRENT_DIR) entry.is_dir = true;
+
+    if (entry.is_dir) {
+      std::string relative = dir->relative;
+      AppendPathComponent(&relative, name);
+      subdirs->push_back(
+          std::make_unique<ScannedDirectory>(std::move(relative)));
+    }
+  }
+  return 0;
+}
+
+// Without file types the result is an array of paths relative to the root.
+// With file types it is [names, types, counts, dirs]: `types` is a
+// Uint8Array with the uv_dirent_type_t of every entry, `dirs` the relative
+// path of every directory in the order their entries appear, and `counts` a
+// Uint32Array with the number of entries in each of those directories. See
+// getRecursiveDirents() in lib/internal/fs/utils.js.
+MaybeLocal<Value> MarshalRecursiveReadDir(Isolate* isolate,
+                                          const RecursiveReadDir& walk,
+                                          enum encoding encoding,
+                                          bool with_types) {
+  EscapableHandleScope scope(isolate);
+  const std::vector<uint32_t> order = walk.BreadthFirstOrder();
+
+  LocalVector<Value> names(isolate);
+  LocalVector<Value> dirs(isolate);
+  std::vector<uint8_t> types;
+  std::vector<uint32_t> counts;
+  std::string path;
+  for (uint32_t index : order) {
+    const ScannedDirectory& dir = *walk.dirs()[index];
+    for (const ReadDirEntry& entry : dir.entries) {
+      std::string_view data = dir.name(entry);
+      if (!with_types) {
+        path = dir.relative;
+        AppendPathComponent(&path, data);
+        data = path;
+      }
+      Local<Value> name;
+      if (!StringBytes::Encode(isolate, data.data(), data.size(), encoding)
+               .ToLocal(&name)) {
+        return MaybeLocal<Value>();
+      }
+      names.push_back(name);
+      types.push_back(entry.type);
+    }
+    if (!with_types) continue;
+    counts.push_back(static_cast<uint32_t>(dir.entries.size()));
+    Local<Value> relative;
+    if (!StringBytes::Encode(
+             isolate, dir.relative.data(), dir.relative.size(), encoding)
+             .ToLocal(&relative)) {
+      return MaybeLocal<Value>();
+    }
+    dirs.push_back(relative);
+  }
+
+  if (!with_types) {
+    return scope.Escape(Array::New(isolate, names.data(), names.size()));
+  }
+
+  // One ArrayBuffer holding the types, then (4-byte aligned) the counts.
+  const size_t counts_offset = (types.size() + 3) & ~static_cast<size_t>(3);
+  Local<ArrayBuffer> ab = ArrayBuffer::New(
+      isolate, counts_offset + counts.size() * sizeof(uint32_t));
+  char* bytes = static_cast<char*>(ab->Data());
+  memcpy(bytes, types.data(), types.size());
+  memcpy(
+      bytes + counts_offset, counts.data(), counts.size() * sizeof(uint32_t));
+
+  Local<Value> parts[] = {
+      Array::New(isolate, names.data(), names.size()),
+      Uint8Array::New(ab, 0, types.size()),
+      Uint32Array::New(ab, counts_offset, counts.size()),
+      Array::New(isolate, dirs.data(), dirs.size()),
+  };
+  return scope.Escape(Array::New(isolate, parts, arraysize(parts)));
+}
+
+// The number of thread pool work items that share an asynchronous walk, and
+// the number of helper threads a synchronous walk may start.
+constexpr int kReadDirRecursiveWorkers = 4;
+constexpr int kReadDirRecursiveSyncHelpers = kReadDirRecursiveWorkers - 1;
+
+// An asynchronous recursive readdir: the walk, and the request it settles
+// once every worker has finished.
+class ReadDirRecursiveRequest {
+ public:
+  ReadDirRecursiveRequest(Environment* env,
+                          FSReqBase* req_wrap,
+                          std::string path,
+                          enum encoding encoding,
+                          bool with_types,
+                          int workers)
+      : env_(env),
+        req_wrap_(req_wrap),
+        walk_(std::move(path)),
+        encoding_(encoding),
+        with_types_(with_types),
+        pending_(workers) {}
+
+  RecursiveReadDir* walk() { return &walk_; }
+
+  // Called on the main thread when a worker is done.
+  void OnWorkerDone(int status) {
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED) cancelled_ = true;
+    if (--pending_ > 0) return;
+
+    Isolate* isolate = env_->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env_->context());
+
+    // Release the request even if the environment is shutting down.
+    BaseObjectPtr<FSReqBase> req_wrap = std::move(req_wrap_);
+    req_wrap->Detach();
+
+    FS_ASYNC_TRACE_END1(UV_FS_SCANDIR, req_wrap.get(), "result", walk_.error())
+    if (cancelled_ || !env_->can_call_into_js()) return;
+
+    if (walk_.error() != 0) {
+      return req_wrap->Reject(UVException(isolate,
+                                          walk_.error(),
+                                          "scandir",
+                                          nullptr,
+                                          walk_.error_path().c_str()));
+    }
+
+    Local<Value> value;
+    TryCatch try_catch(isolate);
+    if (!MarshalRecursiveReadDir(isolate, walk_, encoding_, with_types_)
+             .ToLocal(&value)) {
+      CHECK(try_catch.CanContinue());
+      return req_wrap->Reject(try_catch.Exception());
+    }
+    req_wrap->Resolve(value);
+  }
+
+ private:
+  Environment* const env_;
+  BaseObjectPtr<FSReqBase> req_wrap_;
+  RecursiveReadDir walk_;
+  const enum encoding encoding_;
+  const bool with_types_;
+  int pending_;
+  bool cancelled_ = false;
+};
+
+class ReadDirRecursiveWork final : public ThreadPoolWork {
+ public:
+  ReadDirRecursiveWork(Environment* env,
+                       std::shared_ptr<ReadDirRecursiveRequest> request)
+      : ThreadPoolWork(env, "readdir_recursive"),
+        request_(std::move(request)) {}
+
+  void DoThreadPoolWork() override { request_->walk()->Run(); }
+
+  void AfterThreadPoolWork(int status) override {
+    std::unique_ptr<ReadDirRecursiveWork> self(this);
+    request_->OnWorkerDone(status);
+  }
+
+ private:
+  std::shared_ptr<ReadDirRecursiveRequest> request_;
+};
+
+}  // namespace
+
+// readdirRecursive(path, encoding, withTypes[, req])
+static void ReadDirRecursive(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  const int argc = args.Length();
+  CHECK_GE(argc, 3);
+
+  BufferValue path(isolate, args[0]);
+  CHECK_NOT_NULL(*path);
+  ToNamespacedPath(env, &path);
+
+  const enum encoding encoding = ParseEncoding(isolate, args[1], UTF8);
+
+  bool with_types = args[2]->IsTrue();
+
+  // Every directory would need a permission check, and only the main thread
+  // can do those: lib walks the tree in JS when the permission model is on.
+  CHECK(!env->permission()->enabled());
+
+  if (argc > 3) {  // readdirRecursive(path, encoding, withTypes, req)
+    FSReqBase* req_wrap_async = GetReqWrap(args, 3);
+    CHECK_NOT_NULL(req_wrap_async);
+    req_wrap_async->Init("scandir", nullptr, 0, encoding);
+    FS_ASYNC_TRACE_BEGIN1(
+        UV_FS_SCANDIR, req_wrap_async, "path", TRACE_STR_COPY(*path))
+    auto request =
+        std::make_shared<ReadDirRecursiveRequest>(env,
+                                                  req_wrap_async,
+                                                  path.ToString(),
+                                                  encoding,
+                                                  with_types,
+                                                  kReadDirRecursiveWorkers);
+    for (int i = 0; i < kReadDirRecursiveWorkers; i++) {
+      (new ReadDirRecursiveWork(env, request))->ScheduleWork();
+    }
+  } else {  // readdirRecursive(path, encoding, withTypes)
+    env->PrintSyncTrace();
+    FS_SYNC_TRACE_BEGIN(readdir);
+    RecursiveReadDir walk(path.ToString());
+    walk.RunWithHelpers(kReadDirRecursiveSyncHelpers);
+    FS_SYNC_TRACE_END(readdir);
+
+    if (walk.error() != 0) {
+      return env->ThrowUVException(
+          walk.error(), "scandir", nullptr, walk.error_path().c_str());
+    }
+
+    Local<Value> value;
+    if (MarshalRecursiveReadDir(isolate, walk, encoding, with_types)
+            .ToLocal(&value)) {
+      args.GetReturnValue().Set(value);
+    }
+  }
+}
+
 static inline Maybe<void> AsyncCheckOpenPermissions(Environment* env,
                                                     FSReqBase* req_wrap,
                                                     const BufferValue& path,
@@ -4566,6 +5049,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "rmSync", RmSync);
   SetMethod(isolate, target, "mkdir", MKDir);
   SetMethod(isolate, target, "readdir", ReadDir);
+  SetMethod(isolate, target, "readdirRecursive", ReadDirRecursive);
   SetMethod(isolate, target, "internalModuleStat", InternalModuleStat);
   SetMethod(isolate, target, "stat", Stat);
   SetMethod(isolate, target, "lstat", LStat);
@@ -4705,6 +5189,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(RmSync);
   registry->Register(MKDir);
   registry->Register(ReadDir);
+  registry->Register(ReadDirRecursive);
   registry->Register(InternalModuleStat);
   registry->Register(Stat);
   registry->Register(LStat);
diff --git a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
similarity index 56%
rename from test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
index 314d6dda9a2d..5231b7248f3a 100644
--- a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs/promises');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }).then(common.mustCall());
diff --git a/test/parallel/test-fs-readdir-recursive-permission.js b/test/parallel/test-fs-readdir-recursive-permission.js
new file mode 100644
index 000000000000..b44454a213ce
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-permission.js
@@ -0,0 +1,89 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const allowed = tmpdir.resolve('allowed');
+const blocked = tmpdir.resolve('blocked');
+fs.mkdirSync(path.join(allowed, 'a', 'b'), { recursive: true });
+fs.mkdirSync(path.join(allowed, 'c'));
+fs.mkdirSync(blocked);
+fs.writeFileSync(path.join(allowed, 'top'), '');
+fs.writeFileSync(path.join(allowed, 'a', '1'), '');
+fs.writeFileSync(path.join(allowed, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(blocked, 'secret'), '');
+if (common.canCreateSymLink()) {
+  fs.symlinkSync(path.join(allowed, 'a'), path.join(allowed, 'c', 'link-to-a'), 'dir');
+}
+
+// Computed without the permission model, so by the native walk.
+const expected = fs.readdirSync(allowed, { recursive: true });
+assert(expected.includes(path.join('a', 'b', '2')));
+
+const { status, stderr } = spawnSync(process.execPath, [
+  '--permission',
+  `--allow-fs-read=${allowed}`,
+  '-e',
+  `
+    const assert = require('assert');
+    const fs = require('fs');
+    const path = require('path');
+    const { ALLOWED, BLOCKED } = process.env;
+    const expected = JSON.parse(process.env.EXPECTED);
+    const denied = {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemRead',
+      resource: path.toNamespacedPath(BLOCKED),
+    };
+
+    function check(result, withFileTypes) {
+      if (!withFileTypes) {
+        assert.deepStrictEqual(result, expected);
+        return;
+      }
+      assert(result.every((dirent) => dirent instanceof fs.Dirent));
+      assert.deepStrictEqual(
+        result.map((dirent) => path.join(path.relative(ALLOWED, dirent.parentPath), dirent.name)),
+        expected,
+      );
+    }
+
+    let pending = 0;
+    process.on('exit', () => assert.strictEqual(pending, 0));
+    for (const withFileTypes of [false, true]) {
+      const options = { recursive: true, withFileTypes };
+      check(fs.readdirSync(ALLOWED, options), withFileTypes);
+      assert.throws(() => fs.readdirSync(BLOCKED, options), denied);
+
+      pending += 4;
+      fs.readdir(ALLOWED, options, (err, result) => {
+        assert.ifError(err);
+        check(result, withFileTypes);
+        pending--;
+      });
+      fs.readdir(BLOCKED, options, (err) => {
+        assert.throws(() => { throw err; }, denied);
+        pending--;
+      });
+      fs.promises.readdir(ALLOWED, options).then((result) => {
+        check(result, withFileTypes);
+        pending--;
+      });
+      assert.rejects(fs.promises.readdir(BLOCKED, options), denied).then(() => pending--);
+    }
+  `,
+], {
+  env: {
+    ...process.env,
+    ALLOWED: allowed,
+    BLOCKED: blocked,
+    EXPECTED: JSON.stringify(expected),
+  },
+});
+assert.strictEqual(status, 0, stderr.toString());
diff --git a/test/parallel/test-fs-readdir-recursive-tree.js b/test/parallel/test-fs-readdir-recursive-tree.js
new file mode 100644
index 000000000000..2c10f63f0748
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-tree.js
@@ -0,0 +1,230 @@
+'use strict';
+
+// Exercises the native recursive readdir (sync, callback and promise forms)
+// against a reference walk built from the non-recursive API.
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const root = tmpdir.resolve('tree');
+fs.mkdirSync(path.join(root, 'a', 'b', 'c'), { recursive: true });
+fs.mkdirSync(path.join(root, 'd'));
+fs.mkdirSync(path.join(root, '.hidden'));
+fs.mkdirSync(path.join(root, 'empty'));
+fs.writeFileSync(path.join(root, 'top'), '');
+fs.writeFileSync(path.join(root, 'a', '1'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', 'c', '3'), '');
+fs.writeFileSync(path.join(root, 'd', '4'), '');
+fs.writeFileSync(path.join(root, '.hidden', '5'), '');
+
+const canSymlink = common.canCreateSymLink();
+if (canSymlink) {
+  fs.symlinkSync(path.join(root, 'a'), path.join(root, 'd', 'link-to-a'), 'dir');
+  fs.symlinkSync(path.join(root, 'a', '1'), path.join(root, 'd', 'link-to-file'));
+  fs.symlinkSync(path.join(root, 'nowhere'), path.join(root, 'd', 'dangling'));
+}
+
+// Reference implementation: breadth-first, entries in readdir order,
+// directory symlinks followed (fs.readdir semantics).
+function reference(basePath) {
+  const entries = [];
+  const queue = [basePath];
+  for (let i = 0; i < queue.length; i++) {
+    const dir = queue[i];
+    for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, dirent.name);
+      entries.push({
+        relative: path.relative(basePath, full),
+        isDirent: true,
+        name: dirent.name,
+        parentPath: dir,
+        isDirectory: dirent.isDirectory(),
+        isSymbolicLink: dirent.isSymbolicLink(),
+        isFile: dirent.isFile(),
+      });
+      let isDir = dirent.isDirectory();
+      if (!isDir && dirent.isSymbolicLink()) {
+        try {
+          isDir = fs.statSync(full).isDirectory();
+        } catch {
+          isDir = false;
+        }
+      }
+      if (isDir) queue.push(full);
+    }
+  }
+  return entries;
+}
+
+function fromDirents(dirents) {
+  return dirents.map((dirent) => {
+    return {
+      isDirent: dirent instanceof fs.Dirent,
+      name: dirent.name,
+      parentPath: dirent.parentPath,
+      isDirectory: dirent.isDirectory(),
+      isSymbolicLink: dirent.isSymbolicLink(),
+      isFile: dirent.isFile(),
+    };
+  });
+}
+
+function stripRelative(entries) {
+  return entries.map(({ relative, ...rest }) => rest);
+}
+
+const expected = reference(root);
+const expectedPaths = expected.map((entry) => entry.relative);
+const expectedDirents = stripRelative(expected);
+
+// The tree is only interesting if symlinks were followed.
+if (canSymlink) {
+  assert(expectedPaths.includes(path.join('d', 'link-to-a', 'b', 'c', '3')));
+  assert(!expectedPaths.includes(path.join('d', 'link-to-file', '1')));
+}
+assert(expectedPaths.includes(path.join('.hidden', '5')));
+assert(expectedPaths.includes('empty'));
+
+// Sync.
+assert.deepStrictEqual(fs.readdirSync(root, { recursive: true }), expectedPaths);
+assert.deepStrictEqual(
+  fromDirents(fs.readdirSync(root, { recursive: true, withFileTypes: true })),
+  expectedDirents,
+);
+
+// Callback.
+fs.readdir(root, { recursive: true }, common.mustSucceed((paths) => {
+  assert.deepStrictEqual(paths, expectedPaths);
+}));
+fs.readdir(root, { recursive: true, withFileTypes: true }, common.mustSucceed((dirents) => {
+  assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+}));
+
+// Promises.
+(async () => {
+  assert.deepStrictEqual(
+    await fs.promises.readdir(root, { recursive: true }),
+    expectedPaths,
+  );
+  assert.deepStrictEqual(
+    fromDirents(await fs.promises.readdir(root, { recursive: true, withFileTypes: true })),
+    expectedDirents,
+  );
+})().then(common.mustCall());
+
+// Mutating the options object after the call must not affect the result.
+{
+  const options = { recursive: true, withFileTypes: true };
+  fs.readdir(root, options, common.mustSucceed((dirents) => {
+    assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+  }));
+  options.withFileTypes = false;
+  options.recursive = false;
+}
+
+// Relative paths are relative to the path as given, while parentPath is the
+// path as given for the top level and a joined path below it.
+{
+  const relativeRoot = path.relative(process.cwd(), root) + path.sep;
+  const paths = fs.readdirSync(relativeRoot, { recursive: true });
+  assert.deepStrictEqual(paths, expectedPaths);
+  const dirents = fs.readdirSync(relativeRoot, { recursive: true, withFileTypes: true });
+  assert.strictEqual(dirents[0].parentPath, relativeRoot);
+  const nested = dirents.find((dirent) => dirent.name === '1');
+  assert.strictEqual(nested.parentPath, path.join(relativeRoot, 'a'));
+}
+
+// Buffer encodings and Buffer paths.
+{
+  const buffers = fs.readdirSync(root, { recursive: true, encoding: 'buffer' });
+  assert(buffers.every((entry) => Buffer.isBuffer(entry)));
+  assert.deepStrictEqual(buffers.map(String), expectedPaths);
+
+  const stringify = (dirent) => ({
+    ...fromDirents([dirent])[0],
+    name: String(dirent.name),
+    parentPath: String(dirent.parentPath),
+  });
+  const dirents = fs.readdirSync(root, { recursive: true, encoding: 'buffer', withFileTypes: true });
+  assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name)));
+  assert(dirents.every((dirent) => dirent.parentPath === root || Buffer.isBuffer(dirent.parentPath)));
+  assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+
+  // A Buffer path keeps parentPath a Buffer, whatever the encoding.
+  const bufferRoot = Buffer.from(root);
+  assert.deepStrictEqual(fs.readdirSync(bufferRoot, { recursive: true }), expectedPaths);
+  const bufferDirents = fs.readdirSync(bufferRoot, { recursive: true, withFileTypes: true });
+  assert(bufferDirents.every((dirent) => typeof dirent.name === 'string'));
+  assert(bufferDirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+  assert.strictEqual(bufferDirents[0].parentPath, bufferRoot);
+  assert.deepStrictEqual(bufferDirents.map(stringify), expectedDirents);
+
+  fs.readdir(bufferRoot, { recursive: true }, common.mustSucceed((paths) => {
+    assert.deepStrictEqual(paths, expectedPaths);
+  }));
+  fs.readdir(bufferRoot, { recursive: true, withFileTypes: true, encoding: 'buffer' }, common.mustSucceed((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name) && Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, encoding: 'buffer' }).then(common.mustCall((paths) => {
+    assert.deepStrictEqual(paths.map(String), expectedPaths);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, withFileTypes: true }).then(common.mustCall((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+}
+
+// Errors carry the directory that failed, for the root and below it.
+{
+  const missing = path.join(root, 'missing');
+  assert.throws(() => fs.readdirSync(missing, { recursive: true }), {
+    code: 'ENOENT',
+    syscall: 'scandir',
+    path: missing,
+  });
+  const file = path.join(root, 'top');
+  assert.throws(() => fs.readdirSync(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  });
+  fs.readdir(missing, { recursive: true }, common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ENOENT');
+    assert.strictEqual(err.syscall, 'scandir');
+    assert.strictEqual(err.path, missing);
+  }));
+  assert.rejects(fs.promises.readdir(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  }).then(common.mustCall());
+}
+
+if (!common.isWindows && !common.isIBMi && process.getuid() !== 0) {
+  const locked = tmpdir.resolve('locked');
+  const inner = path.join(locked, 'inner');
+  fs.mkdirSync(inner, { recursive: true });
+  fs.chmodSync(inner, 0);
+  try {
+    assert.throws(() => fs.readdirSync(locked, { recursive: true }), {
+      code: 'EACCES',
+      syscall: 'scandir',
+      path: inner,
+    });
+    fs.readdir(locked, { recursive: true }, common.mustCall((err) => {
+      assert.strictEqual(err.code, 'EACCES');
+      assert.strictEqual(err.path, inner);
+      fs.chmodSync(inner, 0o755);
+    }));
+  } catch (err) {
+    fs.chmodSync(inner, 0o755);
+    throw err;
+  }
+}
diff --git a/test/known_issues/test-fs-readdir-recursive-with-buffer.js b/test/parallel/test-fs-readdir-recursive-with-buffer.js
similarity index 55%
rename from test/known_issues/test-fs-readdir-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-recursive-with-buffer.js
index c2eae8f428fe..e3e17de10f27 100644
--- a/test/known_issues/test-fs-readdir-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }, common.mustSucceed());
diff --git a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
similarity index 52%
rename from test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
index 0f60c290f15d..1ff966c3b7ea 100644
--- a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 require('../common');
@@ -11,5 +8,5 @@ require('../common');
 const { readdirSync } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdirSync(Buffer.from(testDirPath), { recursive: true });

From 6e7818e4f6d2d0429a2ebd441868af19bf7333d2 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Thu, 3 Sep 2026 01:33:37 +0200
Subject: [PATCH 022/202] sqlite: run backup completion in callback scope

Run SQLite backup after-work callbacks inside an internal callback
scope. This drains promise reactions and next ticks before the event
loop can become idle.

Add a child-process regression test where backup is the final active
request.

Assisted-by: Codex
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65666
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 src/node_sqlite.cc                           |  8 +++--
 test/fixtures/sqlite/backup-last-request.mjs | 34 ++++++++++++++++++++
 test/parallel/test-sqlite-backup.mjs         | 17 +++++++++-
 3 files changed, 56 insertions(+), 3 deletions(-)
 create mode 100644 test/fixtures/sqlite/backup-last-request.mjs

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 9ae07441917c..1af30e214253 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -635,9 +635,13 @@ class BackupJob : public ThreadPoolWork {
   }
 
   void AfterThreadPoolWork(int status) override {
-    HandleScope handle_scope(env()->isolate());
+    Isolate* isolate = env()->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env()->context());
+    InternalCallbackScope callback_scope(
+        env(), Object::New(isolate), {0, 0}, InternalCallbackScope::kNoFlags);
     Local<Promise::Resolver> resolver =
-        Local<Promise::Resolver>::New(env()->isolate(), resolver_);
+        Local<Promise::Resolver>::New(isolate, resolver_);
 
     if (!(backup_status_ == SQLITE_OK || backup_status_ == SQLITE_DONE ||
           backup_status_ == SQLITE_BUSY || backup_status_ == SQLITE_LOCKED)) {
diff --git a/test/fixtures/sqlite/backup-last-request.mjs b/test/fixtures/sqlite/backup-last-request.mjs
new file mode 100644
index 000000000000..91ad84e77ed5
--- /dev/null
+++ b/test/fixtures/sqlite/backup-last-request.mjs
@@ -0,0 +1,34 @@
+import { backup, DatabaseSync } from 'node:sqlite';
+
+const source = new DatabaseSync(':memory:');
+source.exec(`
+  CREATE TABLE data(value);
+  INSERT INTO data VALUES (zeroblob(1048576));
+`);
+
+let keepAlive = setInterval(() => {}, 1_000);
+let settled = false;
+
+process.once('beforeExit', () => {
+  if (!settled) {
+    process.stderr.write('backup promise did not settle before the event loop became idle\n');
+    process.exit(1);
+  }
+});
+
+backup(source, process.argv[2], {
+  rate: 1,
+  progress() {
+    if (keepAlive !== undefined) {
+      clearInterval(keepAlive);
+      keepAlive = undefined;
+    }
+  },
+}).then(() => {
+  settled = true;
+  source.close();
+}, (error) => {
+  settled = true;
+  process.stderr.write(`${error.stack ?? error}\n`);
+  process.exitCode = 1;
+});
diff --git a/test/parallel/test-sqlite-backup.mjs b/test/parallel/test-sqlite-backup.mjs
index d1e09569e1ca..f995ae3ca72a 100644
--- a/test/parallel/test-sqlite-backup.mjs
+++ b/test/parallel/test-sqlite-backup.mjs
@@ -1,5 +1,10 @@
 // Flags: --expose-gc
-import { isWindows, skipIfSQLiteMissing } from '../common/index.mjs';
+import {
+  isWindows,
+  skipIfSQLiteMissing,
+  spawnPromisified,
+} from '../common/index.mjs';
+import fixtures from '../common/fixtures.js';
 import tmpdir from '../common/tmpdir.js';
 import { join } from 'node:path';
 import { describe, test } from 'node:test';
@@ -364,3 +369,13 @@ test('source database is kept alive while a backup is in flight', async (t) => {
   const rows = backupDb.prepare('SELECT COUNT(*) AS n FROM data').get();
   t.assert.strictEqual(rows.n, 500);
 });
+
+test('backup promise settles when the backup is the last active request', async (t) => {
+  const { code, signal, stderr } = await spawnPromisified(process.execPath, [
+    fixtures.path('sqlite', 'backup-last-request.mjs'),
+    nextDb(),
+  ]);
+
+  t.assert.strictEqual(signal, null);
+  t.assert.strictEqual(code, 0, stderr);
+});

From b53ddc0daabba17604e7100726c1e233a5f7f15b Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Fri, 28 Aug 2026 00:15:38 -0300
Subject: [PATCH 023/202] vfs: fix rename over non-empty directory

The memory provider only rejected renames whose destination had a
different type than the source, so renaming a directory onto another
directory silently dropped the destination and everything under it.
An existing destination directory has to be empty; rename(2) reports
ENOTEMPTY otherwise, and RealFSProvider already does so because it
delegates to fs.renameSync().

Also, decrement nlink on a file that is replaced by a rename, and make
a rename whose two names resolve to the same entry a no-op, which
covers renaming one hard link onto another.

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65613
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/vfs/providers/memory.js          | 13 ++++
 .../test-vfs-memory-provider-dynamic.js       | 68 +++++++++++++------
 test/parallel/test-vfs-rename.js              | 64 +++++++++++++++++
 3 files changed, 123 insertions(+), 22 deletions(-)

diff --git a/lib/internal/vfs/providers/memory.js b/lib/internal/vfs/providers/memory.js
index acec5b4166b2..ce59a0611616 100644
--- a/lib/internal/vfs/providers/memory.js
+++ b/lib/internal/vfs/providers/memory.js
@@ -840,6 +840,10 @@ class MemoryProvider extends VirtualProvider {
 
     // Check if destination exists
     const existingDest = newParent.children.get(newName);
+    if (existingDest === entry) {
+      // Both names resolve to the same entry: rename does nothing
+      return;
+    }
     if (existingDest) {
       // Cannot overwrite a directory with a non-directory
       if (existingDest.isDirectory() && !entry.isDirectory()) {
@@ -849,6 +853,15 @@ class MemoryProvider extends VirtualProvider {
       if (!existingDest.isDirectory() && entry.isDirectory()) {
         throw createENOTDIR('rename', newPath);
       }
+      if (existingDest.isDirectory()) {
+        this.#ensurePopulated(existingDest, normalizedNew);
+        // Cannot overwrite a non-empty directory
+        if (existingDest.children.size > 0) {
+          throw createENOTEMPTY('rename', newPath);
+        }
+      } else {
+        existingDest.nlink--;
+      }
     }
 
     // Remove from old location (after destination validation)
diff --git a/test/parallel/test-vfs-memory-provider-dynamic.js b/test/parallel/test-vfs-memory-provider-dynamic.js
index 9ddd105a5a55..13ed609820e7 100644
--- a/test/parallel/test-vfs-memory-provider-dynamic.js
+++ b/test/parallel/test-vfs-memory-provider-dynamic.js
@@ -46,35 +46,43 @@ function makeFileEntry(prototypeFrom, contentProvider) {
   return fileEntry;
 }
 
-// ===== Lazy-populated directory =====
-{
-  const provider = new MemoryProvider();
-  const root = getRoot(provider);
-
-  const dir = {
-    __proto__: Object.getPrototypeOf(root),
+function makeDirEntry(prototypeFrom, populate) {
+  const t = Date.now();
+  const dirEntry = { __proto__: Object.getPrototypeOf(prototypeFrom) };
+  Object.assign(dirEntry, {
     type: 1,           // TYPE_DIR
     mode: 0o755,
     children: new Map(),
-    populate: (scoped) => {
-      scoped.addFile('hello.txt', 'lazy hello');
-      scoped.addFile('dyn.txt', () => 'dynamic-string');
-      scoped.addDirectory('subdir', null);
-      scoped.addSymlink('link.txt', '/lazy/hello.txt');
-    },
+    populate,
     populated: false,
     nlink: 1,
     uid: 0,
     gid: 0,
-  };
-  const t = Date.now();
-  dir.atime = t; dir.mtime = t; dir.ctime = t; dir.birthtime = t;
-  dir.isFile = root.isFile.bind(dir);
-  dir.isDirectory = root.isDirectory.bind(dir);
-  dir.isSymbolicLink = root.isSymbolicLink.bind(dir);
-  dir.isDynamic = root.isDynamic.bind(dir);
-  dir.getContentSync = root.getContentSync.bind(dir);
-  dir.getContentAsync = root.getContentAsync.bind(dir);
+    atime: t,
+    mtime: t,
+    ctime: t,
+    birthtime: t,
+  });
+  dirEntry.isFile = prototypeFrom.isFile.bind(dirEntry);
+  dirEntry.isDirectory = prototypeFrom.isDirectory.bind(dirEntry);
+  dirEntry.isSymbolicLink = prototypeFrom.isSymbolicLink.bind(dirEntry);
+  dirEntry.isDynamic = prototypeFrom.isDynamic.bind(dirEntry);
+  dirEntry.getContentSync = prototypeFrom.getContentSync.bind(dirEntry);
+  dirEntry.getContentAsync = prototypeFrom.getContentAsync.bind(dirEntry);
+  return dirEntry;
+}
+
+// ===== Lazy-populated directory =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+
+  const dir = makeDirEntry(root, (scoped) => {
+    scoped.addFile('hello.txt', 'lazy hello');
+    scoped.addFile('dyn.txt', () => 'dynamic-string');
+    scoped.addDirectory('subdir', null);
+    scoped.addSymlink('link.txt', '/lazy/hello.txt');
+  });
   root.children.set('lazy', dir);
 
   const myVfs = vfs.create(provider);
@@ -125,3 +133,19 @@ function makeFileEntry(prototypeFrom, contentProvider) {
     assert.strictEqual(s, 'async-only');
   }));
 }
+
+// ===== Renaming over a lazy directory does not discard its entries =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+  root.children.set('lazy', makeDirEntry(root, (scoped) => {
+    scoped.addFile('keep.txt', 'keep');
+  }));
+
+  const myVfs = vfs.create(provider);
+  myVfs.mkdirSync('/src');
+
+  assert.throws(() => myVfs.renameSync('/src', '/lazy'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+  assert.strictEqual(myVfs.readFileSync('/lazy/keep.txt', 'utf8'), 'keep');
+}
diff --git a/test/parallel/test-vfs-rename.js b/test/parallel/test-vfs-rename.js
index 69daba43c11d..b1ca98dc684e 100644
--- a/test/parallel/test-vfs-rename.js
+++ b/test/parallel/test-vfs-rename.js
@@ -58,3 +58,67 @@ const vfs = require('node:vfs');
   assert.strictEqual(myVfs.existsSync('/a/b/c'), false);
   assert.strictEqual(myVfs.readFileSync('/a/file.txt', 'utf8'), 'data');
 }
+
+// Renaming a directory onto a non-empty directory throws ENOTEMPTY
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.mkdirSync('/dst');
+  myVfs.writeFileSync('/dst/keep.txt', 'keep');
+
+  assert.throws(() => myVfs.renameSync('/src', '/dst'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.readFileSync('/dst/keep.txt', 'utf8'), 'keep');
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+}
+
+// Renaming a directory onto an empty directory succeeds
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.writeFileSync('/src/a.txt', 'a');
+  myVfs.mkdirSync('/dst');
+
+  myVfs.renameSync('/src', '/dst');
+  assert.strictEqual(myVfs.existsSync('/src'), false);
+  assert.strictEqual(myVfs.readFileSync('/dst/a.txt', 'utf8'), 'a');
+}
+
+// Overwriting a file drops one of its links
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.writeFileSync('/b.txt', 'b');
+  myVfs.linkSync('/b.txt', '/b-link.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 2);
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 1);
+  assert.strictEqual(myVfs.readFileSync('/b-link.txt', 'utf8'), 'b');
+}
+
+// Renaming a path onto itself is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.mkdirSync('/d');
+  myVfs.writeFileSync('/d/keep.txt', 'keep');
+
+  myVfs.renameSync('/a.txt', '/a.txt');
+  assert.strictEqual(myVfs.readFileSync('/a.txt', 'utf8'), 'a');
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 1);
+
+  myVfs.renameSync('/d', '/d');
+  assert.strictEqual(myVfs.readFileSync('/d/keep.txt', 'utf8'), 'keep');
+}
+
+// Renaming a hard link onto another link to the same file is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.linkSync('/a.txt', '/b.txt');
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.existsSync('/a.txt'), true);
+  assert.strictEqual(myVfs.existsSync('/b.txt'), true);
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 2);
+}

From 0a1a37ecbbd91e71165feef8dcedd021de556af1 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Thu, 3 Sep 2026 10:35:54 +0500
Subject: [PATCH 024/202] buffer: pad aligned allocations by a multiple of 8

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65605
Fixes: https://github.com/nodejs/node/issues/65601
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
---
 doc/api/buffer.md                            |  5 +++--
 lib/buffer.js                                | 13 +++++++------
 lib/internal/buffer.js                       | 20 +++++++++++++++-----
 src/node_buffer.cc                           |  6 +++---
 test/parallel/test-buffer-alloc-alignment.js | 18 ++++++++++++++++++
 5 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index c4369716c6f9..a78254919ff9 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5690,8 +5690,9 @@ since the extra bytes are not free.
 
 Because the address of a `Buffer`'s memory cannot be chosen directly, extra bytes
 have to be allocated or skipped to reach an aligned address.
-[`Buffer.allocUnsafeSlow()`][] over-allocates up to `alignment - 1` bytes and
-positions the returned `Buffer` at the first suitably aligned byte within them.
+[`Buffer.allocUnsafeSlow()`][] over-allocates `alignment` bytes, or 8 when
+`alignment` is smaller than that, and positions the returned `Buffer` at the
+first suitably aligned byte within them.
 [`Buffer.allocUnsafe()`][] instead pads its offset into the shared internal pool,
 whose start is always aligned to 64 bytes, and only falls back to an allocation
 of its own when `alignment` is larger than that. Either way,
diff --git a/lib/buffer.js b/lib/buffer.js
index 19574064ad12..7b0e37239abb 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -141,6 +141,7 @@ const {
   addBufferPrototypeMethods,
   createUnsafeBuffer,
   createUnsafeAlignedBuffer,
+  alignmentPadding,
   asciiWrite,
   latin1Write,
   utf8Write,
@@ -482,9 +483,9 @@ Buffer.allocUnsafe = function allocUnsafe(size, alignment) {
  *
  * If `alignment` is given, the memory backing the returned buffer starts at an
  * address that is a multiple of `alignment`, which is required by e.g. reads
- * and writes on file descriptors opened with `O_DIRECT`. Note that up to
- * `alignment - 1` extra bytes are allocated to satisfy the request, and that
- * the returned buffer's `byteOffset` is therefore usually non-zero.
+ * and writes on file descriptors opened with `O_DIRECT`. Note that at least
+ * `alignment` extra bytes are allocated to satisfy the request, and that the
+ * returned buffer's `byteOffset` is therefore usually non-zero.
  * @param {number} size
  * @param {number} [alignment] A power of two, at most 2 ** 30
  * @returns {FastBuffer}
@@ -504,10 +505,10 @@ function validateAlignment(size, alignment) {
     throw new ERR_INVALID_ARG_VALUE(
       'alignment', alignment, 'must be a power of two');
   }
-  // Satisfying the alignment costs up to `alignment - 1` extra bytes.
-  if (size > kMaxLength - (alignment - 1)) {
+  const padding = alignmentPadding(alignment);
+  if (size > kMaxLength - padding) {
     throw new ERR_OUT_OF_RANGE(
-      'size', `<= ${kMaxLength - (alignment - 1)}`, size);
+      'size', `<= ${kMaxLength - padding}`, size);
   }
 }
 
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 5977bdf23768..325df6ca01ad 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -5,6 +5,7 @@ const {
   Float32Array,
   Float64Array,
   MathFloor,
+  MathMax,
   Number,
   Symbol,
   Uint8Array,
@@ -1114,24 +1115,33 @@ function createUnsafeBuffer(size) {
   return new FastBuffer(createUnsafeArrayBuffer(size));
 }
 
+// Reaching an aligned address needs at most `alignment - 1` extra bytes, but a
+// multiple of 8 is padded instead. Backing store addresses are 8 byte aligned
+// too, so the bytes left over after the buffer then remain a whole number of
+// elements of any typed array created over its ArrayBuffer.
+function alignmentPadding(alignment) {
+  return MathMax(alignment, 8);
+}
+
 // Returns an uninitialized buffer of `size` bytes whose first byte is located at
 // a memory address that is a multiple of `alignment`. `alignment` must be a
-// power of two, and `size + alignment - 1` must not exceed the maximum buffer
-// length. Since the address of a backing store cannot be chosen, `alignment - 1`
-// extra bytes are allocated and skipped, which leaves the returned buffer with a
-// non-zero `byteOffset` into a larger ArrayBuffer.
+// power of two, and `size` plus its padding must not exceed the maximum buffer
+// length. Since the address of a backing store cannot be chosen, that padding is
+// allocated and skipped, which leaves the returned buffer with a non-zero
+// `byteOffset` into a larger ArrayBuffer.
 function createUnsafeAlignedBuffer(size, alignment) {
   if (size === 0) {
     return new FastBuffer();
   }
 
-  const ab = createUnsafeArrayBuffer(size + alignment - 1);
+  const ab = createUnsafeArrayBuffer(size + alignmentPadding(alignment));
   return new FastBuffer(ab, arrayBufferAlignedOffset(ab, alignment), size);
 }
 
 module.exports = {
   FastBuffer,
   addBufferPrototypeMethods,
+  alignmentPadding,
   markAsUntransferable,
   isMarkedAsUntransferable,
   createUnsafeBuffer,
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index a0453800d84a..1093b73e6838 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -1661,9 +1661,9 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
 // Returns the offset of the first byte of `arrayBuffer` that is located at a
 // memory address which is a multiple of `alignment`. V8 does not let us choose
 // the address of a backing store, so an aligned view is obtained by
-// over-allocating `alignment - 1` bytes and skipping to that offset. The
-// backing store of a non-resizable ArrayBuffer never moves, so the offset stays
-// aligned for the lifetime of the ArrayBuffer.
+// over-allocating and skipping to that offset. The backing store of a
+// non-resizable ArrayBuffer never moves, so the offset stays aligned for the
+// lifetime of the ArrayBuffer.
 void ArrayBufferAlignedOffset(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 2);
diff --git a/test/parallel/test-buffer-alloc-alignment.js b/test/parallel/test-buffer-alloc-alignment.js
index a1a3890ddc20..a55c3fe5fba8 100644
--- a/test/parallel/test-buffer-alloc-alignment.js
+++ b/test/parallel/test-buffer-alloc-alignment.js
@@ -111,6 +111,24 @@ for (const alloc of [Buffer.allocUnsafe, Buffer.allocUnsafeSlow]) {
   assert.strictEqual(buf.buffer.byteLength, 100);
 }
 
+// The padding an aligned allocation needs does not leave a partial element
+// behind it, so a typed array view running from the buffer to the end of its
+// ArrayBuffer can be created without an explicit length.
+{
+  const bufs = [Buffer.allocUnsafe(8), Buffer.allocUnsafeSlow(4096, 4096)];
+  for (const alignment of alignments) {
+    bufs.push(Buffer.allocUnsafe(8, alignment),
+              Buffer.allocUnsafeSlow(8, alignment));
+  }
+  for (const buf of bufs) {
+    const rest = buf.buffer.byteLength - buf.byteOffset;
+    assert.strictEqual(new BigUint64Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+    assert.strictEqual(new Uint32Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+  }
+}
+
 // Buffer.allocUnsafeSlow() is never pooled, even when aligned.
 {
   const a = Buffer.allocUnsafeSlow(64, 64);

From 144e679de4accad948b520dabcee5bee372b2ac9 Mon Sep 17 00:00:00 2001
From: Yusuke Hayashi <yusuke8h@gmail.com>
Date: Thu, 3 Sep 2026 14:36:15 +0900
Subject: [PATCH 025/202] fs: apply nocase to literal glob exclude patterns

On case-insensitive platforms include patterns match entries
regardless of case, but literal (non-magic) exclude patterns were
matched case-sensitively because exclude matchers are created with
nocaseMagicOnly. Exclusion is a pure string match with no filesystem
lookups, so disable nocaseMagicOnly for exclude matchers.

Fixes: https://github.com/nodejs/node/issues/58991
Refs: https://github.com/nodejs/node/pull/63446
Signed-off-by: Yusuke Hayashi <yusuke8h@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64817
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/fs/glob.js        |  5 ++++-
 test/parallel/test-fs-glob.mjs | 28 ++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index a949303b58bd..b5949c471813 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -664,7 +664,10 @@ class Glob {
         // consistent comparison before instantiating matchers.
         const matchers = exclude
           .map((pattern) => resolve(this.#root, pattern))
-          .map((pattern) => createMatcher(pattern));
+          // Exclude matching is a pure string comparison with no filesystem
+          // lookups, so unlike include patterns, literal patterns must also
+          // match case-insensitively on case-insensitive platforms.
+          .map((pattern) => createMatcher(pattern, { nocaseMagicOnly: false }));
         this.#isExcluded = (value) =>
           matchers.some((matcher) => matcher.match(value));
         this.#results.setup(this.#root, this.#isExcluded);
diff --git a/test/parallel/test-fs-glob.mjs b/test/parallel/test-fs-glob.mjs
index 692f11716d55..ed7317508087 100644
--- a/test/parallel/test-fs-glob.mjs
+++ b/test/parallel/test-fs-glob.mjs
@@ -983,3 +983,31 @@ describe('glob - seen cache', function() {
     );
   });
 });
+
+// gh-58991: exclude patterns must apply the same case-sensitivity as include
+// patterns. On case-insensitive filesystems include patterns match entries
+// regardless of case, so literal exclude patterns must match that behavior.
+const skipCaseTests = { skip: !common.isWindows && !common.isMacOS };
+describe('glob - exclude case-insensitive consistency', skipCaseTests, function() {
+  test('literal exclude ignores case (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude matches differently-cased results (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('A/b', { cwd: fixtureDir, exclude: ['a/b'] }), []);
+  });
+  test('literal exclude ignores case (async)', async () => {
+    const promisified = promisify(glob);
+    assert.deepStrictEqual(
+      await promisified('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude ignores case (promise)', async () => {
+    const actual = [];
+    for await (const entry of asyncGlob(
+      'a/b', { cwd: fixtureDir, exclude: ['A/B'] })) {
+      actual.push(entry);
+    }
+    assert.deepStrictEqual(actual, []);
+  });
+});

From e91db8b6f9f2e4424ad7e944f3d744d32f055c3f Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Thu, 3 Sep 2026 10:43:14 +0200
Subject: [PATCH 026/202] fs: handle recursive watch setup races

Arm directory watchers before reading entries to close the setup
window. Discard stale watcher state when paths disappear so recreated
paths can be watched again.

On AIX, treat ENODEV as missing only when stat confirms the path is
gone. Preserve root throwIfNoEntry behavior and other watch errors.

Fixes: https://github.com/nodejs/node/issues/65697

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/65699
Fixes: https://github.com/nodejs/node/issues/65697
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 lib/internal/fs/recursive_watch.js            | 89 ++++++++++++++-----
 test/parallel/parallel.status                 |  2 -
 ...atch-recursive-aix-preserve-watch-error.js | 53 +++++++++++
 ...-retry-directory-disappears-before-read.js | 54 +++++++++++
 ...retry-directory-disappears-before-watch.js | 66 ++++++++++++++
 ...h-recursive-root-disappears-before-read.js | 37 ++++++++
 ...e-root-disappears-before-watch-no-throw.js | 40 +++++++++
 ...-recursive-root-disappears-before-watch.js | 46 ++++++++++
 ...st-fs-watch-recursive-watch-before-read.js | 42 +++++++++
 9 files changed, 407 insertions(+), 22 deletions(-)
 create mode 100644 test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
 create mode 100644 test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
 create mode 100644 test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
 create mode 100644 test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
 create mode 100644 test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
 create mode 100644 test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
 create mode 100644 test/parallel/test-fs-watch-recursive-watch-before-read.js

diff --git a/lib/internal/fs/recursive_watch.js b/lib/internal/fs/recursive_watch.js
index c01f1807cc8f..85d84f9dd8f3 100644
--- a/lib/internal/fs/recursive_watch.js
+++ b/lib/internal/fs/recursive_watch.js
@@ -37,6 +37,24 @@ function lazyLoadFsSync() {
 
 let kResistStopPropagation;
 
+const kIsAIX = process.platform === 'aix';
+
+function isPathMissingForWatch(error, file) {
+  if (error.code === 'ENOENT') {
+    return true;
+  }
+  // AIX reports ENODEV when the path disappears before fs.watch() starts.
+  // Check that it is actually gone so other ENODEV errors still propagate.
+  if (!kIsAIX || error.code !== 'ENODEV') {
+    return false;
+  }
+  try {
+    return lazyLoadFsSync().statSync(file, { throwIfNoEntry: false }) === undefined;
+  } catch {
+    return false;
+  }
+}
+
 // Inotify reports changes to a directory's entries, with their names, on the
 // directory's own watch, so one watcher per directory is enough on Linux.
 // kqueue and event ports only report that the directory itself changed, so
@@ -116,56 +134,81 @@ class FSWatcher extends EventEmitter {
   }
 
   #forget(file) {
+    const watcher = this.#watchers.get(file);
+    if (watcher !== undefined) {
+      watcher.close();
+      this.#watchers.delete(file);
+    }
+    this.#entries.delete(file);
+    this.#symbolicLinks.delete(file);
+
     const childPrefix = file + pathSep;
     for (const entry of this.#entries) {
-      if (entry === file || StringPrototypeStartsWith(entry, childPrefix)) {
+      if (StringPrototypeStartsWith(entry, childPrefix)) {
         this.#entries.delete(entry);
         this.#symbolicLinks.delete(entry);
-        const watcher = this.#watchers.get(entry);
-        if (watcher !== undefined) {
-          watcher.close();
+        const childWatcher = this.#watchers.get(entry);
+        if (childWatcher !== undefined) {
+          childWatcher.close();
           this.#watchers.delete(entry);
         }
       }
     }
   }
 
-  // An entry that vanished between being listed and being watched is left to
-  // the directory's own watcher to report.
+  // Report an entry that vanished between being listed and being watched so
+  // the caller can discard its stale bookkeeping.
   #watch(file, onChange) {
-    if (this.#closed || this.#watchers.has(file)) {
-      return;
+    if (this.#closed) {
+      return false;
+    }
+    if (this.#watchers.has(file)) {
+      return true;
     }
     const { watch } = lazyLoadFsSync();
     let watcher;
     try {
       watcher = watch(file, { persistent: this.#options.persistent }, onChange);
     } catch (err) {
-      if (err.code === 'ENOENT') {
-        return;
+      if (isPathMissingForWatch(err, file) &&
+          (file !== this.#rootPath || !this.#options.throwIfNoEntry)) {
+        return false;
       }
       throw err;
     }
     this.#watchers.set(file, watcher);
+    return true;
   }
 
-  // Registers the entries of `folder` that are not known yet (emitting
-  // 'rename' for them unless this is the initial scan) and arms one watcher
-  // for the directory; #addEntry() descends into subdirectories.
+  // Arms one watcher for `folder`, then registers entries that are not known
+  // yet (emitting 'rename' for them unless this is the initial scan);
+  // #addEntry() descends into subdirectories.
   #scanFolder(folder, initial) {
+    if (!this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename))) {
+      this.#forget(folder);
+      return;
+    }
+
     const { readdirSync } = lazyLoadFsSync();
     let entries;
     try {
       entries = readdirSync(folder, { withFileTypes: true });
     } catch (error) {
-      if (error.code !== 'ENOENT') {
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+        if (folder === this.#rootPath && initial &&
+            (error.code !== 'ENOENT' || this.#options.throwIfNoEntry)) {
+          throw error;
+        }
+        if (!initial && !this.#closed) {
+          this.#emit('rename', folder);
+        }
+        this.#forget(folder);
+      } else {
         this.emit('error', error);
       }
       return;
     }
 
-    this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename));
-
     for (const entry of entries) {
       if (this.#closed) {
         break;
@@ -187,11 +230,15 @@ class FSWatcher extends EventEmitter {
       // The link target is watched so that changes behind the link surface
       // as a 'rename' of the link, as they always have on this code path.
       this.#symbolicLinks.add(file);
-      this.#watch(file, () => this.#emit('rename', file));
+      if (!this.#watch(file, () => this.#emit('rename', file))) {
+        this.#forget(file);
+      }
     } else if (entry.isDirectory()) {
       this.#scanFolder(file, initial);
     } else if (!kDirectoryWatchReportsEntries) {
-      this.#watch(file, () => this.#onEntryEvent(file));
+      if (!this.#watch(file, () => this.#onEntryEvent(file))) {
+        this.#forget(file);
+      }
     }
   }
 
@@ -253,7 +300,7 @@ class FSWatcher extends EventEmitter {
   #watchRootFile(file) {
     const { statSync } = lazyLoadFsSync();
     this.#entries.add(file);
-    this.#watch(file, () => {
+    if (!this.#watch(file, () => {
       if (this.#closed) {
         return;
       }
@@ -263,7 +310,9 @@ class FSWatcher extends EventEmitter {
       } else {
         this.emit('change', 'change', pathBasename(file));
       }
-    });
+    })) {
+      this.#forget(file);
+    }
   }
 
   [kFSWatchStart](filename) {
diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
index 5f45d1ecdccd..bffe32296911 100644
--- a/test/parallel/parallel.status
+++ b/test/parallel/parallel.status
@@ -105,8 +105,6 @@ test-fs-watch-ignore-regexp: SKIP
 test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/54346
 test-esm-loader-hooks-inspect-wait: PASS, FLAKY
-# https://github.com/nodejs/node/issues/65697
-test-fs-watch-recursive-delete-race: SKIP
 
 [$system==ibmi]
 # https://github.com/nodejs/node/pull/30819
diff --git a/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
new file mode 100644
index 000000000000..2573f582a312
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
@@ -0,0 +1,53 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.isAIX)
+  common.skip('AIX-specific ENODEV handling');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('preserve-watch-error');
+const originalStatSync = fs.statSync;
+const originalWatch = fs.watch;
+const expected = new Error('watch failed');
+const verificationError = new Error('stat failed');
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+const failVerification = common.mustCall(() => {
+  throw verificationError;
+});
+
+expected.code = 'ENODEV';
+verificationError.code = 'EIO';
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  throw expected;
+});
+fs.statSync = (filename, options) => {
+  if (filename === directory && options?.throwIfNoEntry === false) {
+    return failVerification();
+  }
+  return Reflect.apply(originalStatSync, fs, [filename, options]);
+};
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.statSync = originalStatSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
new file mode 100644
index 000000000000..b91dbe625aeb
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
@@ -0,0 +1,54 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-read');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let staleWatcherCloseCalls = 0;
+
+fs.mkdirSync(child, { recursive: true });
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    return { close: () => staleWatcherCloseCalls++ };
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.strictEqual(staleWatcherCloseCalls, 1);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
new file mode 100644
index 000000000000..8f570180a855
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
@@ -0,0 +1,66 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-watch');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const changes = [];
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let watchError;
+
+fs.mkdirSync(child, { recursive: true });
+watcher.on('change', (eventType, filename) => changes.push([eventType, filename]));
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    try {
+      return Reflect.apply(originalWatch, fs, [filename, options, listener]);
+    } catch (error) {
+      watchError = error;
+      throw error;
+    }
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+  assert.deepStrictEqual(changes, [['rename', 'child']]);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
new file mode 100644
index 000000000000..7692c86a3abe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
@@ -0,0 +1,37 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-read');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let closeCalls = 0;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  return { close: () => closeCalls++ };
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    {
+      code: 'ENOENT',
+      filename: directory,
+    },
+  );
+  assert.strictEqual(closeCalls, 1);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
new file mode 100644
index 000000000000..c43f3e275184
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
@@ -0,0 +1,40 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch-no-throw');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
new file mode 100644
index 000000000000..917489004650
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
@@ -0,0 +1,46 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, watchError);
+      assert.match(error.code, /^(ENOENT|ENODEV)$/);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-watch-before-read.js b/test/parallel/test-fs-watch-recursive-watch-before-read.js
new file mode 100644
index 000000000000..4faeb5b8efbe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-watch-before-read.js
@@ -0,0 +1,42 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('watch-before-read');
+const originalReaddirSync = fs.readdirSync;
+const originalWatch = fs.watch;
+const operations = [];
+const watcher = new FSWatcher({ recursive: true });
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  operations.push('watch');
+  return createWatcher();
+});
+fs.readdirSync = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  operations.push('read');
+  return Reflect.apply(originalReaddirSync, fs, [filename, ...args]);
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.deepStrictEqual(operations, ['watch', 'read']);
+} finally {
+  watcher.close();
+  fs.readdirSync = originalReaddirSync;
+  fs.watch = originalWatch;
+}

From 2aad7789408a5b4a18342da11880e0dce3b404f0 Mon Sep 17 00:00:00 2001
From: Abdirahim Musse <33973272+abmusse@users.noreply.github.com>
Date: Wed, 19 Aug 2026 07:03:28 -0500
Subject: [PATCH 027/202] test: set type=none on IBM i for empty source

addon targets.

openssl-binding, openssl-get-ssl-ctx,
openssl-providers, and zlib-binding all exclude
their sources on IBM i because the platform ships
OpenSSL and zlib as system libraries.
The binding.gyp condition leaves the target with
no sources but still of type 'loadable_module',
which causes gyp to generate a full solink_module
COPY rule in the generated Makefile.

With gcc-12, the compiler exits 1 on empty input
so gmake stops at the link step and
build_addons.py skips the addon non fatally. With
clang-21, the compiler exits 0 on empty input and
writes no output file. The linker driver then
runs llvm-nm internally as a post-link step to
generate the .exp symbol export file, finds no
output and aborts with:

  llvm-nm: error: a.out: No such file or directory

The fix is to declare the target as type
'none' when on IBM i. The gyp make generator
produces only a touch-stamp rule for 'none'
targets no solink_module, no COPY, no .node
output is ever expected. build_addons.py sees
exit 0 and run-ci continues.

Signed-off-by: Abdirahim Musse <33973272+abmusse@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65545
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
---
 test/addons/openssl-binding/binding.gyp     | 3 +++
 test/addons/openssl-get-ssl-ctx/binding.gyp | 3 +++
 test/addons/openssl-providers/binding.gyp   | 3 +++
 test/addons/zlib-binding/binding.gyp        | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/test/addons/openssl-binding/binding.gyp b/test/addons/openssl-binding/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-binding/binding.gyp
+++ b/test/addons/openssl-binding/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-get-ssl-ctx/binding.gyp b/test/addons/openssl-get-ssl-ctx/binding.gyp
index 46a558e12030..a405ba25bbe7 100644
--- a/test/addons/openssl-get-ssl-ctx/binding.gyp
+++ b/test/addons/openssl-get-ssl-ctx/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/binding.gyp b/test/addons/openssl-providers/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-providers/binding.gyp
+++ b/test/addons/openssl-providers/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/zlib-binding/binding.gyp b/test/addons/zlib-binding/binding.gyp
index f6a822d47e9c..5bd4f999218b 100644
--- a/test/addons/zlib-binding/binding.gyp
+++ b/test/addons/zlib-binding/binding.gyp
@@ -9,6 +9,9 @@
             'aix_variant_name': '<!(uname -s)',
           },
           'conditions': [
+            [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+              'type': 'none',
+            }],
             [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
               'sources': ['binding.cc'],
               'include_dirs': ['../../../deps/zlib'],

From 99b39ab8c84517050cb1f0e04fc6518953e69007 Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:30:21 +0100
Subject: [PATCH 028/202] test: fix flaky cleanup in http2 test

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65701
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/parallel/test-http2-bidirectional-write-deadlock.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-http2-bidirectional-write-deadlock.js b/test/parallel/test-http2-bidirectional-write-deadlock.js
index 9dd4b91c5234..306dce021cb0 100644
--- a/test/parallel/test-http2-bidirectional-write-deadlock.js
+++ b/test/parallel/test-http2-bidirectional-write-deadlock.js
@@ -38,6 +38,7 @@ class StalledClientSocket extends Duplex {
     super();
     this.inner = net.connect(port, common.localhostIPv4);
     this.inner.on('data', (chunk) => this.push(chunk));
+    this.inner.on('end', () => this.push(null));
   }
   _read() {
     // Incoming data is pushed as it arrives.
@@ -54,7 +55,7 @@ class StalledClientSocket extends Duplex {
     callback();
   }
   _final(callback) {
-    callback();
+    this.inner.end(callback);
   }
   _destroy(err, callback) {
     this.inner.destroy();
@@ -101,7 +102,8 @@ server.listen(0, common.mustCall(() => {
     stallWrites = false;
     for (const callback of heldCallbacks) callback();
 
-    client.destroy();
+    req.end();
+    client.close();
     server.close();
   }));
 }));

From e1f90733bb8189b52bb43a91fd7d744a1f5ddc26 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 3 Sep 2026 11:30:31 +0200
Subject: [PATCH 029/202] tools: do not flag force push as invalid message

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65700
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
---
 .github/workflows/notify-on-push.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index e709df93a8d7..3c7b21752138 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -32,6 +32,9 @@ jobs:
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
   validateCommitMessage:
+    # If a commit is force-pushed out of the main branch, the `commits` array is
+    # empty and there are no checks to run.
+    if: github.event.commits[0]
     name: Notify on Push on `main` with invalid message
     # cannot use ubuntu-slim here because rtCamp/action-slack-notify is dockerized
     runs-on: ubuntu-24.04-arm

From 6071f8bc32d95b7c9245f4048956f029760fc86d Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Thu, 6 Aug 2026 08:48:08 +0000
Subject: [PATCH 030/202] domain: runtime-deprecate the module

Promote DEP0032 from a documentation-only deprecation to a runtime
deprecation. Loading the `node:domain` module now emits a
DeprecationWarning with code DEP0032, and the docs are updated to
reflect the Runtime deprecation type.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65074
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 doc/api/deprecations.md                       |  8 ++++++--
 doc/api/domain.md                             | 15 +++++++++------
 lib/domain.js                                 |  8 +++++++-
 test/parallel/test-domain-deprecation.js      | 12 ++++++++++++
 test/parallel/test-domain-http-server.js      |  2 ++
 test/parallel/test-domain-implicit-binding.js |  2 ++
 test/parallel/test-domain-implicit-fs.js      |  2 ++
 test/parallel/test-domain-multi.js            |  2 ++
 test/parallel/test-domain-promise.js          |  2 ++
 9 files changed, 44 insertions(+), 9 deletions(-)
 create mode 100644 test/parallel/test-domain-deprecation.js

diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 10fa3964372f..e63ea5f35957 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -774,6 +774,9 @@ the API is not useful.
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65074
+    description: Runtime deprecation.
   - version:
     - v6.12.0
     - v4.8.6
@@ -784,9 +787,10 @@ changes:
     description: Documentation-only deprecation.
 -->
 
-Type: Documentation-only
+Type: Runtime
 
-The [`domain`][] module is deprecated and should not be used.
+The [`domain`][] module is deprecated and should not be used. Loading the
+module emits a runtime deprecation warning.
 
 ### DEP0033: `EventEmitter.listenerCount()`
 
diff --git a/doc/api/domain.md b/doc/api/domain.md
index 4838d4d4a7ef..af0613e16b9a 100644
--- a/doc/api/domain.md
+++ b/doc/api/domain.md
@@ -3,6 +3,10 @@
 <!-- YAML
 deprecated: v1.4.2
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65074
+    description: Loading the module now emits a runtime deprecation warning
+                 (`DEP0032`).
   - version: v8.8.0
     pr-url: https://github.com/nodejs/node/pull/15695
     description: Any `Promise`s created in VM contexts no longer have a
@@ -21,12 +25,11 @@ changes:
 
 <!-- source_link=lib/domain.js -->
 
-**This module is pending deprecation.** Once a replacement API has been
-finalized, this module will be fully deprecated. Most developers should
-**not** have cause to use this module. Users who absolutely must have
-the functionality that domains provide may rely on it for the time being
-but should expect to have to migrate to a different solution
-in the future.
+**This module is deprecated and should not be used.** Loading the module emits
+a runtime deprecation warning (`DEP0032`). Most developers should **not** have
+cause to use this module. Users who absolutely must have the functionality
+that domains provide may rely on it for the time being but should expect to
+have to migrate to a different solution in the future.
 
 Domains provide a way to handle multiple different IO operations as a
 single group. If any of the event emitters or callbacks registered to a
diff --git a/lib/domain.js b/lib/domain.js
index cbd2b2bcd9b0..caf97983b8f8 100644
--- a/lib/domain.js
+++ b/lib/domain.js
@@ -21,8 +21,9 @@
 
 'use strict';
 
-// WARNING: THIS MODULE IS PENDING DEPRECATION.
+// WARNING: THIS MODULE IS DEPRECATED (DEP0032).
 //
+// Loading this module emits a runtime deprecation warning.
 // No new pull requests targeting this module will be accepted
 // unless they address existing, critical bugs.
 
@@ -44,6 +45,11 @@ const {
   ERR_UNHANDLED_ERROR,
 } = require('internal/errors').codes;
 
+// The `domain` module is deprecated (DEP0032). Emit a runtime deprecation
+// warning when the module is loaded.
+process.emitWarning('The `domain` module is deprecated and should not be used.',
+                    'DeprecationWarning', 'DEP0032');
+
 // Use AsyncLocalStorage for domain context propagation
 // Lazy initialization - ALS is created on first domain use
 let domainStorage;
diff --git a/test/parallel/test-domain-deprecation.js b/test/parallel/test-domain-deprecation.js
new file mode 100644
index 000000000000..48b4df6b238f
--- /dev/null
+++ b/test/parallel/test-domain-deprecation.js
@@ -0,0 +1,12 @@
+'use strict';
+const common = require('../common');
+
+const domainWarning =
+  'The `domain` module is deprecated and should not be used.';
+common.expectWarning('DeprecationWarning', domainWarning, 'DEP0032');
+
+const domain = require('domain');
+const assert = require('assert');
+
+assert.strictEqual(typeof domain.create, 'function');
+assert.strictEqual(typeof domain.Domain, 'function');
diff --git a/test/parallel/test-domain-http-server.js b/test/parallel/test-domain-http-server.js
index 160241d569b1..6555a58f305e 100644
--- a/test/parallel/test-domain-http-server.js
+++ b/test/parallel/test-domain-http-server.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 // Copyright Joyent, Inc. and other Node contributors.
 //
 // Permission is hereby granted, free of charge, to any person obtaining a
diff --git a/test/parallel/test-domain-implicit-binding.js b/test/parallel/test-domain-implicit-binding.js
index 9f119a420368..84c140a1d77e 100644
--- a/test/parallel/test-domain-implicit-binding.js
+++ b/test/parallel/test-domain-implicit-binding.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 'use strict';
 
 const common = require('../common');
diff --git a/test/parallel/test-domain-implicit-fs.js b/test/parallel/test-domain-implicit-fs.js
index abb4e89f085d..6e3a1cf68ab4 100644
--- a/test/parallel/test-domain-implicit-fs.js
+++ b/test/parallel/test-domain-implicit-fs.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 // Copyright Joyent, Inc. and other Node contributors.
 //
 // Permission is hereby granted, free of charge, to any person obtaining a
diff --git a/test/parallel/test-domain-multi.js b/test/parallel/test-domain-multi.js
index 635208acac3c..6dc470e4bf4a 100644
--- a/test/parallel/test-domain-multi.js
+++ b/test/parallel/test-domain-multi.js
@@ -19,6 +19,8 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+// Flags: --no-deprecation
+
 'use strict';
 // Tests of multiple domains happening at once.
 
diff --git a/test/parallel/test-domain-promise.js b/test/parallel/test-domain-promise.js
index 7b1796d84fea..b96a4cd64a4c 100644
--- a/test/parallel/test-domain-promise.js
+++ b/test/parallel/test-domain-promise.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 'use strict';
 const common = require('../common');
 const assert = require('assert');

From 82c252172d24ed8603550bb712ae1d13502c2d18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Olivier=20Fl=C3=BCckiger?= <olivf@chromium.org>
Date: Tue, 18 Aug 2026 12:45:52 +0000
Subject: [PATCH 031/202] deps: V8: backport f3d4d458fe59
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original commit message:

    [cleanup] Remove --js-float16array

    Remove the --js-float16array flag and incorporate Float16Array into the
    standard typed array macros and baseline snapshot unconditionally.
    Float16Array has been shipping by default since M138.

    Bug: 548385945
    TAG=agy
    CONV=052f499d-4ee5-4a10-8afd-900ba4a338db

    Change-Id: I2c0012158febf422fdc1b866b9414f3f040e83ad
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8264275
    Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
    Auto-Submit: Olivier Flückiger <olivf@chromium.org>
    Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#109335}

Refs: https://github.com/v8/v8/commit/f3d4d458fe597b7c949c78f192a87f9d804c9520
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65702
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
---
 common.gypi                                   |  2 +-
 deps/v8/src/api/api.cc                        | 56 -------------------
 deps/v8/src/builtins/builtins.cc              |  6 --
 deps/v8/src/flags/flag-definitions.h          |  2 -
 deps/v8/src/init/bootstrapper.cc              | 39 ++-----------
 deps/v8/src/objects/elements-kind.h           | 31 +++-------
 deps/v8/src/objects/value-serializer.cc       |  7 ---
 .../cctest/test-inobject-slack-tracking.cc    |  1 -
 deps/v8/test/cctest/test-typedarrays.cc       |  4 --
 deps/v8/test/test262/testcfg.py               |  1 -
 .../test/unittests/objects/object-unittest.cc |  3 -
 .../objects/value-serializer-unittest.cc      |  4 --
 12 files changed, 16 insertions(+), 140 deletions(-)

diff --git a/common.gypi b/common.gypi
index a83523286a91..a982da03f78b 100644
--- a/common.gypi
+++ b/common.gypi
@@ -42,7 +42,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.28',
+    'v8_embedder_string': '-node.29',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index fbd628370c0b..48da5b35b872 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -3741,14 +3741,6 @@ bool Value::IsTypedArray() const {
 TYPED_ARRAYS_BASE(VALUE_IS_TYPED_ARRAY)
 #undef VALUE_IS_TYPED_ARRAY
 
-bool Value::IsFloat16Array() const {
-  auto obj = *Utils::OpenDirectHandle(this);
-  return i::IsJSTypedArray(obj) &&
-         i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array &&
-         Utils::ApiCheck(i::v8_flags.js_float16array, "Value::IsFloat16Array",
-                         "Float16Array is not supported");
-}
-
 bool Value::IsDataView() const {
   auto obj = *Utils::OpenDirectHandle(this);
   return IsJSDataView(obj) || IsJSRabGsabDataView(obj);
@@ -4292,16 +4284,6 @@ void v8::TypedArray::CheckCast(Value* that) {
 TYPED_ARRAYS_BASE(CHECK_TYPED_ARRAY_CAST)
 #undef CHECK_TYPED_ARRAY_CAST
 
-void v8::Float16Array::CheckCast(Value* that) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::Cast",
-                  "Float16Array is not supported");
-  auto obj = *Utils::OpenDirectHandle(that);
-  Utils::ApiCheck(
-      i::IsJSTypedArray(obj) &&
-          i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array,
-      "v8::Float16Array::Cast()", "Value is not a Float16Array");
-}
-
 void v8::DataView::CheckCast(Value* that) {
   auto obj = *Utils::OpenDirectHandle(that);
   Utils::ApiCheck(i::IsJSDataView(obj) || IsJSRabGsabDataView(obj),
@@ -9347,44 +9329,6 @@ static_assert(v8::TypedArray::kMaxByteLength == i::JSTypedArray::kMaxByteLength,
 TYPED_ARRAYS_BASE(TYPED_ARRAY_NEW)
 #undef TYPED_ARRAY_NEW
 
-Local<Float16Array> Float16Array::New(Local<ArrayBuffer> array_buffer,
-                                      size_t byte_offset, size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<ArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-Local<Float16Array> Float16Array::New(
-    Local<SharedArrayBuffer> shared_array_buffer, size_t byte_offset,
-    size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<SharedArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*shared_array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-
 // TODO(v8:11111): Support creating length tracking DataViews via the API.
 Local<DataView> DataView::New(Local<ArrayBuffer> array_buffer,
                               size_t byte_offset, size_t byte_length) {
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index 34424db08dc0..0b6e43dde6ea 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -863,12 +863,6 @@ Builtins::JSBuiltinStateFlags Builtins::GetJSBuiltinState(Builtin builtin) {
       RETURN_FLAG_DEPENDENT_BUILTIN_STATE(
           v8_flags.js_explicit_resource_management);
 
-    // --js-float16array
-    case Builtin::kMathF16round:
-    case Builtin::kDataViewPrototypeGetFloat16:
-    case Builtin::kDataViewPrototypeSetFloat16:
-      RETURN_FLAG_DEPENDENT_BUILTIN_STATE(v8_flags.js_float16array);
-
     // --js-base-64
     case Builtin::kUint8ArrayFromBase64:
     case Builtin::kUint8ArrayFromHex:
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index aab9435dbb53..15d4341ff84b 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -344,8 +344,6 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
   V(js_error_iserror, "Error.isError")                                       \
   V(js_regexp_escape, "RegExp.escape")                                       \
   V(js_explicit_resource_management, "explicit resource management")         \
-  V(js_float16array,                                                         \
-    "Float16Array, Math.f16round, DataView.getFloat16, DataView.setFloat16") \
   V(js_base_64, "Uint8Array to/from base64 and hex")                         \
   V(js_esm_ns_reexport,                                                      \
     "Support diamond-importing re-expored namespaces "                       \
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index ba75a3a17df2..dca2648b3a93 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -3483,6 +3483,8 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     SimpleInstallFunction(isolate_, math, "exp", Builtin::kMathExp, 1, kAdapt);
     SimpleInstallFunction(isolate_, math, "floor", Builtin::kMathFloor, 1,
                           kAdapt);
+    SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
+                          kAdapt);
     SimpleInstallFunction(isolate_, math, "fround", Builtin::kMathFround, 1,
                           kAdapt);
     SimpleInstallFunction(isolate_, math, "hypot", Builtin::kMathHypot, 2,
@@ -4330,6 +4332,10 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
                           Builtin::kDataViewPrototypeGetUint32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setUint32",
                           Builtin::kDataViewPrototypeSetUint32, 2, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "getFloat16",
+                          Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "setFloat16",
+                          Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "getFloat32",
                           Builtin::kDataViewPrototypeGetFloat32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setFloat32",
@@ -5084,11 +5090,6 @@ DirectHandle<JSFunction> Genesis::InstallTypedArray(
           GetCorrespondingRabGsabElementsKind(elements_kind), 0);
   rab_gsab_initial_map->SetConstructor(*result);
 
-  if (rab_gsab_initial_map_index == Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX &&
-      v8_flags.js_float16array) {
-    LOG(isolate(), MapDetails(*rab_gsab_initial_map));
-  }
-
   native_context()->set(rab_gsab_initial_map_index, *rab_gsab_initial_map,
                         UPDATE_WRITE_BARRIER, kReleaseStore);
   Map::SetPrototype(isolate(), rab_gsab_initial_map, prototype);
@@ -5869,34 +5870,6 @@ void Genesis::InitializeGlobal_js_explicit_resource_management() {
       kAdapt);
 }
 
-void Genesis::InitializeGlobal_js_float16array() {
-  if (!v8_flags.js_float16array) return;
-
-  DirectHandle<JSGlobalObject> global(native_context()->global_object(),
-                                      isolate());
-  DirectHandle<JSObject> math = Cast<JSObject>(
-      JSReceiver::GetProperty(isolate(), global, "Math").ToHandleChecked());
-
-  SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
-                        kAdapt);
-
-  DirectHandle<JSObject> dataview_prototype(
-      Cast<JSObject>(native_context()->data_view_fun()->instance_prototype()),
-      isolate());
-
-  SimpleInstallFunction(isolate_, dataview_prototype, "getFloat16",
-                        Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
-  SimpleInstallFunction(isolate_, dataview_prototype, "setFloat16",
-                        Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
-
-  DirectHandle<JSFunction> fun = InstallTypedArray(
-      "Float16Array", FLOAT16_ELEMENTS, FLOAT16_TYPED_ARRAY_CONSTRUCTOR_TYPE,
-      Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX);
-
-  InstallWithIntrinsicDefaultProto(isolate_, fun,
-                                   Context::FLOAT16_ARRAY_FUN_INDEX);
-}
-
 void Genesis::InitializeGlobal_js_regexp_escape() {
   if (!v8_flags.js_regexp_escape) return;
 
diff --git a/deps/v8/src/objects/elements-kind.h b/deps/v8/src/objects/elements-kind.h
index 7be923774f2c..2383a6a3a401 100644
--- a/deps/v8/src/objects/elements-kind.h
+++ b/deps/v8/src/objects/elements-kind.h
@@ -26,13 +26,10 @@ namespace internal {
   V(BigInt64, bigint64, BIGINT64, int64_t)               \
   V(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) \
   V(Float32, float32, FLOAT32, float)                    \
-  V(Float64, float64, FLOAT64, double)
+  V(Float64, float64, FLOAT64, double)                   \
+  V(Float16, float16, FLOAT16, uint16_t)
 
-#define TYPED_ARRAYS_FLOAT16(V) V(Float16, float16, FLOAT16, uint16_t)
-
-#define TYPED_ARRAYS(V) \
-  TYPED_ARRAYS_BASE(V)  \
-  TYPED_ARRAYS_FLOAT16(V)
+#define TYPED_ARRAYS(V) TYPED_ARRAYS_BASE(V)
 
 #define RAB_GSAB_TYPED_ARRAYS_BASE(V)                                    \
   V(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8, uint8_t)               \
@@ -46,14 +43,10 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, \
     uint8_t)                                                             \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)           \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)          \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
-#define RAB_GSAB_TYPED_ARRAYS(V) \
-  RAB_GSAB_TYPED_ARRAYS_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_FLOAT16(V)
+#define RAB_GSAB_TYPED_ARRAYS(V) RAB_GSAB_TYPED_ARRAYS_BASE(V)
 
 // The TypedArrays backed by RAB / GSAB are called Uint8Array, Uint16Array etc,
 // and not RabGsabUint8Array, RabGsabUint16Array etc. This macro is used for
@@ -69,14 +62,11 @@ namespace internal {
   V(BigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64, int64_t)               \
   V(Uint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) \
   V(Float32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)                    \
-  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V) \
+  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)                   \
   V(Float16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)
 
 // Like RAB_GSAB_TYPED_ARRAYS but has an additional parameter for
 // for the corresponding non-RAB/GSAB ElementsKind.
@@ -93,14 +83,11 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED,      \
     uint8_t, UINT8_CLAMPED)                                                   \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float, FLOAT32)       \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)      \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t, FLOAT16)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)
 
 enum ElementsKind : uint8_t {
   // The "fast" kind for elements that only contain SMI values. Must be first
diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc
index def468a73920..1cbe14d654bd 100644
--- a/deps/v8/src/objects/value-serializer.cc
+++ b/deps/v8/src/objects/value-serializer.cc
@@ -2301,13 +2301,6 @@ MaybeDirectHandle<JSArrayBufferView> ValueDeserializer::ReadJSArrayBufferView(
     break;
       TYPED_ARRAYS_BASE(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
-    case ArrayBufferViewTag::kFloat16Array: {
-      if (i::v8_flags.js_float16array) {
-        external_array_type = kExternalFloat16Array;
-        element_size = sizeof(uint16_t);
-      }
-      break;
-    }
   }
   if (element_size == 0 || byte_offset % element_size != 0 ||
       byte_length % element_size != 0) {
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index ace7c1370ad0..a74b20fa8eb1 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -1100,7 +1100,6 @@ TEST(SubclassArrayBuiltinNoInlineNew) {
 
 
 TEST(SubclassTypedArrayBuiltin) {
-  v8_flags.js_float16array = true;
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
 
diff --git a/deps/v8/test/cctest/test-typedarrays.cc b/deps/v8/test/cctest/test-typedarrays.cc
index ce256fec8f0b..40d3cdde0fc4 100644
--- a/deps/v8/test/cctest/test-typedarrays.cc
+++ b/deps/v8/test/cctest/test-typedarrays.cc
@@ -115,20 +115,17 @@ void TestSpeciesProtector(char* code,
 }
 
 UNINITIALIZED_TEST(SpeciesConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "x.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesConstructorAccessor) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(x, 'constructor',{get() {return MyTypedArray;}})";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesModified) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(constructor, Symbol.species, "
       "{value:MyTypedArray})";
@@ -136,7 +133,6 @@ UNINITIALIZED_TEST(SpeciesModified) {
 }
 
 UNINITIALIZED_TEST(SpeciesParentConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "constructor.prototype.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index aa93daaef0cd..07e03b07aaa9 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -59,7 +59,6 @@
     'import-attributes': '--harmony-import-attributes',
     'regexp-duplicate-named-groups': '--js-regexp-duplicate-named-groups',
     'regexp-modifiers': '--js-regexp-modifiers',
-    'Float16Array': '--js-float16array',
     'explicit-resource-management': '--js-explicit-resource-management',
     'decorators': '--js-decorators',
     'promise-try': '--js-promise-try',
diff --git a/deps/v8/test/unittests/objects/object-unittest.cc b/deps/v8/test/unittests/objects/object-unittest.cc
index 18032ea39fd9..d4421cd807d6 100644
--- a/deps/v8/test/unittests/objects/object-unittest.cc
+++ b/deps/v8/test/unittests/objects/object-unittest.cc
@@ -683,8 +683,6 @@ TEST_FUNCTION_KIND(IsStrictFunctionWithoutPrototype)
 #undef TEST_FUNCTION_KIND
 
 TEST_F(ObjectTest, ConstructorInstanceTypes) {
-  bool flag_was_enabled = i::v8_flags.js_float16array;
-  i::v8_flags.js_float16array = true;
   v8::HandleScope scope(isolate());
 
   DirectHandle<NativeContext> context = i_isolate()->native_context();
@@ -720,7 +718,6 @@ TEST_F(ObjectTest, ConstructorInstanceTypes) {
         break;
     }
   }
-  i::v8_flags.js_float16array = flag_was_enabled;
 }
 
 TEST_F(ObjectTest, AddDataPropertyNameCollision) {
diff --git a/deps/v8/test/unittests/objects/value-serializer-unittest.cc b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
index ee7e8acf26db..a6ce6cee63cc 100644
--- a/deps/v8/test/unittests/objects/value-serializer-unittest.cc
+++ b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
@@ -48,7 +48,6 @@ class ValueSerializerTest : public TestWithIsolate {
 
  protected:
   ValueSerializerTest() {
-    FLAG_SCOPE(js_float16array);
     Local<Context> serialization_context = Context::New(isolate());
     Local<Context> deserialization_context = Context::New(isolate());
     serialization_context_.Reset(isolate(), serialization_context);
@@ -2083,7 +2082,6 @@ TEST_F(ValueSerializerTestWithArrayBufferTransfer,
 }
 
 TEST_F(ValueSerializerTest, RoundTripTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2133,7 +2131,6 @@ TEST_F(ValueSerializerTest, RoundTripTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2158,7 +2155,6 @@ TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedNonLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and

From 4cd3d985103adfcbaf225a86164b0c08022d6de4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 1 Sep 2026 11:34:21 +0200
Subject: [PATCH 032/202] lib: use `Float16Array` from primordials
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/65702
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/eslint.config_partial.mjs           | 7 +------
 lib/internal/freeze_intrinsics.js       | 4 ++++
 lib/internal/per_context/primordials.js | 1 +
 lib/internal/util/comparisons.js        | 7 ++-----
 lib/v8.js                               | 4 +---
 5 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/lib/eslint.config_partial.mjs b/lib/eslint.config_partial.mjs
index 638e60c923b7..9240b00ac709 100644
--- a/lib/eslint.config_partial.mjs
+++ b/lib/eslint.config_partial.mjs
@@ -412,12 +412,6 @@ export default [
           name: 'SubtleCrypto',
           message: "Use `const { SubtleCrypto } = require('internal/crypto/webcrypto');` instead of the global.",
         },
-        // Float16Array is not available in primordials because it can be
-        // disabled with --no-js-float16array CLI flag.
-        {
-          name: 'Float16Array',
-          message: 'Use `const { Float16Array } = globalThis;` instead of the global.',
-        },
         // DisposableStack and AsyncDisposableStack are not available in primordials because they can be
         // disabled with --no-js-explicit-resource-management CLI flag.
         {
@@ -478,6 +472,7 @@ export default [
           name: 'FinalizationRegistry',
           into: 'Safe',
         },
+        { name: 'Float16Array' },
         { name: 'Float32Array' },
         { name: 'Float64Array' },
         { name: 'Function' },
diff --git a/lib/internal/freeze_intrinsics.js b/lib/internal/freeze_intrinsics.js
index 05437199726c..5dd425cb0934 100644
--- a/lib/internal/freeze_intrinsics.js
+++ b/lib/internal/freeze_intrinsics.js
@@ -54,6 +54,8 @@ const {
   EvalErrorPrototype,
   FinalizationRegistry,
   FinalizationRegistryPrototype,
+  Float16Array,
+  Float16ArrayPrototype,
   Float32Array,
   Float32ArrayPrototype,
   Float64Array,
@@ -196,6 +198,7 @@ module.exports = function() {
     Uint16ArrayPrototype,
     Int32ArrayPrototype,
     Uint32ArrayPrototype,
+    Float16ArrayPrototype,
     Float32ArrayPrototype,
     Float64ArrayPrototype,
     BigInt64ArrayPrototype,
@@ -296,6 +299,7 @@ module.exports = function() {
     Uint16Array,
     Int32Array,
     Uint32Array,
+    Float16Array,
     Float32Array,
     Float64Array,
     BigInt64Array,
diff --git a/lib/internal/per_context/primordials.js b/lib/internal/per_context/primordials.js
index 49576c2d9497..2e610f4ab508 100644
--- a/lib/internal/per_context/primordials.js
+++ b/lib/internal/per_context/primordials.js
@@ -196,6 +196,7 @@ function copyPrototype(src, dest, prefix) {
   'Error',
   'EvalError',
   'FinalizationRegistry',
+  'Float16Array',
   'Float32Array',
   'Float64Array',
   'Function',
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 6b608a66733a..92594e8994fb 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -15,6 +15,7 @@ const {
   Date,
   DatePrototypeGetTime,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Function,
@@ -50,7 +51,6 @@ const {
   Uint8ClampedArray,
   WeakMap,
   WeakSet,
-  globalThis: { Float16Array },
 } = primordials;
 
 const { compare } = internalBinding('buffer');
@@ -70,6 +70,7 @@ const wellKnownConstructors = new SafeSet()
   .add(DataView)
   .add(Date)
   .add(Error)
+  .add(Float16Array)
   .add(Float32Array)
   .add(Float64Array)
   .add(Function)
@@ -91,10 +92,6 @@ const wellKnownConstructors = new SafeSet()
   .add(WeakMap)
   .add(WeakSet);
 
-if (Float16Array) { // TODO(BridgeAR): Remove when Flag got removed from V8
-  wellKnownConstructors.add(Float16Array);
-}
-
 const types = require('internal/util/types');
 const {
   isAnyArrayBuffer,
diff --git a/lib/v8.js b/lib/v8.js
index b76722a3e614..ea3366bb9617 100644
--- a/lib/v8.js
+++ b/lib/v8.js
@@ -20,6 +20,7 @@ const {
   BigUint64Array,
   DataView,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Int16Array,
@@ -32,9 +33,6 @@ const {
   Uint32Array,
   Uint8Array,
   Uint8ClampedArray,
-  globalThis: {
-    Float16Array,
-  },
 } = primordials;
 
 const { Buffer } = require('buffer');

From 4e207b1c3446ecbb722231d0736304ca88df6a2e Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Thu, 3 Sep 2026 12:52:15 +0200
Subject: [PATCH 033/202] sea: mount bundled assets as a virtual file system

Support "useVfs": true in the SEA configuration: mount the bundled
assets as a read-only VFS and run the CommonJS or ESM main script from
inside the mount.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65675
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
---
 doc/api/single-executable-applications.md     | 104 ++++++
 doc/api/vfs.md                                |  32 ++
 lib/internal/main/embedding.js                |  53 ++-
 lib/internal/vfs/providers/sea.js             | 349 ++++++++++++++++++
 lib/internal/vfs/sea.js                       |  58 +++
 src/node_sea.cc                               |  57 +++
 src/node_sea.h                                |   1 +
 test/fixtures/sea/vfs-esm/calculator.cjs      |   5 +
 test/fixtures/sea/vfs-esm/config.json         |   1 +
 test/fixtures/sea/vfs-esm/greeting.txt        |   1 +
 test/fixtures/sea/vfs-esm/main.mjs            |  63 ++++
 test/fixtures/sea/vfs-esm/math.mjs            |   6 +
 test/fixtures/sea/vfs-esm/sea-config.json     |  14 +
 .../sea/vfs-esm/test-esm-pkg-index.mjs        |   4 +
 .../sea/vfs-esm/test-esm-pkg-package.json     |   6 +
 test/fixtures/sea/vfs/calculator.js           |   9 +
 test/fixtures/sea/vfs/config.json             |   1 +
 test/fixtures/sea/vfs/greeting.txt            |   1 +
 test/fixtures/sea/vfs/math.js                 |   4 +
 test/fixtures/sea/vfs/sea-config.json         |  15 +
 test/fixtures/sea/vfs/sea.js                  | 106 ++++++
 .../sea/vfs/test-exports-pkg-entry.js         |   2 +
 .../sea/vfs/test-exports-pkg-package.json     |   5 +
 test/fixtures/sea/vfs/test-pkg-index.js       |   5 +
 test/fixtures/sea/vfs/test-pkg-package.json   |   5 +
 ...test-build-sea-vfs-incompatible-options.js |  77 ++++
 ...t-single-executable-application-vfs-esm.js |  39 ++
 .../test-single-executable-application-vfs.js |  38 ++
 28 files changed, 1059 insertions(+), 2 deletions(-)
 create mode 100644 lib/internal/vfs/providers/sea.js
 create mode 100644 lib/internal/vfs/sea.js
 create mode 100644 test/fixtures/sea/vfs-esm/calculator.cjs
 create mode 100644 test/fixtures/sea/vfs-esm/config.json
 create mode 100644 test/fixtures/sea/vfs-esm/greeting.txt
 create mode 100644 test/fixtures/sea/vfs-esm/main.mjs
 create mode 100644 test/fixtures/sea/vfs-esm/math.mjs
 create mode 100644 test/fixtures/sea/vfs-esm/sea-config.json
 create mode 100644 test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
 create mode 100644 test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
 create mode 100644 test/fixtures/sea/vfs/calculator.js
 create mode 100644 test/fixtures/sea/vfs/config.json
 create mode 100644 test/fixtures/sea/vfs/greeting.txt
 create mode 100644 test/fixtures/sea/vfs/math.js
 create mode 100644 test/fixtures/sea/vfs/sea-config.json
 create mode 100644 test/fixtures/sea/vfs/sea.js
 create mode 100644 test/fixtures/sea/vfs/test-exports-pkg-entry.js
 create mode 100644 test/fixtures/sea/vfs/test-exports-pkg-package.json
 create mode 100644 test/fixtures/sea/vfs/test-pkg-index.js
 create mode 100644 test/fixtures/sea/vfs/test-pkg-package.json
 create mode 100644 test/sea/test-build-sea-vfs-incompatible-options.js
 create mode 100644 test/sea/test-single-executable-application-vfs-esm.js
 create mode 100644 test/sea/test-single-executable-application-vfs.js

diff --git a/doc/api/single-executable-applications.md b/doc/api/single-executable-applications.md
index be5667cbd499..5083d16894d6 100644
--- a/doc/api/single-executable-applications.md
+++ b/doc/api/single-executable-applications.md
@@ -116,6 +116,7 @@ The configuration currently reads the following top-level fields:
   "disableExperimentalSEAWarning": true, // Default: false
   "useSnapshot": false,  // Default: false
   "useCodeCache": true, // Default: false
+  "useVfs": true, // Default: false
   "execArgv": ["--no-warnings", "--max-old-space-size=4096"], // Optional
   "execArgvExtension": "env", // Default: "env", options: "none", "env", "cli"
   "assets": {  // Optional
@@ -175,6 +176,105 @@ const raw = getRawAsset('a.jpg');
 See documentation of the [`sea.getAsset()`][], [`sea.getAssetAsBlob()`][],
 [`sea.getRawAsset()`][] and [`sea.getAssetKeys()`][] APIs for more information.
 
+### Virtual file system (VFS) for assets
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+In addition to using the `node:sea` API to access individual assets, the
+bundled assets can be exposed as a read-only [virtual file system][] and
+accessed through standard `node:fs` APIs. To enable this, set
+`"useVfs": true` in the SEA configuration.
+
+A virtual file system never shadows the real file system: it is mounted at a
+reserved mount point that cannot exist on the real file system, and the mount
+point is chosen at runtime rather than being a fixed path. When `useVfs` is
+enabled, the injected main script itself is placed at the root of the mount
+and executed from there, so `__filename` and `__dirname` point inside the
+virtual file system instead of reflecting [`process.execPath`][]. Bundled
+code therefore reaches the assets through `__dirname`-relative paths and
+relative [`require()`][] calls, without having to know the mount point:
+
+```cjs
+const fs = require('node:fs');
+const path = require('node:path');
+
+// __dirname is the root of the virtual file system holding the assets.
+const rawConfig = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const data = fs.readFileSync(path.join(__dirname, 'data/file.txt'));
+
+// Directory operations work too.
+const files = fs.readdirSync(path.join(__dirname, 'assets'));
+
+// Check if a bundled file exists.
+if (fs.existsSync(path.join(__dirname, 'optional.json'))) {
+  // ...
+}
+```
+
+The VFS supports the `node:fs` operations for reading files and directories.
+Since the SEA VFS is read-only, write operations fail with `EROFS`. See the
+[VFS documentation][] for the full list of supported operations.
+
+#### Loading modules from the VFS in a SEA
+
+When `useVfs` is enabled, the main script is executed from inside the
+virtual file system, and `require()` uses the [module loader
+integration][] of the VFS to load modules from the bundled assets. This
+supports relative requires (e.g. `require('./helper.js')`) as well as
+`node_modules` package lookups, which are confined to the mount:
+
+```cjs
+// Require bundled modules using relative paths.
+const myModule = require('./lib/mymodule.js');
+
+// Packages bundled under the node_modules asset prefix also resolve.
+const dep = require('some-package');
+```
+
+#### ESM entry points
+
+`"useVfs": true` also supports `"mainFormat": "module"`. The ESM main
+script is loaded from inside the mount through the ESM loader, so
+`import.meta.url`, `import.meta.filename`, and `import.meta.dirname`
+reflect the location of the main script in the virtual file system, and
+static and dynamic imports resolve against the bundled assets:
+
+```mjs
+import fs from 'node:fs';
+import path from 'node:path';
+
+// import.meta.dirname is the root of the virtual file system.
+const data = fs.readFileSync(
+  path.join(import.meta.dirname, 'data/file.txt'));
+
+// Relative and bare specifier imports resolve inside the mount.
+import myModule from './lib/mymodule.mjs';
+const lazy = await import('./lib/lazy.mjs');
+```
+
+Module format detection works the same way as on the real file
+system: name bundled ES modules with the `.mjs` extension (or provide the
+relevant `package.json` files as assets) so they are interpreted as ESM.
+
+#### Snapshot and code caching limitations
+
+`"useVfs": true` cannot be used together with `"useSnapshot": true` or
+`"useCodeCache": true`. The code cache limitation is due to incomplete
+implementation, not a technical impossibility. Consider bundling the
+application if startup performance matters and do not rely on module loading
+from the VFS in that case.
+
+#### Native addon limitations
+
+Native addons (`.node` files) cannot be loaded directly from the VFS because
+`process.dlopen()` requires files on the real file system. To use native
+addons in a SEA with VFS, write the asset to a temporary file first. See
+[Using native addons in the injected main script][] for an example.
+
 ### Startup snapshot support
 
 The `useSnapshot` field can be used to enable startup snapshot support. In this
@@ -648,6 +748,8 @@ to help us document them.
 [Generating single executable preparation blobs]: #1-generating-single-executable-preparation-blobs
 [Mach-O]: https://en.wikipedia.org/wiki/Mach-O
 [PE]: https://en.wikipedia.org/wiki/Portable_Executable
+[Using native addons in the injected main script]: #using-native-addons-in-the-injected-main-script
+[VFS documentation]: vfs.md
 [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
 [`process.execPath`]: process.md#processexecpath
 [`require()`]: modules.md#requireid
@@ -660,8 +762,10 @@ to help us document them.
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
 [documentation about startup snapshot support in Node.js]: cli.md#--build-snapshot
 [fuse]: https://www.electronjs.org/docs/latest/tutorial/fuses
+[module loader integration]: vfs.md#module-loader-integration
 [postject]: https://github.com/nodejs/postject
 [postject-linux-arm64-issue]: https://github.com/nodejs/postject/issues/105
 [signtool]: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
 [single executable applications]: https://github.com/nodejs/single-executable
 [supported by Node.js]: https://github.com/nodejs/node/blob/main/BUILDING.md#platform-list
+[virtual file system]: vfs.md
diff --git a/doc/api/vfs.md b/doc/api/vfs.md
index ccf8d159cbfe..333154417dc2 100644
--- a/doc/api/vfs.md
+++ b/doc/api/vfs.md
@@ -419,6 +419,37 @@ system, the callers are responsible for avoiding removal or
 invalidation of modules in the virtual file system while they are
 being loaded.
 
+## Use with Single Executable Applications
+
+When running as a [Single Executable Application][] built with
+`"useVfs": true` in the SEA configuration, the bundled assets are
+automatically mounted as a read-only virtual file system and the injected
+main script is executed from the root of the mount. No additional setup is
+required. Since the mount point is reserved and chosen at runtime, bundled
+code accesses the assets through `__dirname`-relative paths and relative
+`require()` calls rather than through a fixed path:
+
+```cjs
+// In the SEA main script, __dirname is the root of the mounted assets.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const config = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8'));
+const template = fs.readFileSync(
+  path.join(__dirname, 'templates/index.html'), 'utf8');
+```
+
+ESM entry points (`"mainFormat": "module"`) are supported: the main module
+is loaded from inside the mount through the ESM loader, and
+`import.meta.dirname` points at the mount root.
+
+`"useVfs"` cannot be used together with `"useSnapshot"` or `"useCodeCache"`.
+The SEA configuration parser will error if either combination is detected.
+
+See the [Single Executable Application][] documentation for more information
+on creating SEA builds with assets.
+
 ## Class: `VirtualProvider`
 
 <!-- YAML
@@ -591,6 +622,7 @@ fields use synthetic but stable values:
 [CommonJS resolution algorithm]: modules.md#all-together
 [ES modules resolution algorithm]: esm.md#resolution-algorithm
 [Explicit Resource Management]: https://github.com/tc39/proposal-explicit-resource-management
+[Single Executable Application]: single-executable-applications.md
 [`MemoryProvider`]: #class-memoryprovider
 [`RealFSProvider`]: #class-realfsprovider
 [`VirtualFileSystem`]: #class-virtualfilesystem
diff --git a/lib/internal/main/embedding.js b/lib/internal/main/embedding.js
index 863f90a32f40..31c55459a13e 100644
--- a/lib/internal/main/embedding.js
+++ b/lib/internal/main/embedding.js
@@ -12,10 +12,15 @@
 const {
   prepareMainThreadExecution,
 } = require('internal/process/pre_execution');
-const { isExperimentalSeaWarningNeeded, isSea } = internalBinding('sea');
+const {
+  isExperimentalSeaWarningNeeded,
+  isSea,
+  isVfsEnabled,
+  mainCodePath: seaMainCodePath,
+} = internalBinding('sea');
 const { emitExperimentalWarning } = require('internal/util');
 const { emitWarningSync } = require('internal/process/warning');
-const { Module } = require('internal/modules/cjs/loader');
+const { Module, wrapModuleLoad } = require('internal/modules/cjs/loader');
 const { compileFunctionForCJSLoader } = internalBinding('contextify');
 const { maybeCacheSourceMap } = require('internal/source_map/source_map_cache');
 const { pathToFileURL } = require('internal/url');
@@ -120,10 +125,54 @@ function embedderRunESM(content, filename) {
   return wrap.getNamespace();
 }
 
+/* c8 ignore start -- only reachable in an actual SEA binary */
+/**
+ * Mounts the SEA virtual file system with the main script placed at the
+ * mount point root, and returns the path of the main script inside the
+ * mount, or null when the VFS could not be set up.
+ * @param {string} content The source of the SEA main script
+ * @returns {string|null} The VFS path of the main script
+ */
+function setUpSeaVfs(content) {
+  const mainName = path.basename(seaMainCodePath || process.execPath);
+  const { initSeaVfs } = require('internal/vfs/sea');
+  const seaVfs = initSeaVfs({ extraFiles: { [mainName]: content } });
+  if (seaVfs === null) {
+    return null;
+  }
+  return path.join(seaVfs.mountPoint, mainName);
+}
+/* c8 ignore stop */
+
 function embedderRunEntryPoint(content, format, filename) {
   format ||= moduleFormats.kCommonJS;
   filename ||= process.execPath;
 
+  /* c8 ignore start -- only reachable in an actual SEA binary */
+  if (isLoadingSea && isVfsEnabled()) {
+    // Run the main script from inside the SEA VFS mount so that
+    // `__filename`, `__dirname`, `import.meta`, relative requires and
+    // imports, and `node_modules` lookups all resolve against the
+    // bundled assets.
+    const vfsMain = setUpSeaVfs(content);
+    if (vfsMain !== null) {
+      if (format === moduleFormats.kCommonJS) {
+        return wrapModuleLoad(vfsMain, null, true);
+      } else if (format === moduleFormats.kModule) {
+        const { runEntryPointWithESMLoader } =
+          require('internal/modules/run_main');
+        const mainURL = pathToFileURL(vfsMain);
+        return runEntryPointWithESMLoader((cascadedLoader) => {
+          // Note that if the graph contains unsettled TLA, this may never
+          // resolve even after the event loop stops running.
+          return cascadedLoader.import(
+            mainURL, undefined, { __proto__: null }, undefined, true);
+        });
+      }
+    }
+  }
+  /* c8 ignore stop */
+
   if (format === moduleFormats.kCommonJS) {
     return embedderRunCjs(content, filename);
   } else if (format === moduleFormats.kModule) {
diff --git a/lib/internal/vfs/providers/sea.js b/lib/internal/vfs/providers/sea.js
new file mode 100644
index 000000000000..4a03246c271b
--- /dev/null
+++ b/lib/internal/vfs/providers/sea.js
@@ -0,0 +1,349 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayPrototypeFilter,
+  ArrayPrototypePop,
+  ArrayPrototypePush,
+  Boolean,
+  ObjectKeys,
+  SafeMap,
+  SafeSet,
+  StringPrototypeReplaceAll,
+  StringPrototypeSplit,
+  StringPrototypeStartsWith,
+  Symbol,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+const { posix: pathPosix } = require('path');
+const { VirtualProvider } = require('internal/vfs/provider');
+const { MemoryFileHandle } = require('internal/vfs/file_handle');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const {
+  createENOENT,
+  createENOTDIR,
+  createEISDIR,
+  createEROFS,
+} = require('internal/vfs/errors');
+const {
+  createFileStats,
+  createDirectoryStats,
+} = require('internal/vfs/stats');
+const { Dirent } = require('internal/fs/utils');
+const { kEmptyObject } = require('internal/util');
+const {
+  fs: {
+    UV_DIRENT_FILE,
+    UV_DIRENT_DIR,
+  },
+} = internalBinding('constants');
+
+// Private symbols
+const kAssets = Symbol('kAssets');
+const kExtraFiles = Symbol('kExtraFiles');
+const kDirectories = Symbol('kDirectories');
+const kGetAsset = Symbol('kGetAsset');
+const kSizes = Symbol('kSizes');
+
+/* c8 ignore start -- the SEA provider requires an actual SEA binary to run */
+
+/**
+ * Read-only provider serving the assets bundled into a Single Executable
+ * Application. Asset content stays in the executable's SEA blob and is
+ * copied into JS memory only when a file is opened.
+ */
+class SEAProvider extends VirtualProvider {
+  /**
+   * @param {object} [options] Options
+   * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+   *   files to serve alongside the assets, keyed by path (used for the SEA
+   *   main script, whose source lives in the SEA blob but not in the assets)
+   */
+  constructor(options = kEmptyObject) {
+    super();
+
+    const { isSea, getAsset, getAssetKeys } = internalBinding('sea');
+
+    if (!isSea()) {
+      throw new ERR_INVALID_STATE(
+        'SEAProvider can only be used in a Single Executable Application');
+    }
+
+    this[kGetAsset] = getAsset;
+    // Map of normalized path -> asset key
+    this[kAssets] = new SafeMap();
+    // Map of normalized path -> Buffer content
+    this[kExtraFiles] = new SafeMap();
+    // Map of directory path -> SafeSet of child names
+    this[kDirectories] = new SafeMap();
+    // Cache of file sizes so stat does not have to copy asset content
+    this[kSizes] = new SafeMap();
+
+    // Root directory always exists
+    this[kDirectories].set('/', new SafeSet());
+
+    const keys = getAssetKeys() || [];
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      this[kAssets].set(this.#normalizePath(key), key);
+    }
+    const extraFiles = options.extraFiles;
+    if (extraFiles !== undefined) {
+      const paths = ObjectKeys(extraFiles);
+      for (let i = 0; i < paths.length; i++) {
+        const path = paths[i];
+        const content = extraFiles[path];
+        const buffer = typeof content === 'string' ?
+          Buffer.from(content) : content;
+        const normalized = this.#normalizePath(path);
+        this[kExtraFiles].set(normalized, buffer);
+        this[kSizes].set(normalized, buffer.length);
+      }
+    }
+
+    // Derive the directory tree from the file paths
+    for (const path of this.#filePaths()) {
+      const parts = ArrayPrototypeFilter(
+        StringPrototypeSplit(path, '/'), Boolean);
+      let currentPath = '/';
+      for (let i = 0; i < parts.length - 1; i++) {
+        const parentPath = currentPath;
+        currentPath = pathPosix.join(currentPath, parts[i]);
+        if (!this[kDirectories].has(currentPath)) {
+          this[kDirectories].set(currentPath, new SafeSet());
+        }
+        this[kDirectories].get(parentPath).add(parts[i]);
+      }
+      if (parts.length > 0) {
+        this[kDirectories].get(pathPosix.dirname(path)).add(
+          pathPosix.basename(path));
+      }
+    }
+  }
+
+  get readonly() {
+    return true;
+  }
+
+  get supportsSymlinks() {
+    return false;
+  }
+
+  /**
+   * Iterates over the normalized paths of all files.
+   * @yields {string} The normalized path of each file
+   */
+  * #filePaths() {
+    yield* this[kAssets].keys();
+    yield* this[kExtraFiles].keys();
+  }
+
+  /**
+   * Normalizes a path to an absolute posix-style path.
+   * @param {string} path The path
+   * @returns {string} Normalized path
+   */
+  #normalizePath(path) {
+    let normalized = StringPrototypeReplaceAll(path, '\\', '/');
+    if (!StringPrototypeStartsWith(normalized, '/')) {
+      normalized = '/' + normalized;
+    }
+    return pathPosix.normalize(normalized);
+  }
+
+  /**
+   * Checks if a normalized path is a file.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isFile(path) {
+    return this[kAssets].has(path) || this[kExtraFiles].has(path);
+  }
+
+  /**
+   * Checks if a normalized path is a directory.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isDirectory(path) {
+    return this[kDirectories].has(path);
+  }
+
+  /**
+   * Gets the file content as an independently mutable Buffer.
+   * @param {string} path Normalized path
+   * @returns {Buffer}
+   */
+  #getContent(path) {
+    const extra = this[kExtraFiles].get(path);
+    if (extra !== undefined) {
+      return Buffer.from(extra);
+    }
+    const key = this[kAssets].get(path);
+    if (key === undefined) {
+      throw createENOENT('open', path);
+    }
+    // getAsset returns a zero-copy ArrayBuffer over the (possibly read-only)
+    // SEA blob in the executable; copy it so the handle owns mutable memory.
+    const content = Buffer.from(new Uint8Array(this[kGetAsset](key)));
+    this[kSizes].set(path, content.length);
+    return content;
+  }
+
+  /**
+   * Gets the size of a file, loading the content only on first access.
+   * @param {string} path Normalized path
+   * @returns {number}
+   */
+  #getSize(path) {
+    let size = this[kSizes].get(path);
+    if (size === undefined) {
+      size = this.#getContent(path).length;
+    }
+    return size;
+  }
+
+  openSync(path, flags, mode) {
+    // Normalize numeric flags (O_RDONLY === 0) to a string
+    const normalizedFlags = typeof flags === 'number' ?
+      (flags === 0 ? 'r' : null) : flags;
+    if (normalizedFlags !== 'r') {
+      throw createEROFS('open', path);
+    }
+
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      throw createEISDIR('open', path);
+    }
+    if (!this.#isFile(normalized)) {
+      throw createENOENT('open', path);
+    }
+
+    const content = this.#getContent(normalized);
+    const getStats = () => createFileStats(content.length, { mode: 0o444 });
+    return new MemoryFileHandle(normalized, 'r', 0o444, content, null,
+                                getStats);
+  }
+
+  async open(path, flags, mode) {
+    return this.openSync(path, flags, mode);
+  }
+
+  statSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      return createDirectoryStats({ mode: 0o555, bigint: options?.bigint });
+    }
+    if (this.#isFile(normalized)) {
+      return createFileStats(this.#getSize(normalized),
+                             { mode: 0o444, bigint: options?.bigint });
+    }
+    throw createENOENT('stat', path);
+  }
+
+  async stat(path, options) {
+    return this.statSync(path, options);
+  }
+
+  readdirSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (!this.#isDirectory(normalized)) {
+      if (this.#isFile(normalized)) {
+        throw createENOTDIR('scandir', path);
+      }
+      throw createENOENT('scandir', path);
+    }
+
+    const withFileTypes = options?.withFileTypes === true;
+    const recursive = options?.recursive === true;
+
+    if (recursive) {
+      return this.#readdirRecursive(normalized, withFileTypes);
+    }
+
+    const names = ArrayFrom(this[kDirectories].get(normalized));
+    if (!withFileTypes) {
+      return names;
+    }
+
+    const dirents = [];
+    for (let i = 0; i < names.length; i++) {
+      const childPath = pathPosix.join(normalized, names[i]);
+      const type = this.#isDirectory(childPath) ?
+        UV_DIRENT_DIR : UV_DIRENT_FILE;
+      ArrayPrototypePush(dirents, new Dirent(names[i], type, normalized));
+    }
+    return dirents;
+  }
+
+  /**
+   * Recursively reads directory contents.
+   * @param {string} dirPath The normalized directory path
+   * @param {boolean} withFileTypes Whether to return Dirent objects
+   * @returns {string[]|Dirent[]}
+   */
+  #readdirRecursive(dirPath, withFileTypes) {
+    const results = [];
+
+    // Traverse depth-first in preorder with an explicit frame stack, so a
+    // deeply nested asset tree cannot exhaust the call stack.
+    const stack = [{
+      path: dirPath,
+      relative: '',
+      children: ArrayFrom(this[kDirectories].get(dirPath)),
+      index: 0,
+    }];
+
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1];
+      if (frame.index >= frame.children.length) {
+        ArrayPrototypePop(stack);
+        continue;
+      }
+
+      const name = frame.children[frame.index++];
+      const childPath = pathPosix.join(frame.path, name);
+      const childRelative = frame.relative ?
+        `${frame.relative}/${name}` : name;
+      const isDir = this.#isDirectory(childPath);
+
+      if (withFileTypes) {
+        const type = isDir ? UV_DIRENT_DIR : UV_DIRENT_FILE;
+        ArrayPrototypePush(results,
+                           new Dirent(childRelative, type, dirPath));
+      } else {
+        ArrayPrototypePush(results, childRelative);
+      }
+
+      if (isDir) {
+        ArrayPrototypePush(stack, {
+          path: childPath,
+          relative: childRelative,
+          children: ArrayFrom(this[kDirectories].get(childPath)),
+          index: 0,
+        });
+      }
+    }
+
+    return results;
+  }
+
+  async readdir(path, options) {
+    return this.readdirSync(path, options);
+  }
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  SEAProvider,
+};
diff --git a/lib/internal/vfs/sea.js b/lib/internal/vfs/sea.js
new file mode 100644
index 000000000000..f08bc71bd91b
--- /dev/null
+++ b/lib/internal/vfs/sea.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const { isSea, isVfsEnabled } = internalBinding('sea');
+const { kEmptyObject } = require('internal/util');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+
+let initialized = false;
+
+/* c8 ignore start -- SEA VFS initialization requires an actual SEA binary */
+
+/**
+ * Initializes the SEA virtual file system: a read-only VFS serving the
+ * assets bundled into the executable, mounted at its reserved mount point.
+ * Because a VFS never shadows the real file system, the assets live under
+ * the mount point returned by `vfs.mountPoint`, not at a fixed path; the
+ * SEA main script is placed at the mount point root so bundled code can
+ * reach the assets through `__dirname`-relative paths and relative
+ * `require()` calls.
+ * @param {object} [options] Configuration options
+ * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+ *   files to serve alongside the assets (used for the SEA main script)
+ * @returns {VirtualFileSystem|null} The mounted VFS, or null if not running
+ *   as a SEA or VFS is not enabled in the SEA configuration
+ * @throws {ERR_INVALID_STATE} If already initialized
+ */
+function initSeaVfs(options = kEmptyObject) {
+  if (initialized) {
+    throw new ERR_INVALID_STATE('SEA VFS is already initialized');
+  }
+  initialized = true;
+
+  if (!isSea() || !isVfsEnabled()) {
+    return null;
+  }
+
+  const { VirtualFileSystem } = require('internal/vfs/file_system');
+  const { SEAProvider } = require('internal/vfs/providers/sea');
+
+  const provider = new SEAProvider({ extraFiles: options.extraFiles });
+  // The SEA warning already covers the feature; don't emit the
+  // VirtualFileSystem experimental warning for the implicit SEA mount.
+  const vfs = new VirtualFileSystem(provider, {
+    emitExperimentalWarning: false,
+  });
+  vfs.mount();
+
+  return vfs;
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  initSeaVfs,
+};
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 03d487f1dba7..d17ed779399c 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -263,6 +263,15 @@ void IsSea(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(IsSingleExecutable());
 }
 
+void IsVfsEnabled(const FunctionCallbackInfo<Value>& args) {
+  bool enabled = false;
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    enabled = static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs);
+  }
+  args.GetReturnValue().Set(enabled);
+}
+
 void IsExperimentalSeaWarningNeeded(const FunctionCallbackInfo<Value>& args) {
   bool is_building_sea =
       !per_process::cli_options->experimental_sea_config.empty();
@@ -447,6 +456,16 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
       if (use_code_cache_value) {
         result.flags |= SeaFlags::kUseCodeCache;
       }
+    } else if (key == "useVfs") {
+      bool use_vfs;
+      if (field.value().get_bool().get(use_vfs)) {
+        FPrintF(
+            stderr, "\"useVfs\" field of %s is not a Boolean\n", config_path);
+        return std::nullopt;
+      }
+      if (use_vfs) {
+        result.flags |= SeaFlags::kEnableVfs;
+      }
     } else if (key == "assets") {
       simdjson::ondemand::object assets_object;
       if (field.value().get_object().get(assets_object)) {
@@ -565,6 +584,19 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
     return std::nullopt;
   }
 
+  if (static_cast<bool>(result.flags & SeaFlags::kEnableVfs)) {
+    if (static_cast<bool>(result.flags & SeaFlags::kUseSnapshot)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useSnapshot\" is true\n");
+      return std::nullopt;
+    }
+    if (static_cast<bool>(result.flags & SeaFlags::kUseCodeCache)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useCodeCache\" is true\n");
+      return std::nullopt;
+    }
+  }
+
   if (result.main_path.empty()) {
     FPrintF(stderr,
             "\"main\" field of %s is not a non-empty string\n",
@@ -924,7 +956,31 @@ void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
                 void* priv) {
+  Environment* env = Environment::GetCurrent(context);
+  Isolate* isolate = env->isolate();
+
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    // Expose the main script path recorded in the SEA config so the VFS
+    // integration can place the main script at the mount point root.
+    if (static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs)) {
+      Local<String> code_path_str;
+      if (String::NewFromUtf8(isolate,
+                              sea_resource.code_path.data(),
+                              NewStringType::kNormal,
+                              sea_resource.code_path.length())
+              .ToLocal(&code_path_str)) {
+        target
+            ->Set(context,
+                  FIXED_ONE_BYTE_STRING(isolate, "mainCodePath"),
+                  code_path_str)
+            .Check();
+      }
+    }
+  }
+
   SetMethod(context, target, "isSea", IsSea);
+  SetMethod(context, target, "isVfsEnabled", IsVfsEnabled);
   SetMethod(context,
             target,
             "isExperimentalSeaWarningNeeded",
@@ -935,6 +991,7 @@ void Initialize(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(IsSea);
+  registry->Register(IsVfsEnabled);
   registry->Register(IsExperimentalSeaWarningNeeded);
   registry->Register(GetAsset);
   registry->Register(GetAssetKeys);
diff --git a/src/node_sea.h b/src/node_sea.h
index b147caefa5e5..cd633c2f43b7 100644
--- a/src/node_sea.h
+++ b/src/node_sea.h
@@ -30,6 +30,7 @@ enum class SeaFlags : uint32_t {
   kUseCodeCache = 1 << 2,
   kIncludeAssets = 1 << 3,
   kIncludeExecArgv = 1 << 4,
+  kEnableVfs = 1 << 5,
 };
 
 enum class SeaExecArgvExtension : uint8_t {
diff --git a/test/fixtures/sea/vfs-esm/calculator.cjs b/test/fixtures/sea/vfs-esm/calculator.cjs
new file mode 100644
index 000000000000..3499fb2cad12
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/calculator.cjs
@@ -0,0 +1,5 @@
+'use strict';
+// CommonJS module imported from the ESM main to test interop inside the VFS.
+module.exports = {
+  sum: (a, b) => a + b,
+};
diff --git a/test/fixtures/sea/vfs-esm/config.json b/test/fixtures/sea/vfs-esm/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs-esm/greeting.txt b/test/fixtures/sea/vfs-esm/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs-esm/main.mjs b/test/fixtures/sea/vfs-esm/main.mjs
new file mode 100644
index 000000000000..24ae629a5bce
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/main.mjs
@@ -0,0 +1,63 @@
+// The ESM SEA main script runs from inside the VFS mount: import.meta
+// reflects the mount, and static imports, dynamic imports, and bare
+// specifier lookups all resolve against the bundled assets.
+import fs from 'node:fs';
+import path from 'node:path';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+
+// Static import of a relative ESM module from the VFS.
+import { add, multiply } from './modules/math.mjs';
+
+// Static import of a CommonJS module from the VFS (interop).
+import calculator from './modules/calculator.cjs';
+
+// Static import of a bare specifier resolved via the in-VFS node_modules.
+import { name as pkgName, greet } from 'test-esm-pkg';
+
+// The main script runs from inside the VFS, not from the executable.
+assert.ok(import.meta.url.startsWith('file:'));
+assert.strictEqual(path.basename(import.meta.filename), 'main.mjs');
+assert.notStrictEqual(import.meta.filename, process.execPath);
+console.log('main module runs from', import.meta.url);
+
+// import.meta.dirname is the root of the mounted assets.
+const config = JSON.parse(
+  fs.readFileSync(path.join(import.meta.dirname, 'config.json'), 'utf8'));
+assert.strictEqual(config.name, 'test-app');
+const greeting = fs.readFileSync(
+  path.join(import.meta.dirname, 'data', 'greeting.txt'), 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!');
+console.log('fs access through import.meta.dirname passed');
+
+// Static ESM import from the VFS.
+assert.strictEqual(add(2, 3), 5);
+assert.strictEqual(multiply(4, 5), 20);
+console.log('static relative import passed');
+
+// CommonJS interop from the VFS.
+assert.strictEqual(calculator.sum(10, 20), 30);
+console.log('static import of CommonJS module passed');
+
+// Bare specifier resolution confined to the in-VFS node_modules.
+assert.strictEqual(pkgName, 'test-esm-pkg');
+assert.strictEqual(greet('World'), 'Hello, World!');
+console.log('bare specifier import passed');
+
+// Dynamic import from the VFS.
+const dynamicMath = await import('./modules/math.mjs');
+assert.strictEqual(dynamicMath.add(1, 1), 2);
+console.log('dynamic import passed');
+
+// createRequire against the VFS main URL.
+const require = createRequire(import.meta.url);
+const requiredCalculator = require('./modules/calculator.cjs');
+assert.strictEqual(requiredCalculator.sum(3, 4), 7);
+console.log('createRequire from import.meta.url passed');
+
+// node:sea and the VFS serve the same content.
+const { getAsset } = await import('node:sea');
+assert.strictEqual(getAsset('data/greeting.txt', 'utf8'), greeting);
+console.log('node:sea API and VFS coexistence passed');
+
+console.log('All SEA VFS ESM tests passed!');
diff --git a/test/fixtures/sea/vfs-esm/math.mjs b/test/fixtures/sea/vfs-esm/math.mjs
new file mode 100644
index 000000000000..acc4868a6f6e
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/math.mjs
@@ -0,0 +1,6 @@
+export function add(a, b) {
+  return a + b;
+}
+export function multiply(a, b) {
+  return a * b;
+}
diff --git a/test/fixtures/sea/vfs-esm/sea-config.json b/test/fixtures/sea/vfs-esm/sea-config.json
new file mode 100644
index 000000000000..c17694a412fa
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/sea-config.json
@@ -0,0 +1,14 @@
+{
+  "main": "main.mjs",
+  "mainFormat": "module",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.mjs": "math.mjs",
+    "modules/calculator.cjs": "calculator.cjs",
+    "node_modules/test-esm-pkg/package.json": "test-esm-pkg-package.json",
+    "node_modules/test-esm-pkg/index.mjs": "test-esm-pkg-index.mjs"
+  }
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
new file mode 100644
index 000000000000..1cc3c9c7fa55
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
@@ -0,0 +1,4 @@
+export const name = 'test-esm-pkg';
+export function greet(who) {
+  return `Hello, ${who}!`;
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
new file mode 100644
index 000000000000..ee0ab8500ba1
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
@@ -0,0 +1,6 @@
+{
+  "name": "test-esm-pkg",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": { ".": "./index.mjs" }
+}
diff --git a/test/fixtures/sea/vfs/calculator.js b/test/fixtures/sea/vfs/calculator.js
new file mode 100644
index 000000000000..dc8e496a85ee
--- /dev/null
+++ b/test/fixtures/sea/vfs/calculator.js
@@ -0,0 +1,9 @@
+'use strict';
+// This module tests transitive requires - it requires math.js using a
+// relative path, which tests that module hooks resolve correctly.
+const math = require('./math.js');
+
+module.exports = {
+  sum: (a, b) => math.add(a, b),
+  product: (a, b) => math.multiply(a, b),
+};
diff --git a/test/fixtures/sea/vfs/config.json b/test/fixtures/sea/vfs/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs/greeting.txt b/test/fixtures/sea/vfs/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs/math.js b/test/fixtures/sea/vfs/math.js
new file mode 100644
index 000000000000..26be73d850ac
--- /dev/null
+++ b/test/fixtures/sea/vfs/math.js
@@ -0,0 +1,4 @@
+module.exports = {
+  add: (a, b) => a + b,
+  multiply: (a, b) => a * b,
+};
diff --git a/test/fixtures/sea/vfs/sea-config.json b/test/fixtures/sea/vfs/sea-config.json
new file mode 100644
index 000000000000..767e778ea26e
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea-config.json
@@ -0,0 +1,15 @@
+{
+  "main": "sea.js",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.js": "math.js",
+    "modules/calculator.js": "calculator.js",
+    "node_modules/test-pkg/package.json": "test-pkg-package.json",
+    "node_modules/test-pkg/index.js": "test-pkg-index.js",
+    "node_modules/test-exports-pkg/package.json": "test-exports-pkg-package.json",
+    "node_modules/test-exports-pkg/lib/entry.js": "test-exports-pkg-entry.js"
+  }
+}
diff --git a/test/fixtures/sea/vfs/sea.js b/test/fixtures/sea/vfs/sea.js
new file mode 100644
index 000000000000..59989390c7d1
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea.js
@@ -0,0 +1,106 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+// The SEA VFS never shadows the real file system: the assets are mounted at
+// a reserved mount point and the main script runs from inside the mount, so
+// everything is reachable through __dirname-relative paths and relative
+// requires.
+
+// The main script runs from inside the VFS, not from the executable.
+assert.notStrictEqual(__filename, process.execPath);
+assert.strictEqual(path.basename(__filename), 'sea.js');
+assert.strictEqual(require.main, module);
+console.log('main script runs from', __filename);
+
+// The main script itself is readable through fs.
+assert.strictEqual(fs.existsSync(__filename), true);
+
+// Read the config file through standard fs (via VFS hooks)
+const configContent = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const config = JSON.parse(configContent);
+assert.strictEqual(config.name, 'test-app', 'config.name should match');
+assert.strictEqual(config.version, '1.0.0', 'config.version should match');
+console.log('Read config.json:', config);
+
+// Read a text file
+const greetingPath = path.join(__dirname, 'data', 'greeting.txt');
+const greeting = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!', 'greeting should match');
+console.log('Read greeting.txt:', greeting);
+
+// Test existsSync
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'config.json')), true);
+assert.strictEqual(fs.existsSync(greetingPath), true);
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'nonexistent.txt')), false);
+console.log('existsSync tests passed');
+
+// Test statSync
+const configStat = fs.statSync(path.join(__dirname, 'config.json'));
+assert.strictEqual(configStat.isFile(), true);
+assert.strictEqual(configStat.isDirectory(), false);
+const dirStat = fs.statSync(path.join(__dirname, 'data'));
+assert.strictEqual(dirStat.isDirectory(), true);
+console.log('statSync tests passed');
+
+// Test readdirSync - the mount root lists the assets and the main script
+const entries = fs.readdirSync(__dirname);
+assert.ok(entries.includes('config.json'), 'Should include config.json');
+assert.ok(entries.includes('data'), 'Should include data directory');
+assert.ok(entries.includes('sea.js'), 'Should include the main script');
+console.log('readdirSync tests passed, entries:', entries);
+
+// The VFS is read-only
+assert.throws(() => {
+  fs.writeFileSync(path.join(__dirname, 'new-file.txt'), 'nope');
+}, { code: 'EROFS' });
+console.log('read-only test passed');
+
+// Test relative require from main script - __filename is inside the mount so
+// relative paths resolve against the bundled assets via module hooks
+const mathModule = require('./modules/math.js');
+assert.strictEqual(mathModule.add(2, 3), 5, 'math.add should work');
+assert.strictEqual(mathModule.multiply(4, 5), 20, 'math.multiply should work');
+console.log('relative require from main script passed');
+
+// Test transitive requires: calculator.js requires ./math.js internally
+const calculator = require('./modules/calculator.js');
+assert.strictEqual(calculator.sum(10, 20), 30, 'calculator.sum should work');
+assert.strictEqual(calculator.product(3, 7), 21, 'calculator.product should work');
+console.log('transitive require from VFS tests passed');
+
+// Module lookup paths are confined to the mount
+assert.deepStrictEqual(module.paths, [path.join(__dirname, 'node_modules')]);
+console.log('module.paths confinement test passed');
+
+// Test that node:sea API and VFS can load the same asset
+const sea = require('node:sea');
+const seaAsset = sea.getAsset('data/greeting.txt', 'utf8');
+const vfsAsset = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(seaAsset, vfsAsset, 'node:sea and VFS should return the same content');
+console.log('node:sea API and VFS coexistence test passed');
+
+// Test buffer independence: multiple reads return independent copies
+const buf1 = fs.readFileSync(greetingPath);
+const buf2 = fs.readFileSync(greetingPath);
+const original = buf1[0];
+buf1[0] = 0xFF;
+assert.strictEqual(buf2[0], original, 'buf2 should be unaffected by buf1 mutation');
+assert.strictEqual(buf1[0], 0xFF, 'buf1 mutation should persist');
+console.log('buffer independence test passed');
+
+// Test node_modules package lookup via VFS (resolved through "exports" field)
+const testPkg = require('test-pkg');
+assert.strictEqual(testPkg.name, 'test-pkg', 'package name should match');
+assert.strictEqual(testPkg.greet('World'), 'Hello, World!', 'package function should work');
+console.log('node_modules package lookup test passed');
+
+// Test exports-only package (no "main" field, entry in subdirectory)
+// This proves the package.json reader is VFS-aware - without it,
+// "exports" would not be consulted and resolution would fail.
+const exportsPkg = require('test-exports-pkg');
+assert.strictEqual(exportsPkg.fromExports, true, 'exports-only package should resolve');
+console.log('exports-only package lookup test passed');
+
+console.log('All SEA VFS tests passed!');
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-entry.js b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
new file mode 100644
index 000000000000..3ef6bdcadc7a
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
@@ -0,0 +1,2 @@
+'use strict';
+module.exports = { fromExports: true };
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-package.json b/test/fixtures/sea/vfs/test-exports-pkg-package.json
new file mode 100644
index 000000000000..86f62f622da5
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-exports-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./lib/entry.js" }
+}
diff --git a/test/fixtures/sea/vfs/test-pkg-index.js b/test/fixtures/sea/vfs/test-pkg-index.js
new file mode 100644
index 000000000000..e6c2ee94611c
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-index.js
@@ -0,0 +1,5 @@
+'use strict';
+module.exports = {
+  name: 'test-pkg',
+  greet: (name) => `Hello, ${name}!`,
+};
diff --git a/test/fixtures/sea/vfs/test-pkg-package.json b/test/fixtures/sea/vfs/test-pkg-package.json
new file mode 100644
index 000000000000..bc4109d609ae
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./index.js" }
+}
diff --git a/test/sea/test-build-sea-vfs-incompatible-options.js b/test/sea/test-build-sea-vfs-incompatible-options.js
new file mode 100644
index 000000000000..3f76beff087d
--- /dev/null
+++ b/test/sea/test-build-sea-vfs-incompatible-options.js
@@ -0,0 +1,77 @@
+// This tests that --build-sea rejects "useVfs" combined with options it
+// does not support.
+
+'use strict';
+
+require('../common');
+const tmpdir = require('../common/tmpdir');
+const { skipIfBuildSEAIsNotSupported } = require('../common/sea');
+const { writeFileSync } = require('fs');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+skipIfBuildSEAIsNotSupported();
+
+// Test: "useVfs" is not a Boolean
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('invalid-useVfs.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": "true"
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" field of .*invalid-useVfs\.json is not a Boolean/,
+    });
+}
+
+// Test: "useVfs" with "useSnapshot"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-snapshot.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useSnapshot": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useSnapshot" is true/,
+    });
+}
+
+// Test: "useVfs" with "useCodeCache"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-code-cache.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useCodeCache": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useCodeCache" is true/,
+    });
+}
diff --git a/test/sea/test-single-executable-application-vfs-esm.js b/test/sea/test-single-executable-application-vfs-esm.js
new file mode 100644
index 000000000000..b591f6e9d62b
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs-esm.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// This tests the SEA VFS integration with an ESM entry point - the bundled
+// assets are mounted as a virtual file system and the ESM main script runs
+// from inside the mount through the ESM loader.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs-esm'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS ESM tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sea/test-single-executable-application-vfs.js b/test/sea/test-single-executable-application-vfs.js
new file mode 100644
index 000000000000..46a50cd79f86
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// This tests the SEA VFS integration - the bundled assets are mounted as a
+// virtual file system and the main script runs from inside the mount.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);

From 095fdd3721d4417fd30a1f7bc3bccae80896ec5a Mon Sep 17 00:00:00 2001
From: Daijiro Wachi <daijiro.wachi@gmail.com>
Date: Thu, 3 Sep 2026 21:57:27 +0900
Subject: [PATCH 034/202] net: fix BlockList.fromJSON for IPv4-mapped IPv6
 rules

BlockList.toJSON() serializes IPv4-mapped IPv6 addresses in mixed
dotted-quad form (e.g. "::ffff:192.0.2.128"), but the fromJSON() rule
parser's IPv6 regexes excluded "." and capped the length at 39, so such
rules were silently corrupted or dropped on a toJSON()/fromJSON()
round-trip. Allow "." and raise the cap to 45 (the longest mixed form).

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64125
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 lib/internal/blocklist.js       |  6 +++---
 test/parallel/test-blocklist.js | 37 +++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js
index 5b5023b0f923..9436078eaa2c 100644
--- a/lib/internal/blocklist.js
+++ b/lib/internal/blocklist.js
@@ -383,7 +383,7 @@ class BlockList {
         // - 2001:db8:85a3::8a2e:370:7334/64 (compressed)
         // - 2001:db8:85a3::192.0.2.128/64 (mixed)
         const ipv6SubnetMatch = item.match(
-          /Subnet: IPv6 ([0-9a-fA-F:]{1,39})\/([0-9]{1,3})/i,
+          /Subnet: IPv6 ([0-9a-fA-F:.]{1,45})\/([0-9]{1,3})/i,
         );
         if (ipv6SubnetMatch) {
           const { 1: network, 2: prefix } = ipv6SubnetMatch;
@@ -396,7 +396,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full)
         // - 2001:db8:85a3::8a2e:370:7334 (compressed)
         // - 2001:db8:85a3::192.0.2.128 (mixed)
-        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:]{1,39})/i);
+        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:.]{1,45})/i);
         if (ipv6AddressMatch) {
           const { 1: address } = ipv6AddressMatch;
           this.addAddress(address, 'ipv6');
@@ -408,7 +408,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334-2001:0db8:85a3:0000:0000:8a2e:0370:7335 (full)
         // - 2001:db8:85a3::8a2e:370:7334-2001:db8:85a3::8a2e:370:7335 (compressed)
         // - 2001:db8:85a3::192.0.2.128-2001:db8:85a3::192.0.2.129 (mixed)
-        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:]{1,39})-([0-9a-fA-F:]{1,39})/i);
+        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:.]{1,45})-([0-9a-fA-F:.]{1,45})/i);
         if (ipv6RangeMatch) {
           const { 1: start, 2: end } = ipv6RangeMatch;
           this.addRange(start, end, 'ipv6');
diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js
index ca4e96b0cbdd..f1fc42f6304e 100644
--- a/test/parallel/test-blocklist.js
+++ b/test/parallel/test-blocklist.js
@@ -955,3 +955,40 @@ const util = require('util');
   assert(!blockList.check('10.2.0.1'));
   assert.strictEqual(blockList.rules.length, 1);
 }
+
+{
+  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
+  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
+  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
+  // in that notation.
+  const bl = new BlockList();
+  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
+  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');
+
+  const expected = [
+    'Address: IPv6 ::ffff:192.0.2.128',
+    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
+    'Subnet: IPv6 ::ffff:10.0.0.0/120',
+  ];
+  assert.deepStrictEqual(bl.toJSON().sort(), expected);
+
+  const restored = new BlockList();
+  restored.fromJSON(bl.toJSON());
+
+  // The restored rules must be identical (lossless round-trip).
+  assert.deepStrictEqual(restored.toJSON().sort(), expected);
+
+  // And it must still match the same addresses as the original.
+  [
+    ['::ffff:192.0.2.128', true],  // the single address
+    ['::ffff:192.0.2.129', false],
+    ['::ffff:10.0.0.50', true],    // inside the subnet
+    ['::ffff:10.0.1.0', false],
+    ['::ffff:172.16.0.5', true],   // inside the range
+    ['::ffff:172.16.0.20', false],
+  ].forEach(([address, result]) => {
+    assert.strictEqual(bl.check(address, 'ipv6'), result);
+    assert.strictEqual(restored.check(address, 'ipv6'), result);
+  });
+}

From 84e367579ef43e0ae268463cc45c16a5992f38fb Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Thu, 16 Jul 2026 19:51:33 +0200
Subject: [PATCH 035/202] https: limit proxy CONNECT response headers

Apply the configured maximum header size while reading CONNECT
responses. Rearm the readable listener only once per read pass to avoid
unbounded buffer and listener growth.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
---
 lib/https.js                                  | 35 ++++++++++-----
 ...st-https-proxy-request-header-overflow.mjs | 45 +++++++++++++++++++
 2 files changed, 69 insertions(+), 11 deletions(-)
 create mode 100644 test/client-proxy/test-https-proxy-request-header-overflow.mjs

diff --git a/lib/https.js b/lib/https.js
index 6ae2e5d8a213..75ec8bb3f895 100644
--- a/lib/https.js
+++ b/lib/https.js
@@ -70,6 +70,7 @@ let debug = require('internal/util/debuglog').debuglog('https', (fn) => {
   debug = fn;
 });
 const net = require('net');
+const { Buffer } = require('buffer');
 const { URL, urlToHttpOptions, isURL } = require('internal/url');
 const { validateObject } = require('internal/validators');
 const { isIP } = require('internal/net');
@@ -204,6 +205,7 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
   const result = {
     __proto__: null,
     proxyTunnelPayload: payload,
+    maxHeaderSize: reqOptions.maxHeaderSize || getOptionValue('--max-http-header-size'),
     requestOptions: {  // Options used for the request sent after the tunnel is established.
       __proto__: null,
       servername: reqOptions.servername || ipType ? undefined : reqOptions.host,
@@ -215,17 +217,17 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
 };
 
 function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
-  const { proxyTunnelPayload } = tunnelConfig;
+  const { proxyTunnelPayload, maxHeaderSize } = tunnelConfig;
   // By default, the socket is in paused mode. Read to look for the 200
   // connection established response.
   function read() {
     let chunk;
     while ((chunk = socket.read()) !== null) {
-      if (onProxyData(chunk) !== -1) {
-        break;
+      if (onProxyData(chunk)) {
+        return;
       }
     }
-    socket.on('readable', read);
+    socket.once('readable', read);
   }
 
   function cleanup() {
@@ -243,14 +245,25 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
 
   // Read the headers from the chunks and check for the status code. If it fails we
   // clean up the socket and return an error. Otherwise we establish the tunnel.
-  let buffer = '';
+  let buffer;
   function onProxyData(chunk) {
-    const str = chunk.toString();
-    debug('onProxyData', str);
-    buffer += str;
+    debug('onProxyData', chunk.length);
+    buffer = buffer === undefined ? chunk :
+      Buffer.concat([buffer, chunk], buffer.length + chunk.length);
     const headerEndIndex = buffer.indexOf('\r\n\r\n');
-    if (headerEndIndex === -1) return headerEndIndex;
-    const statusLine = buffer.substring(0, buffer.indexOf('\r\n'));
+    const headerLength = headerEndIndex === -1 ?
+      buffer.length : headerEndIndex + 4;
+    if (headerLength > maxHeaderSize) {
+      debug(`Proxy response headers exceed ${maxHeaderSize} bytes, cleaning up`);
+      cleanup();
+      const err = new ERR_PROXY_TUNNEL(
+        `Proxy response headers exceeded ${maxHeaderSize} bytes`);
+      afterSocket(err, socket);
+      return true;
+    }
+    if (headerEndIndex === -1) return false;
+    const statusLineEndIndex = buffer.indexOf('\r\n');
+    const statusLine = buffer.subarray(0, statusLineEndIndex).toString();
     const statusCode = statusLine.split(' ')[1];
     if (statusCode !== '200') {
       debug(`onProxyData receives ${statusCode}, cleaning up`);
@@ -292,7 +305,7 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
       });
       tunneldSocket.on('error', onTLSHandshakeError);
     }
-    return headerEndIndex;
+    return true;
   }
 
   function onProxyEnd() {
diff --git a/test/client-proxy/test-https-proxy-request-header-overflow.mjs b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
new file mode 100644
index 000000000000..2ffc215bafa9
--- /dev/null
+++ b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
@@ -0,0 +1,45 @@
+// This tests that the proxy server cannot send unbounded incomplete headers
+// while establishing a CONNECT tunnel.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import http from 'node:http';
+import { runProxiedRequest } from '../common/proxy-server.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const proxy = http.createServer();
+proxy.on('connect', common.mustCall((req, socket) => {
+  socket.write('HTTP/1.1 200 Connection Established\r\n');
+
+  const interval = setInterval(() => {
+    if (socket.destroyed) {
+      clearInterval(interval);
+      return;
+    }
+    socket.write('x'.repeat(100));
+  }, 10);
+  socket.on('close', () => clearInterval(interval));
+  socket.on('error', () => clearInterval(interval));
+}, 1));
+proxy.listen(0);
+await once(proxy, 'listening');
+
+const { code, signal, stderr, stdout } = await runProxiedRequest({
+  NODE_USE_ENV_PROXY: 1,
+  REQUEST_URL: 'https://localhost:1/test',
+  HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
+}, ['--max-http-header-size=1024']);
+
+assert.match(
+  stderr,
+  /ERR_PROXY_TUNNEL.*Proxy response headers exceeded 1024 bytes/,
+);
+assert.doesNotMatch(stderr, /MaxListenersExceededWarning/);
+assert.strictEqual(stdout.trim(), '');
+assert.strictEqual(code, 0);
+assert.strictEqual(signal, null);
+
+proxy.close();

From e3244199337c4e759642f777700929c73f1db456 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 22 Aug 2026 13:42:06 +0000
Subject: [PATCH 036/202] fs: write files in one thread pool round trip

fs.writeFile(path, data) took three libuv thread pool round trips
(open, write, close), each its own request with its own queue wait,
completion callback and JS/C++ crossing, and fs.promises.writeFile()
did the same through a FileHandle. For the small files applications
write most, the round trips are the cost, and each occupies a pool slot
that concurrent fs, dns.lookup() and crypto work is also queueing for.

Add WriteFileJob next to ReadFileJob: an AsyncWrap + ThreadPoolWork
that opens, writes the whole buffer (looping on short writes) and
closes as one pool task, keeping the buffer alive until it is done.
fs.writeFile() uses it for path arguments without flush;
fs.promises.writeFile() additionally keeps data above one write chunk
(and iterables) on the FileHandle path, so large writes stay abortable
between chunks as before. File descriptors, FileHandles, flush: true
and an active VFS keep their existing paths.

Behavior is otherwise kept: open failures report syscall 'open' with
the path, write failures 'write'; permission errors are delivered
through the callback/promise; an abort signalled while the write is in
flight is still reported as an AbortError; the job is an FSREQCALLBACK
resource for async_hooks and emits the 'write' fs trace event.

Tests that used fs.writeFile() as a proxy for open/close trace events,
or injected FileHandle faults for path-based writes, are adjusted to
keep testing what they test.

The job holds the buffer's backing store, so the memory stays valid if
the buffer is detached or collected before the write finishes; a
resizable ArrayBuffer could still have its pages decommitted by a
shrink, so its contents are copied when the job is created.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65489
Refs: https://github.com/nodejs/node/pull/65327
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
---
 lib/fs.js                                     |  18 ++
 lib/internal/fs/promises.js                   |  35 ++++
 src/node_file.cc                              | 167 ++++++++++++++++++
 ...s-promises-file-handle-aggregate-errors.js |   4 +-
 ...st-fs-promises-file-handle-close-errors.js |   4 +-
 .../test-fs-promises-file-handle-op-errors.js |   4 +-
 .../test-fs-writefile-one-roundtrip.js        |  85 +++++++++
 test/parallel/test-trace-events-fs-async.js   |   9 +-
 8 files changed, 320 insertions(+), 6 deletions(-)
 create mode 100644 test/parallel/test-fs-writefile-one-roundtrip.js

diff --git a/lib/fs.js b/lib/fs.js
index f974d808b826..63312ba19507 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -79,6 +79,7 @@ const {
 const {
   FSReqCallback,
   ReadFileJob,
+  WriteFileJob,
 } = binding;
 const { toPathIfFileURL } = require('internal/url');
 const {
@@ -2929,6 +2930,23 @@ function writeFile(path, data, options, callback) {
   if (checkAborted(options.signal, callback))
     return;
 
+  if (!flush) {
+    // Open + write + close in one thread pool round trip.
+    const signal = options.signal;
+    path = getValidatedPath(path);
+    const job = new WriteFileJob(path, stringToFlags(flag, 'options.flag'),
+                                 parseFileMode(options.mode, 'mode', 0o666), data);
+    job.ondone = signal == null ? callback : (err) => {
+      // An abort that arrived while the write was in flight still wins.
+      callback(signal.aborted && !err ? new AbortError(undefined, { cause: signal.reason }) : err);
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      callback(accessError);
+    }
+    return;
+  }
+
   fs.open(path, flag, options.mode, (openErr, fd) => {
     if (openErr) {
       callback(openErr);
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index bd9fc871ce75..ec163ccf9068 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -2116,6 +2116,14 @@ async function writeFile(path, data, options) {
 
   checkAborted(options.signal);
 
+  if (!flush && !isCustomIterable(data) && data.byteLength <= kWriteFileMaxChunkSize) {
+    path = getValidatedPath(path);
+    await writeFileInOneRoundTrip(path, stringToFlags(flag, 'options.flag'),
+                                  parseFileMode(options.mode, 'mode', 0o666), data);
+    checkAborted(options.signal);  // An abort during the write still wins.
+    return;
+  }
+
   const fd = await open(path, flag, options.mode);
   let writeOp = writeFileHandle(fd, data, options.signal, options.encoding);
 
@@ -2126,6 +2134,33 @@ async function writeFile(path, data, options) {
   return handleFdClose(writeOp, fd.close);
 }
 
+/**
+ * Open + write + close as one thread pool round trip.
+ * @param {string|Buffer} path Validated path
+ * @param {number} flagsNumber
+ * @param {number} mode
+ * @param {ArrayBufferView} data
+ * @returns {Promise<void>}
+ */
+function writeFileInOneRoundTrip(path, flagsNumber, mode, data) {
+  return new Promise((resolve, reject) => {
+    const job = new binding.WriteFileJob(path, flagsNumber, mode, data);
+    job.ondone = (err) => {
+      if (err != null) {
+        ErrorCaptureStackTrace(err, writeFileInOneRoundTrip);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      ErrorCaptureStackTrace(accessError, writeFileInOneRoundTrip);
+      reject(accessError);
+    }
+  });
+}
+
 function isCustomIterable(obj) {
   return isIterable(obj) && !isArrayBufferView(obj) && typeof obj !== 'string';
 }
diff --git a/src/node_file.cc b/src/node_file.cc
index dd372c7f16c7..de199dfea1a1 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -65,6 +65,7 @@ namespace fs {
 
 using v8::Array;
 using v8::ArrayBuffer;
+using v8::ArrayBufferView;
 using v8::BigInt;
 using v8::Context;
 using v8::EscapableHandleScope;
@@ -3703,6 +3704,7 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   SET_SELF_SIZE(ReadFileJob)
 
  private:
+  friend class WriteFileJob;
   static constexpr size_t kUnknownSizeChunk = 64 * 1024;
   static constexpr size_t kMaxReadChunk = 256 * 1024 * 1024;
 
@@ -3786,6 +3788,162 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   int fd_ = -1;
 };
 
+// Writes a whole buffer to a file in ONE thread pool round trip -- open +
+// write (until everything is written) + close -- for fs.writeFile() and
+// fs.promises.writeFile() with a path, which otherwise pay one round trip per
+// step.
+//
+// JS: const job = new WriteFileJob(path, flags, mode, buffer);
+//     job.ondone = (err) => {...}; job.run(path);
+// `err` carries the syscall that failed ('open', 'write' or 'close'); the file
+// descriptor opened here is always closed.
+class WriteFileJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_GE(args.Length(), 4);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    CHECK(args[1]->IsInt32());
+    CHECK(args[2]->IsInt32());
+    CHECK(args[3]->IsArrayBufferView());
+    new WriteFileJob(env,
+                     args.This(),
+                     path.ToString(),
+                     args[1].As<Int32>()->Value(),
+                     args[2].As<Int32>()->Value(),
+                     args[3].As<ArrayBufferView>());
+  }
+
+  // Returns undefined when the job was scheduled, or the ERR_ACCESS_DENIED
+  // error the asynchronous open() would have delivered (nothing is scheduled).
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    WriteFileJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    Environment* env = job->AsyncWrap::env();
+    CHECK(!job->scheduled_);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    Local<Value> access_error;
+    if (ReadFileJob::OpenPermissionError(env, path, job->flags_)
+            .ToLocal(&access_error)) {
+      args.GetReturnValue().Set(access_error);
+      return;
+    }
+    job->scheduled_ = true;
+    job->ClearWeak();
+    FS_ASYNC_TRACE_BEGIN0(UV_FS_WRITE, job)
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    uv_fs_t req;
+    int fd = uv_fs_open(nullptr, &req, path_.c_str(), flags_, mode_, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (fd < 0) return Fail("open", fd);
+
+    size_t written = 0;
+    while (written < length_) {
+      uv_buf_t buf = uv_buf_init(data_ + written,
+                                 static_cast<unsigned int>(std::min<size_t>(
+                                     length_ - written, kMaxWriteChunk)));
+      int r = uv_fs_write(nullptr, &req, fd, &buf, 1, -1, nullptr);
+      uv_fs_req_cleanup(&req);
+      if (r < 0) {
+        Fail("write", r);
+        break;
+      }
+      written += static_cast<size_t>(r);
+    }
+
+    int rc = uv_fs_close(nullptr, &req, fd, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (rc < 0 && error_ == 0) Fail("close", rc);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<WriteFileJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    FS_ASYNC_TRACE_END0(UV_FS_WRITE, this)
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    HandleScope handle_scope(env->isolate());
+    Context::Scope context_scope(env->context());
+    Isolate* isolate = env->isolate();
+    Local<Value> argv[1] = {Null(isolate)};
+    if (error_ != 0) {
+      argv[0] = UVException(isolate,
+                            error_,
+                            syscall_,
+                            nullptr,
+                            syscall_ == kOpen ? path_.c_str() : nullptr);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    tracker->TrackField("buffer", buffer_);
+    if (copy_) tracker->TrackFieldWithSize("copy", length_);
+  }
+  SET_MEMORY_INFO_NAME(WriteFileJob)
+  SET_SELF_SIZE(WriteFileJob)
+
+ private:
+  static constexpr size_t kMaxWriteChunk = 256 * 1024 * 1024;
+  static constexpr const char* kOpen = "open";
+
+  WriteFileJob(Environment* env,
+               Local<Object> object,
+               std::string&& path,
+               int flags,
+               int mode,
+               Local<ArrayBufferView> view)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.writefile"),
+        path_(std::move(path)),
+        flags_(flags),
+        mode_(mode) {
+    // Holding the backing store keeps the memory valid even if the buffer is
+    // detached or collected meanwhile; a resizable buffer can still have its
+    // pages decommitted by a shrink, so its contents are copied instead.
+    length_ = view->ByteLength();
+    backing_store_ = view->Buffer()->GetBackingStore();
+    if (backing_store_->IsResizableByUserJavaScript()) {
+      copy_.reset(new char[length_]);
+      memcpy(copy_.get(),
+             static_cast<char*>(backing_store_->Data()) + view->ByteOffset(),
+             length_);
+      data_ = copy_.get();
+      backing_store_.reset();
+    } else {
+      buffer_.Reset(env->isolate(), view);
+      data_ = static_cast<char*>(backing_store_->Data()) + view->ByteOffset();
+    }
+    MakeWeak();
+  }
+
+  void Fail(const char* syscall, int error) {
+    syscall_ = syscall;
+    error_ = error;
+  }
+
+  const std::string path_;
+  v8::Global<v8::ArrayBufferView> buffer_;
+  std::shared_ptr<v8::BackingStore> backing_store_;
+  std::unique_ptr<char[]> copy_;
+  char* data_ = nullptr;
+  size_t length_ = 0;
+  const int flags_;
+  const int mode_;
+  bool scheduled_ = false;
+  int error_ = 0;
+  const char* syscall_ = nullptr;
+};
+
 // Wrapper for readv(2).
 //
 // bytesRead = fs.readv(fd, buffers[, position], callback)
@@ -5103,6 +5261,13 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetProtoMethod(isolate, rfj, "run", ReadFileJob::Run);
   SetConstructorFunction(isolate, target, "ReadFileJob", rfj);
 
+  Local<FunctionTemplate> wfj = NewFunctionTemplate(isolate, WriteFileJob::New);
+  wfj->InstanceTemplate()->SetInternalFieldCount(
+      WriteFileJob::kInternalFieldCount);
+  wfj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, wfj, "run", WriteFileJob::Run);
+  SetConstructorFunction(isolate, target, "WriteFileJob", wfj);
+
   // Create FunctionTemplate for FSReqCallback
   Local<FunctionTemplate> fst = NewFunctionTemplate(isolate, NewFSReqCallback);
   fst->InstanceTemplate()->SetInternalFieldCount(
@@ -5177,6 +5342,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Open);
   registry->Register(ReadFileJob::New);
   registry->Register(ReadFileJob::Run);
+  registry->Register(WriteFileJob::New);
+  registry->Register(WriteFileJob::Run);
   registry->Register(OpenFileHandle);
   registry->Register(Read);
   registry->Register(ReadFileUtf8);
diff --git a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
index 36ebc23491ca..b299a7d5d572 100644
--- a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
@@ -67,7 +67,9 @@ async function checkAggregateError(op) {
   tmpdir.refresh();
   await checkAggregateError((filePath) => truncate(filePath));
   await checkAggregateError((filePath) => readFile(filePath));
-  await checkAggregateError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkAggregateError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkAggregateError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-close-errors.js b/test/parallel/test-fs-promises-file-handle-close-errors.js
index 901e71c15ac5..c368f3acb931 100644
--- a/test/parallel/test-fs-promises-file-handle-close-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-close-errors.js
@@ -62,7 +62,9 @@ async function checkCloseError(op) {
   tmpdir.refresh();
   await checkCloseError((filePath) => truncate(filePath));
   await checkCloseError((filePath) => readFile(filePath));
-  await checkCloseError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkCloseError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkCloseError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-op-errors.js b/test/parallel/test-fs-promises-file-handle-op-errors.js
index 46b4acd0b8ff..d36056227841 100644
--- a/test/parallel/test-fs-promises-file-handle-op-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-op-errors.js
@@ -56,7 +56,9 @@ async function checkOperationError(op) {
   tmpdir.refresh();
   await checkOperationError((filePath) => truncate(filePath));
   await checkOperationError((filePath) => readFile(filePath));
-  await checkOperationError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkOperationError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkOperationError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-writefile-one-roundtrip.js b/test/parallel/test-fs-writefile-one-roundtrip.js
new file mode 100644
index 000000000000..bab6940eec26
--- /dev/null
+++ b/test/parallel/test-fs-writefile-one-roundtrip.js
@@ -0,0 +1,85 @@
+'use strict';
+// fs.writeFile() and fs.promises.writeFile() with a path perform
+// open + write + close as one thread pool request. This covers what that
+// request must keep doing: honor flags and mode, append, report the
+// failing syscall, accept every ArrayBufferView, write the data as it was at
+// the call even if the buffer is resized or detached right after, and write
+// buffers larger than one write() call in full.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { isMainThread } = require('worker_threads');
+
+tmpdir.refresh();
+let counter = 0;
+const next = () => tmpdir.resolve(`file-${counter++}`);
+
+async function check(write) {
+  {
+    const file = next();
+    await write(file, 'hello');
+    await write(file, ' world', { flag: 'a' });
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'hello world');
+    await assert.rejects(write(file, 'again', { flag: 'wx' }), { code: 'EEXIST', syscall: 'open', path: file });
+  }
+  {
+    const file = path.join(next(), 'missing-dir', 'file');
+    await assert.rejects(write(file, 'x'), { code: 'ENOENT', syscall: 'open', path: file });
+  }
+  {
+    const file = next();
+    await write(file, '');
+    assert.strictEqual(fs.statSync(file).size, 0);
+  }
+  if (!common.isWindows && isMainThread) {
+    const file = next();
+    const mask = process.umask(0o022);
+    await write(file, 'x', { mode: 0o640 });
+    process.umask(mask);
+    assert.strictEqual(fs.statSync(file).mode & 0o777, 0o640);
+  }
+  {
+    const file = next();
+    const units = new Uint16Array([0x6968]);
+    await write(file, units);
+    await write(file, new DataView(new TextEncoder().encode('!?').buffer, 1, 1), { flag: 'a' });
+    assert.deepStrictEqual(fs.readFileSync(file),
+                           Buffer.concat([Buffer.from(units.buffer), Buffer.from('?')]));
+  }
+  if (fs.existsSync('/dev/full')) {
+    // open() succeeds, write() fails.
+    await assert.rejects(write('/dev/full', 'x'), { code: 'ENOSPC', syscall: 'write' });
+  }
+  {
+    const file = next();
+    const resizable = new ArrayBuffer(64 * 1024, { maxByteLength: 128 * 1024 });
+    const view = new Uint8Array(resizable).fill(97);
+    const done = write(file, view);
+    resizable.resize(0);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'a'.repeat(64 * 1024));
+  }
+  {
+    const file = next();
+    const detached = new ArrayBuffer(1024);
+    const done = write(file, new Uint8Array(detached).fill(98));
+    detached.transfer(8);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'b'.repeat(1024));
+  }
+  {
+    const file = next();
+    const big = Buffer.alloc(3 * 1024 * 1024 + 7, 'z');
+    await write(file, big);
+    assert.deepStrictEqual(fs.readFileSync(file), big);
+  }
+}
+
+(async () => {
+  await check((file, data, options) => new Promise((resolve, reject) => {
+    fs.writeFile(file, data, options, (err) => (err ? reject(err) : resolve()));
+  }));
+  await check(fs.promises.writeFile);
+})().then(common.mustCall());
diff --git a/test/parallel/test-trace-events-fs-async.js b/test/parallel/test-trace-events-fs-async.js
index 9b8e21b3d560..2a658838b39e 100644
--- a/test/parallel/test-trace-events-fs-async.js
+++ b/test/parallel/test-trace-events-fs-async.js
@@ -47,8 +47,10 @@ function chown({ uid, gid }) {
 
 function close() {
   const fs = require('fs');
-  fs.writeFile('fs3.txt', '123', 'utf8', () => {
-    fs.unlinkSync('fs3.txt');
+  fs.open('fs3.txt', 'w', (err, fd) => {
+    fs.close(fd, () => {
+      fs.unlinkSync('fs3.txt');
+    });
   });
 }
 
@@ -173,7 +175,8 @@ function mktmp() {
 
 function open() {
   const fs = require('fs');
-  fs.writeFile('fs16.txt', '123', 'utf8', () => {
+  fs.open('fs16.txt', 'w', (err, fd) => {
+    fs.closeSync(fd);
     fs.unlinkSync('fs16.txt');
   });
 }

From c8e5c965e3af518fc41f744146e5d8774fba4f04 Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Thu, 3 Sep 2026 11:36:30 -0400
Subject: [PATCH 037/202] sqlite: re-validate database state after reading
 options

prepare(), function(), aggregate(), deserialize(), applyChangeset() and
backup() validated the connection, then read their options bag with
Object::Get(). A property getter runs arbitrary JavaScript at that
point, so a getter calling close() invalidates what was just checked.
Five of the six then passed a null sqlite3* to SQLite and crashed;
prepare() reported a spurious "out of memory".

Re-check IsOpen() after option parsing, immediately before the SQLite
call, keeping the early check so invalid calls still fail before any
user code runs. IsOpen() is the only condition a getter can change:
authorizer and callback depths are RAII-managed. createSession()
already parsed options first, so it only gains the early check.

deserialize() also latched the buffer length before reading
options.dbName. A getter that shrank the backing store left the length
too large; CopyContents() then handed the uninitialized remainder to
SQLite, from where serialize() returned it to JavaScript. Check the
CopyContents() result instead of discarding it.

function() and aggregate() cast the callback's length property with
As<Int32>() and no IsInt32() guard. length is configurable, so any type
reached the cast and produced a silently wrong arity.

Fixes: https://github.com/nodejs/node/issues/65586
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65595
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/sqlite.md                             |   6 +-
 src/node_sqlite.cc                            |  81 ++++-
 .../test-sqlite-options-getter-reentry.js     | 303 ++++++++++++++++++
 3 files changed, 379 insertions(+), 11 deletions(-)
 create mode 100644 test/parallel/test-sqlite-options-getter-reentry.js

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 8a875035f8cb..7d021381fc94 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -243,7 +243,8 @@ Registers a new aggregate function with the SQLite database. This method is a wr
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `options.step` and `options.inverse` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `inverse` and `step` must be invoked with exactly `length` arguments.
+    `inverse` and `step` must be invoked with exactly `length` arguments, and
+    their `length` properties must be integers.
     **Default:** `false`.
   * `start` {number | string | null | Array | Object | Function} The identity
     value for the aggregation function. This value is used when the aggregation
@@ -430,7 +431,8 @@ added:
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `function` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `function` must be invoked with exactly `function.length` arguments.
+    `function` must be invoked with exactly `function.length` arguments, which
+    must be an integer.
     **Default:** `false`.
 * `fn` {Function} The JavaScript function to call when the SQLite function is
   invoked. The return value of this function should be a valid SQLite data type:
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 1af30e214253..76accf1c2731 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1742,6 +1742,10 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Utf8Value sql(env->isolate(), args[0].As<String>());
   sqlite3_stmt* s = nullptr;
 
@@ -1929,9 +1933,22 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     if (!fn->Get(env->context(), env->length_string()).ToLocal(&js_len)) {
       return;
     }
+
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"function.length\" property must be an integer.");
+      return;
+    }
+
     argc = js_len.As<Int32>()->Value();
   }
 
+  // Reading the options bag and "function.length" above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   UserDefinedFunction* user_data = new UserDefinedFunction(
       env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
@@ -2094,6 +2111,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   // sqlite3_malloc64 is required because SQLITE_DESERIALIZE_FREEONCLOSE
   // transfers ownership to SQLite, which calls sqlite3_free() on close.
   // See: https://www.sqlite.org/c3ref/deserialize.html
@@ -2104,7 +2125,16 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  input->CopyContents(buf, byte_length);
+  // The same user JavaScript may also have shrunk or detached the backing
+  // store, in which case byte_length is stale and CopyContents() leaves the
+  // remainder of buf uninitialized. Handing that to SQLite would disclose it
+  // through serialize().
+  if (input->CopyContents(buf, byte_length) != byte_length) {
+    sqlite3_free(buf);
+    THROW_ERR_INVALID_STATE(
+        env, "The \"buffer\" argument was resized while reading \"options\"");
+    return;
+  }
 
   db->FinalizeStatements();
 
@@ -2242,17 +2272,37 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
       return;
     }
 
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"options.step.length\" property must be an integer.");
+      return;
+    }
+
     // Subtract 1 because the first argument is the aggregate value.
     argc = js_len.As<Int32>()->Value() - 1;
-    if (!inverseFunc.IsEmpty() &&
-        !inverseFunc->Get(env->context(), env->length_string())
-             .ToLocal(&js_len)) {
-      return;
+    if (!inverseFunc.IsEmpty()) {
+      if (!inverseFunc->Get(env->context(), env->length_string())
+               .ToLocal(&js_len)) {
+        return;
+      }
+
+      if (!js_len->IsInt32()) {
+        THROW_ERR_INVALID_ARG_TYPE(
+            env->isolate(),
+            "The \"options.inverse.length\" property must be an integer.");
+        return;
+      }
     }
 
     argc = std::max({argc, js_len.As<Int32>()->Value() - 1, 0});
   }
 
+  // Reading the options bag and the step/inverse "length" properties above can
+  // run user JavaScript through a property getter, which may have closed the
+  // database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   int text_rep = SQLITE_UTF8;
   if (direct_only) {
     text_rep |= SQLITE_DIRECTONLY;
@@ -2281,10 +2331,15 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
 }
 
 void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
+  DatabaseSync* db;
+  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
+
   std::string table;
   std::string db_name = "main";
 
-  Environment* env = Environment::GetCurrent(args);
   if (args.Length() > 0) {
     if (!args[0]->IsObject()) {
       THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2335,10 +2390,9 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  DatabaseSync* db;
-  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
-  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   sqlite3_session* pSession;
   int r =
@@ -2465,6 +2519,11 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the destination path and the options bag above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Local<Promise::Resolver> resolver;
   if (!Promise::Resolver::New(env->context()).ToLocal(&resolver)) {
     return;
@@ -2608,6 +2667,10 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   // Keep the database alive in case a callback drops all references to it,
   // which could otherwise let it be garbage-collected mid-callback.
   BaseObjectPtr<DatabaseSync> guard(db);
diff --git a/test/parallel/test-sqlite-options-getter-reentry.js b/test/parallel/test-sqlite-options-getter-reentry.js
new file mode 100644
index 000000000000..495b85db92fb
--- /dev/null
+++ b/test/parallel/test-sqlite-options-getter-reentry.js
@@ -0,0 +1,303 @@
+'use strict';
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const tmpdir = require('../common/tmpdir');
+const { join } = require('node:path');
+const { backup, DatabaseSync } = require('node:sqlite');
+const { suite, test } = require('node:test');
+
+tmpdir.refresh();
+
+const invalidState = {
+  code: 'ERR_INVALID_STATE',
+  message: /database is not open/,
+};
+
+// A property getter on the options bag runs arbitrary JavaScript in the middle
+// of the call, so state validated before the options were read can be stale by
+// the time it is used.
+suite('closing the database from an options getter', () => {
+  test('prepare() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.prepare('SELECT 1', {
+        get returnArrays() {
+          db.close();
+          return false;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('function() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.function('fn', {
+        get useBigIntArguments() {
+          db.close();
+          return false;
+        },
+      }, () => 1);
+    }, invalidState);
+  });
+
+  test('function() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const fn = () => 1;
+    Object.defineProperty(fn, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 0;
+      },
+    });
+    t.assert.throws(() => {
+      db.function('fn', fn);
+    }, invalidState);
+  });
+
+  test('aggregate() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.aggregate('agg', {
+        get start() {
+          db.close();
+          return 0;
+        },
+        step: (acc, value) => acc,
+      });
+    }, invalidState);
+  });
+
+  test('aggregate() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const step = (acc, value) => acc;
+    Object.defineProperty(step, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 2;
+      },
+    });
+    t.assert.throws(() => {
+      db.aggregate('agg', { start: 0, step });
+    }, invalidState);
+  });
+
+  test('deserialize() throws instead of using a closed connection', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(image, {
+        get dbName() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('createSession() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.createSession({
+        get db() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('applyChangeset() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    const session = db.createSession();
+    db.exec('INSERT INTO data (key) VALUES (1)');
+    const changeset = session.changeset();
+
+    t.assert.throws(() => {
+      db.applyChangeset(changeset, {
+        get onConflict() {
+          db.close();
+          return undefined;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('backup() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      backup(db, join(tmpdir.path, 'getter-backup.db'), {
+        get rate() {
+          db.close();
+          return 1;
+        },
+      });
+    }, invalidState);
+  });
+});
+
+// The state check runs before the options bag is read, so a call that is
+// already doomed must not execute any of the caller's getters.
+test('options getters do not run on an already-closed database', (t) => {
+  const source = new DatabaseSync(':memory:');
+  source.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  const image = source.serialize();
+  const session = source.createSession();
+  source.exec('INSERT INTO data (key) VALUES (1)');
+  const changeset = session.changeset();
+
+  const cases = {
+    prepare: (db, options) => db.prepare('SELECT 1', options),
+    function: (db, options) => db.function('fn', options, () => 1),
+    aggregate: (db, options) => db.aggregate('agg', options),
+    deserialize: (db, options) => db.deserialize(image, options),
+    createSession: (db, options) => db.createSession(options),
+    applyChangeset: (db, options) => db.applyChangeset(changeset, options),
+    backup: (db, options) =>
+      backup(db, join(tmpdir.path, 'closed-backup.db'), options),
+  };
+
+  // The property each method reads first, and a valid value for it, so that a
+  // getter which does run leaves the "did not run" assertion as the failure
+  // rather than a type error from the returned value.
+  const probes = {
+    prepare: ['returnArrays', false],
+    function: ['useBigIntArguments', false],
+    aggregate: ['start', 0],
+    deserialize: ['dbName', 'main'],
+    createSession: ['db', 'main'],
+    applyChangeset: ['onConflict', undefined],
+    backup: ['rate', 1],
+  };
+
+  for (const [name, invoke] of Object.entries(cases)) {
+    const db = new DatabaseSync(':memory:');
+    db.close();
+
+    const [key, value] = probes[name];
+    let ran = false;
+    const options = {
+      get [key]() {
+        ran = true;
+        return value;
+      },
+    };
+
+    t.assert.throws(() => invoke(db, options), invalidState, name);
+    t.assert.strictEqual(ran, false, `${name} ran an options getter`);
+  }
+});
+
+suite('resizing a deserialize() buffer from an options getter', () => {
+  test('throws rather than handing uninitialized memory to SQLite', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    source.prepare('INSERT INTO data (value) VALUES (?)').run('hello');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength, {
+      maxByteLength: image.byteLength,
+    });
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          buffer.resize(1024);
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+
+  test('throws when the buffer is detached', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength);
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          structuredClone(buffer, { transfer: [buffer] });
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+});
+
+// fn.length is configurable, so it must be validated rather than cast blindly.
+suite('non-integer callback length', () => {
+  const badLengths = ['abc', {}, [], null, undefined, NaN, 1.5, Symbol.iterator,
+                      10n, true, 2 ** 40];
+
+  test('function() rejects a non-integer length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const fn = () => 1;
+      Object.defineProperty(fn, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.function('fn', fn);
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "function\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('aggregate() rejects a non-integer step length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const step = (acc, next) => acc;
+      Object.defineProperty(step, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.aggregate('agg', { start: 0, step, result: (acc) => acc });
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "options\.step\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('aggregate() rejects a non-integer inverse length', (t) => {
+    const db = new DatabaseSync(':memory:');
+    for (const value of badLengths) {
+      const inverse = (acc, next) => acc;
+      Object.defineProperty(inverse, 'length', { configurable: true, value });
+      t.assert.throws(() => {
+        db.aggregate('agg', {
+          start: 0,
+          step: (acc, next) => acc,
+          inverse,
+          result: (acc) => acc,
+        });
+      }, {
+        code: 'ERR_INVALID_ARG_TYPE',
+        message: /The "options\.inverse\.length" property must be an integer/,
+      }, `length=${String(value)}`);
+    }
+  });
+
+  test('a normal function length is still accepted', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.function('plus', (a, b) => a + b);
+    t.assert.strictEqual(db.prepare('SELECT plus(1, 2) AS v').get().v, 3);
+  });
+});

From 06d23c293c7846e951b2e008e7009f1b39a86018 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Thu, 27 Aug 2026 21:14:51 +0000
Subject: [PATCH 038/202] perf_hooks: implement Histogram meanCI API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/api/perf_hooks.md                         | 35 ++++++++
 lib/internal/histogram.js                     | 24 ++++++
 src/histogram.cc                              | 76 +++++++++++++----
 src/histogram.h                               | 10 ++-
 .../test-perf-hooks-histogram-stats.js        | 81 +++++++++++++++++++
 5 files changed, 208 insertions(+), 18 deletions(-)

diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 34504245421b..8df9716fa732 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -2286,6 +2286,41 @@ added: v11.10.0
 
 The mean of the recorded event loop delays.
 
+### `histogram.meanCI([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `confidence` {number} The confidence level for the interval, between
+    0 and 1 (exclusive). **Default:** `0.95`.
+* Returns: {Object}
+  * `mean` {number} The mean estimate, equivalent to `histogram.mean`.
+  * `lower` {number} The lower bound of the confidence interval.
+  * `upper` {number} The upper bound of the confidence interval.
+
+Returns a two-sided confidence interval for the mean using Student's
+t-distribution and the sample standard error. A higher confidence level
+produces a wider interval. This interval assumes that samples are independent
+and approximately normally distributed, although the approximation is robust
+for sufficiently large samples.
+
+The result reflects the histogram's configured precision and is calculated
+from the values represented by its buckets. With fewer than two recorded
+values, `lower` and `upper` are `NaN`. When all recorded values are equal,
+`lower` and `upper` equal `mean`.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 100; i++) h.record(i);
+
+const { mean, lower, upper } = h.meanCI();
+console.log(`mean=${mean}, 95% CI=[${lower}, ${upper}]`);
+```
+
 ### `histogram.min`
 
 <!-- YAML
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index febb696d5e22..f325adab484e 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -197,6 +197,30 @@ class Histogram {
     return this[kHandle]?.mean();
   }
 
+  /**
+   * Returns a confidence interval for the mean using Student's t-distribution.
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ mean: number, lower: number, upper: number }}
+   */
+  meanCI(options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.meanCI(confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      mean: result[0],
+      lower: result[1],
+      upper: result[2],
+    };
+  }
+
   /**
    * @readonly
    * @type {number}
diff --git a/src/histogram.cc b/src/histogram.cc
index 1a852dcf3f88..1008c63c04d4 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -298,28 +298,29 @@ static double NormalCdf(double x) {
 
 // Student's t-distribution CDF: P(T <= t) for df degrees of freedom.
 static double StudentTCdf(double t, double df) {
-  double x = df / (df + t * t);
-  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
-  if (t >= 0.0) {
-    return 1.0 - 0.5 * ibeta;
+  double squared = t * t;
+  double denominator = df + squared;
+  if (squared < df) {
+    double x = squared / denominator;
+    double ibeta = RegularizedIncompleteBeta(0.5, df / 2.0, x);
+    return t >= 0.0 ? 0.5 + 0.5 * ibeta : 0.5 - 0.5 * ibeta;
   }
-  return 0.5 * ibeta;
+
+  double x = df / denominator;
+  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
+  return t >= 0.0 ? 1.0 - 0.5 * ibeta : 0.5 * ibeta;
 }
 
-// Student's t-distribution quantile (inverse CDF) using bisection.
-// Returns the value t such that P(T <= t) = p.
-static double StudentTQuantile(double p, double df) {
-  if (p <= 0.0) return -std::numeric_limits<double>::infinity();
-  if (p >= 1.0) return std::numeric_limits<double>::infinity();
-  if (p == 0.5) return 0.0;
+// Positive Student's t-distribution quantile for an upper-tail probability.
+// Using the lower tail avoids loss of precision for probabilities near 1.
+static double StudentTUpperQuantile(double p, double df) {
+  double lo = 0.0;
+  double hi = 1.0;
+  while (StudentTCdf(-hi, df) > p) hi *= 2.0;
 
-  // Bisection search. The range [-1e6, 1e6] is sufficient for any
-  // practical confidence level and degrees of freedom.
-  double lo = -1e6;
-  double hi = 1e6;
   for (int i = 0; i < 100; i++) {
     double mid = (lo + hi) / 2.0;
-    if (StudentTCdf(mid, df) < p) {
+    if (StudentTCdf(-mid, df) > p) {
       lo = mid;
     } else {
       hi = mid;
@@ -482,6 +483,30 @@ constexpr uint64_t kEwmaErrorRate = 3;
 constexpr uint64_t kEwmaThreshold = 4;
 }  // namespace
 
+Histogram::MeanCIResult Histogram::MeanCI(double confidence) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t count = histogram_->total_count;
+  double mean = hdr_mean(histogram_.get());
+  if (count < 2) {
+    double nan = std::numeric_limits<double>::quiet_NaN();
+    return {mean, nan, nan};
+  }
+
+  double stddev = hdr_stddev(histogram_.get());
+  if (stddev == 0.0) return {mean, mean, mean};
+
+  // HdrHistogram computes population stddev (divides by N). The confidence
+  // interval requires sample variance (divides by N-1).
+  double variance = stddev * stddev * static_cast<double>(count) /
+                    static_cast<double>(count - 1);
+  double standard_error = std::sqrt(variance / static_cast<double>(count));
+  double alpha = 1.0 - confidence;
+  double t_crit = StudentTUpperQuantile(
+      alpha / 2.0, static_cast<double>(count - 1));
+  double margin = t_crit * standard_error;
+  return {mean, mean - margin, mean + margin};
+}
+
 Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
                                                 double confidence) const {
   auto do_welch = [&]() -> WelchTestResult {
@@ -517,7 +542,7 @@ Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
 
     // Confidence interval on the difference of means.
     double alpha = 1.0 - confidence;
-    double t_crit = StudentTQuantile(1.0 - alpha / 2.0, df);
+    double t_crit = StudentTUpperQuantile(alpha / 2.0, df);
     double margin = t_crit * std::sqrt(se_sum);
     double diff = mean1 - mean2;
 
@@ -1133,6 +1158,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
   SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
   SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "meanCI", GetMeanCI);
   SetProtoMethodNoSideEffect(isolate, tmpl, "welchTest", GetWelchTest);
   SetProtoMethodNoSideEffect(
       isolate, tmpl, "mannWhitneyTest", GetMannWhitneyTest);
@@ -1187,6 +1213,7 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetPercentilesAt);
   registry->Register(GetLinearBuckets);
   registry->Register(GetLogBuckets);
+  registry->Register(GetMeanCI);
   registry->Register(GetWelchTest);
   registry->Register(GetMannWhitneyTest);
   registry->Register(GetCohensD);
@@ -1895,6 +1922,21 @@ void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
 }
 
+void HistogramImpl::GetMeanCI(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  double confidence = args[0].As<Number>()->Value();
+
+  auto result = (*histogram)->MeanCI(confidence);
+
+  Local<Value> values[] = {Number::New(isolate, result.mean),
+                           Number::New(isolate, result.lower),
+                           Number::New(isolate, result.upper)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
 void HistogramImpl::GetWelchTest(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
diff --git a/src/histogram.h b/src/histogram.h
index 05d6003c25cc..2af0e4a4f82e 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -80,7 +80,13 @@ class Histogram : public MemoryRetainer {
                      int64_t* values,
                      size_t length) const;
 
-  // Statistical hypothesis testing
+  // Statistical analysis
+  struct MeanCIResult {
+    double mean;
+    double lower;
+    double upper;
+  };
+
   struct WelchTestResult {
     double t_statistic;
     double degrees_of_freedom;
@@ -101,6 +107,7 @@ class Histogram : public MemoryRetainer {
     int64_t upper;
   };
 
+  MeanCIResult MeanCI(double confidence = 0.95) const;
   WelchTestResult WelchTest(const Histogram& other,
                             double confidence = 0.95) const;
   MannWhitneyResult MannWhitneyTest(const Histogram& other) const;
@@ -189,6 +196,7 @@ class HistogramImpl {
   static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMeanCI(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetWelchTest(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetMannWhitneyTest(
       const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/test/parallel/test-perf-hooks-histogram-stats.js b/test/parallel/test-perf-hooks-histogram-stats.js
index 61a3894924ff..581579d12686 100644
--- a/test/parallel/test-perf-hooks-histogram-stats.js
+++ b/test/parallel/test-perf-hooks-histogram-stats.js
@@ -5,6 +5,85 @@ require('../common');
 const assert = require('assert');
 const { createHistogram, importHistogram } = require('perf_hooks');
 
+// ---------------------------------------------------------------------------
+// meanCI([options]) — confidence interval for the mean
+// ---------------------------------------------------------------------------
+{
+  const empty = createHistogram();
+  const emptyCI = empty.meanCI();
+  assert.strictEqual(Object.getPrototypeOf(emptyCI), null);
+  assert.ok(Number.isNaN(emptyCI.mean));
+  assert.ok(Number.isNaN(emptyCI.lower));
+  assert.ok(Number.isNaN(emptyCI.upper));
+
+  // A confidence interval is undefined with fewer than two samples.
+  const one = createHistogram();
+  one.record(42);
+  const oneCI = one.meanCI();
+  assert.strictEqual(oneCI.mean, 42);
+  assert.ok(Number.isNaN(oneCI.lower));
+  assert.ok(Number.isNaN(oneCI.upper));
+
+  // This known sample has a 95% Student's t confidence interval of
+  // approximately [3.334149, 7.665851].
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+  const ci95 = h.meanCI();
+  assert.strictEqual(ci95.mean, h.mean);
+  assert.ok(Math.abs(ci95.lower - 3.3341494103866087) < 1e-6);
+  assert.ok(Math.abs(ci95.upper - 7.665850589613392) < 1e-6);
+
+  // Higher confidence produces a wider interval.
+  const ci90 = h.meanCI({ confidence: 0.90 });
+  const ci99 = h.meanCI({ confidence: 0.99 });
+  assert.ok((ci99.upper - ci99.lower) > (ci90.upper - ci90.lower));
+
+  // Very low confidence levels retain precision near the center of the
+  // distribution. With two samples, the t-distribution has one degree of
+  // freedom and the expected interval width is tan(pi * confidence / 2).
+  const two = createHistogram();
+  two.record(1);
+  two.record(2);
+  const lowConfidence = 1e-9;
+  const narrowCI = two.meanCI({ confidence: lowConfidence });
+  const expectedWidth = Math.tan(Math.PI * lowConfidence / 2);
+  const actualWidth = narrowCI.upper - narrowCI.lower;
+  assert.ok(Math.abs(actualWidth - expectedWidth) / expectedWidth < 1e-4);
+
+  // Very high confidence levels are not truncated by the quantile search.
+  const extremeCI = two.meanCI({ confidence: 0.9999999 });
+  assert.ok(extremeCI.lower < -3_000_000);
+  assert.ok(extremeCI.upper > 3_000_000);
+
+  const highestCI = two.meanCI({
+    confidence: 1 - Number.EPSILON / 2,
+  });
+  assert.ok(Number.isFinite(highestCI.lower));
+  assert.ok(Number.isFinite(highestCI.upper));
+
+  // Constant values have no sampling uncertainty.
+  const constant = createHistogram();
+  for (let i = 0; i < 100; i++) constant.record(7);
+  assert.deepStrictEqual(constant.meanCI(), {
+    __proto__: null,
+    mean: 7,
+    lower: 7,
+    upper: 7,
+  });
+
+  // Validation.
+  assert.throws(() => h.meanCI({ confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: NaN }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.meanCI(null),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 // ---------------------------------------------------------------------------
 // welchTest(other) — Welch's t-test
 // ---------------------------------------------------------------------------
@@ -586,6 +665,7 @@ const { createHistogram, importHistogram } = require('perf_hooks');
   const wrongThis = {};
 
   const methods = [
+    ['meanCI', []],
     ['welchTest', [h]],
     ['mannWhitneyTest', [h]],
     ['cohensD', [h]],
@@ -633,6 +713,7 @@ const { createHistogram, importHistogram } = require('perf_hooks');
   stub[kHandle] = null;
 
   assert.strictEqual(stub.welchTest(h), undefined);
+  assert.strictEqual(stub.meanCI(), undefined);
   assert.strictEqual(stub.mannWhitneyTest(h), undefined);
   assert.strictEqual(stub.percentileCI(50), undefined);
   assert.strictEqual(stub.burnRate(0.999), undefined);

From 4d2f7a6f4c02b2d7f757acc143073deb15c7de45 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Thu, 27 Aug 2026 22:18:51 +0000
Subject: [PATCH 039/202] lib: implement node:bench
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/api/bench.md                              | 354 +++++++++
 doc/api/index.md                              |   1 +
 lib/bench.js                                  |  30 +
 lib/internal/bench_runner/benchmark.js        | 411 +++++++++++
 .../bench_runner/benchmarks_stream.js         |  74 ++
 lib/internal/bench_runner/harness.js          | 687 ++++++++++++++++++
 lib/internal/bench_runner/runner.js           |  12 +
 lib/internal/bootstrap/realm.js               |   1 +
 .../test-module-hooks-builtin-require.js      |   1 +
 .../test-module-hooks-load-builtin-require.js |   1 +
 test/parallel/test-bench-auto-run.js          |  28 +
 test/parallel/test-bench-errors.js            | 104 +++
 test/parallel/test-bench-filtering.js         |  41 ++
 test/parallel/test-bench-hook-errors.js       |  84 +++
 test/parallel/test-bench-module.mjs           |  41 ++
 test/parallel/test-bench-run.js               | 139 ++++
 test/parallel/test-bench-validation.js        |  45 ++
 test/parallel/test-module-isBuiltin.js        |   2 +
 18 files changed, 2056 insertions(+)
 create mode 100644 doc/api/bench.md
 create mode 100644 lib/bench.js
 create mode 100644 lib/internal/bench_runner/benchmark.js
 create mode 100644 lib/internal/bench_runner/benchmarks_stream.js
 create mode 100644 lib/internal/bench_runner/harness.js
 create mode 100644 lib/internal/bench_runner/runner.js
 create mode 100644 test/parallel/test-bench-auto-run.js
 create mode 100644 test/parallel/test-bench-errors.js
 create mode 100644 test/parallel/test-bench-filtering.js
 create mode 100644 test/parallel/test-bench-hook-errors.js
 create mode 100644 test/parallel/test-bench-module.mjs
 create mode 100644 test/parallel/test-bench-run.js
 create mode 100644 test/parallel/test-bench-validation.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
new file mode 100644
index 000000000000..93b303fb2e2d
--- /dev/null
+++ b/doc/api/bench.md
@@ -0,0 +1,354 @@
+# Benchmark runner
+
+<!--introduced_in=REPLACEME-->
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+<!-- source_link=lib/bench.js -->
+
+The `node:bench` module supports defining and running JavaScript benchmarks in
+the current process. To access it:
+
+```mjs
+import { bench, suite } from 'node:bench';
+```
+
+```cjs
+const { bench, suite } = require('node:bench');
+```
+
+This module is only available under the `node:` scheme.
+
+```mjs
+import { bench, suite } from 'node:bench';
+
+suite('URL', () => {
+  const input = 'https://example.com/a?b=c';
+
+  bench('construct', {
+    samples: 30,
+    params: { input: 'short' },
+  }, (b) => {
+    const operations = 10_000;
+
+    b.start();
+    for (let i = 0; i < operations; i++) {
+      new URL(input);
+    }
+    b.end(operations);
+  });
+});
+```
+
+Benchmarks are executed serially in declaration order. Declared benchmarks are
+scheduled automatically. Call `run()` during the same turn as the declarations
+to consume the event stream or configure filtering.
+If an automatically scheduled run fails and `run()` was not called, the process
+exit code is set to `1`.
+
+## Measurement model
+
+Each warmup and measured sample invokes the benchmark function once with a
+fresh {BenchContext}. The function must call `context.start()` and
+`context.end(operations)` exactly once. Setup before `start()` and cleanup after
+`end()` are outside the measured region. Promise-returning functions are
+awaited.
+
+An event loop turn occurs between sample invocations. The runner executes
+benchmarks serially, but it does not provide process isolation. Other work in
+the process, JIT compilation, garbage collection, CPU frequency changes, and
+system load can all affect results. Keep raw samples when comparing results and
+investigate noisy or skewed distributions rather than treating a confidence
+interval as a pass/fail threshold.
+
+## `bench([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string} The benchmark name. **Default:** The `name` property of `fn`,
+  or `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `only` {boolean} When any benchmark or containing suite has `only` set,
+    benchmarks without `only` in their hierarchy are skipped. **Default:**
+    `false`.
+  * `params` {Object} String, finite number, or boolean metadata identifying
+    this benchmark configuration. Parameter keys are sorted when constructing
+    the stable benchmark identity. **Default:** An empty object.
+  * `samples` {number} The number of measured callback invocations. Must be a
+    positive 32-bit unsigned integer. **Default:** `30`.
+  * `signal` {AbortSignal} Allows aborting this benchmark.
+  * `skip` {boolean|string} If truthy, the benchmark is skipped. A string is
+    included in the result as the skip reason. **Default:** `false`.
+  * `tags` {string\[]} Labels associated with the benchmark. Tags are
+    lowercased, deduplicated, and inherited from containing suites by union.
+    **Default:** `[]`.
+  * `timeout` {number} The number of milliseconds after which the benchmark
+    fails. **Default:** `Infinity`.
+  * `warmup` {number} The number of unreported callback invocations before
+    measured samples. Must be a 32-bit unsigned integer. **Default:** `0`.
+* `fn` {Function|AsyncFunction} The benchmark function. It receives a
+  {BenchContext}.
+* Returns: {Promise} Fulfilled with the benchmark result after a top-level
+  benchmark finishes, or with `undefined` immediately when declared in a
+  suite.
+
+Warmup invocations use the same callback and timing contract as measured
+samples, but their samples are discarded. An exception, rejection, timeout,
+abort, missing timing call, or duplicate timing call stops the current
+benchmark. Later benchmarks continue to run.
+
+A timeout or abort cannot interrupt synchronous JavaScript and does not forcibly
+cancel asynchronous work that ignores `context.signal`.
+
+The stable `benchId` is based on the source file, hierarchical suite and
+benchmark names, and canonicalized parameters. Declaring the same identity
+more than once reports an error rather than merging the samples.
+
+### `bench.skip([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Shorthand for `bench(name, { ...options, skip: true }, fn)`.
+
+### `bench.only([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Shorthand for `bench(name, { ...options, only: true }, fn)`.
+
+## `suite([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string} The suite name. **Default:** The `name` property of `fn`, or
+  `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `only` {boolean} Selects all benchmarks nested in this suite. **Default:**
+    `false`.
+  * `skip` {boolean|string} Skips all benchmarks nested in this suite.
+    **Default:** `false`.
+  * `tags` {string\[]} Labels inherited by nested suites and benchmarks.
+    **Default:** `[]`.
+* `fn` {Function|AsyncFunction} A function that declares nested suites,
+  benchmarks, and hooks.
+* Returns: {Promise} Fulfilled when a top-level suite finishes, or with
+  `undefined` immediately when declared in another suite.
+
+Suite functions run while declarations are collected. Promise-returning suite
+functions are awaited before benchmark execution begins.
+
+## `describe([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Alias for `suite()`.
+
+## `before(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once before the benchmarks in the current suite.
+
+## `after(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once after the benchmarks in the current suite.
+
+## `beforeEach(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once before each complete logical benchmark in the
+current suite. It does not run before every sample. Per-sample setup belongs in
+the benchmark function before `context.start()`.
+
+## `afterEach(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once after each complete logical benchmark in the
+current suite. It does not run after every sample. Per-sample cleanup belongs
+in the benchmark function after `context.end()`.
+
+## `run([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `namePattern` {string|RegExp} Only runs benchmarks whose full hierarchical
+    name matches the pattern. String values are interpreted as JavaScript
+    regular expressions.
+  * `signal` {AbortSignal} Allows aborting in-progress benchmark execution.
+* Returns: {BenchmarksStream}
+
+Returns the object-mode event stream for the in-process benchmark run. Call
+`run()` during the same turn in which benchmarks are declared, before automatic
+execution begins. Calling `run()` is optional when the returned stream is not
+needed.
+
+```mjs
+import { bench, run } from 'node:bench';
+
+bench('example', { samples: 3 }, (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+for await (const { type, data } of run()) {
+  if (type === 'bench:complete' && data.error === undefined) {
+    console.log(data.name, data.summary.mean);
+  }
+}
+```
+
+## Class: `BenchContext`
+
+An instance of `BenchContext` is passed to every benchmark invocation. A new
+instance is created for every warmup and measured sample.
+
+### `context.name`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {string}
+
+The benchmark name.
+
+### `context.params`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {Object}
+
+The benchmark's canonicalized parameter metadata.
+
+### `context.signal`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {AbortSignal}
+
+An abort signal that is triggered when the benchmark is aborted, times out, or
+finishes.
+
+### `context.start()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Starts the measured region using `process.hrtime.bigint()`. Calling `start()`
+more than once is an error.
+
+### `context.end(operations)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `operations` {number} The number of completed operations. Must be a positive
+  safe integer.
+
+Ends the measured region. The end timestamp is captured before `operations` is
+validated. Calling `end()` before `start()`, calling it more than once, or
+recording a zero-duration sample is an error.
+
+## Class: `BenchmarksStream`
+
+`BenchmarksStream` is an object-mode {stream.Readable}. Each lifecycle record is
+both emitted as a named event and made available on the stream as
+`{ type, data }`.
+
+The events are emitted in execution order:
+
+* `'bench:start'`
+* `'bench:sample'`
+* `'bench:complete'`
+* `'bench:diagnostic'`
+* `'bench:summary'`
+
+Every benchmark-scoped event contains `benchId` and `parentId`.
+`'bench:complete'` data contains a [benchmark result][]. A failed result has an
+additional `error` property and may contain samples recorded before the error.
+A skipped result has an additional `skip` property and an empty `samples`
+array. `'bench:diagnostic'` reports suite and hook errors. `'bench:summary'`
+contains overall `success`, `counts`, `duration_ns`, and `file` properties.
+
+## Sample result
+
+Each measured sample has the following properties:
+
+* `operations` {number} The positive operation count passed to
+  `context.end()`.
+* `duration_ns` {bigint} The measured duration in nanoseconds.
+* `rate` {number} Operations per second.
+
+## Benchmark result
+
+A completed benchmark result contains:
+
+* `benchId` {string} The stable benchmark identity.
+* `parentId` {string|null} The stable containing suite identity.
+* `name` {string} The benchmark name.
+* `file` {string} The source file.
+* `line` {number} The source line.
+* `column` {number} The source column.
+* `tags` {string\[]} The inherited canonical tags.
+* `params` {Object} The canonical parameter metadata.
+* `samples` {Object\[]} The exact measured samples.
+* `summary` {Object}
+  * `mean` {number} The arithmetic mean of per-sample rates.
+  * `median` {number} The median per-sample rate.
+  * `min` {number} The minimum per-sample rate.
+  * `max` {number} The maximum per-sample rate.
+  * `stddev` {number} The population standard deviation of rates.
+  * `coefficientOfVariation` {number} `stddev / mean`.
+  * `confidenceInterval` {Object} The 95% Student's t confidence interval for
+    the mean rate, with `lower` and `upper` properties.
+  * `medianConfidenceInterval` {Object} The 95% nonparametric confidence
+    interval for the median rate, with `lower` and `upper` properties.
+  * `skewness` {number} The skewness of the scaled rate histogram.
+
+[benchmark result]: #benchmark-result
diff --git a/doc/api/index.md b/doc/api/index.md
index 146c0e13df65..a30724c064e1 100644
--- a/doc/api/index.md
+++ b/doc/api/index.md
@@ -9,6 +9,7 @@
 * [Assertion testing](assert.md)
 * [Asynchronous context tracking](async_context.md)
 * [Async hooks](async_hooks.md)
+* [Benchmark runner](bench.md)
 * [Buffer](buffer.md)
 * [C++ addons](addons.md)
 * [C/C++ addons with Node-API](n-api.md)
diff --git a/lib/bench.js b/lib/bench.js
new file mode 100644
index 000000000000..454fad4f8570
--- /dev/null
+++ b/lib/bench.js
@@ -0,0 +1,30 @@
+'use strict';
+
+const {
+  ObjectAssign,
+} = primordials;
+
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  suite,
+} = require('internal/bench_runner/harness');
+const { run } = require('internal/bench_runner/runner');
+
+emitExperimentalWarning('Benchmarks');
+
+module.exports = bench;
+ObjectAssign(module.exports, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  describe: suite,
+  run,
+  suite,
+});
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
new file mode 100644
index 000000000000..27f372d7295f
--- /dev/null
+++ b/lib/internal/bench_runner/benchmark.js
@@ -0,0 +1,411 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSort,
+  JSONStringify,
+  MathFloor,
+  MathMax,
+  MathMin,
+  MathRound,
+  MathSqrt,
+  Number,
+  NumberIsFinite,
+  NumberMAX_SAFE_INTEGER,
+  ObjectFreeze,
+  ObjectKeys,
+  PromiseWithResolvers,
+  SafeSet,
+  StringPrototypeToLowerCase,
+} = primordials;
+const { AsyncResource } = require('async_hooks');
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+    ERR_OUT_OF_RANGE,
+  },
+} = require('internal/errors');
+const { createHistogram } = require('internal/histogram');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateFunction,
+  validateInteger,
+  validateNumber,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+
+const { bigint: hrtime } = process.hrtime;
+const kDefaultSamples = 30;
+const kDefaultWarmup = 0;
+const kEmptyParams = ObjectFreeze({ __proto__: null });
+const kEmptyTags = ObjectFreeze([]);
+
+function validateSkip(skip) {
+  if (skip !== undefined && typeof skip !== 'boolean' &&
+      typeof skip !== 'string') {
+    throw new ERR_INVALID_ARG_TYPE('options.skip', ['boolean', 'string'], skip);
+  }
+}
+
+function canonicalizeTags(tags, parentTags = kEmptyTags) {
+  if (tags === undefined) return parentTags;
+  if (!ArrayIsArray(tags)) {
+    throw new ERR_INVALID_ARG_TYPE('options.tags', 'Array', tags);
+  }
+
+  const result = ArrayPrototypeSlice(parentTags);
+  const seen = new SafeSet(parentTags);
+  for (let i = 0; i < tags.length; i++) {
+    validateString(tags[i], `options.tags[${i}]`);
+    if (tags[i].length === 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        `options.tags[${i}]`, tags[i], 'must not be empty');
+    }
+    const tag = StringPrototypeToLowerCase(tags[i]);
+    if (!seen.has(tag)) {
+      seen.add(tag);
+      ArrayPrototypePush(result, tag);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeParams(params) {
+  if (params === undefined) return kEmptyParams;
+  validateObject(params, 'options.params');
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(params);
+  ArrayPrototypeSort(keys);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const value = params[key];
+    if (typeof value !== 'string' && typeof value !== 'boolean' &&
+        (typeof value !== 'number' || !NumberIsFinite(value))) {
+      if (typeof value === 'number') {
+        throw new ERR_OUT_OF_RANGE(
+          `options.params.${key}`, 'a finite number', value);
+      }
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.params.${key}`, ['string', 'number', 'boolean'], value);
+    }
+    result[key] = value;
+  }
+  return ObjectFreeze(result);
+}
+
+function validateNodeOptions(options, parentTags) {
+  validateObject(options, 'options');
+  const { only = false, skip, tags } = options;
+  if (typeof only !== 'boolean') {
+    throw new ERR_INVALID_ARG_TYPE('options.only', 'boolean', only);
+  }
+  validateSkip(skip);
+  return {
+    __proto__: null,
+    only,
+    skip,
+    tags: canonicalizeTags(tags, parentTags),
+  };
+}
+
+function createLocation(loc, fallbackFile) {
+  return {
+    __proto__: null,
+    file: loc?.[2] ?? fallbackFile,
+    line: loc?.[0],
+    column: loc?.[1],
+  };
+}
+
+function getNamePath(parent, name) {
+  const path = [];
+  for (let current = parent; current?.parent !== null; current = current.parent) {
+    ArrayPrototypePush(path, current.name);
+  }
+  ArrayPrototypeReverse(path);
+  ArrayPrototypePush(path, name);
+  return path;
+}
+
+class Suite extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc, isRoot = false) {
+    super('BenchSuite');
+    const validated = validateNodeOptions(
+      options, parent?.tags ?? kEmptyTags);
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.isRoot = isRoot;
+    this.children = [];
+    this.hooks = {
+      __proto__: null,
+      after: [],
+      afterEach: [],
+      before: [],
+      beforeEach: [],
+    };
+    this.buildError = null;
+    this.buildPromise = null;
+    this.finished = false;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class Bench extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc) {
+    super('Benchmark');
+    const validated = validateNodeOptions(options, parent.tags);
+    const {
+      params,
+      samples = kDefaultSamples,
+      signal,
+      timeout = Infinity,
+      warmup = kDefaultWarmup,
+    } = options;
+
+    validateUint32(samples, 'options.samples', true);
+    validateUint32(warmup, 'options.warmup');
+    validateAbortSignal(signal, 'options.signal');
+    if (timeout !== Infinity) {
+      validateNumber(timeout, 'options.timeout', 0, TIMEOUT_MAX);
+    }
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.params = canonicalizeParams(params);
+    this.samples = samples;
+    this.warmup = warmup;
+    this.timeout = timeout;
+    this.outerSignal = signal;
+    this.namePath = getNamePath(parent, name);
+    this.fullName = ArrayPrototypeJoin(this.namePath, ' ');
+    this.benchId = JSONStringify([
+      this.loc.file,
+      this.namePath,
+      this.params,
+    ]);
+    this.parentId = parent.isRoot ? null : JSONStringify([
+      this.loc.file,
+      getNamePath(parent.parent, parent.name),
+    ]);
+    this.finished = false;
+    this.result = null;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class BenchContext {
+  #closed = false;
+  #endCalled = false;
+  #invalid = false;
+  #sample = null;
+  #startCalled = false;
+  #startTime;
+
+  constructor(bench, signal) {
+    this.name = bench.name;
+    this.params = bench.params;
+    this.signal = signal;
+  }
+
+  start() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() must be called exactly once per benchmark sample');
+    }
+    this.#startCalled = true;
+    this.#startTime = hrtime();
+  }
+
+  end(operations) {
+    const endTime = hrtime();
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() must be called exactly once per benchmark sample');
+    }
+    this.#endCalled = true;
+    if (!this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('end() cannot be called before start()');
+    }
+
+    try {
+      validateInteger(operations, 'operations', 1, NumberMAX_SAFE_INTEGER);
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+
+    const duration = endTime - this.#startTime;
+    if (duration === 0n) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'insufficient clock precision for benchmark sample');
+    }
+    this.#sample = {
+      __proto__: null,
+      operations,
+      duration_ns: duration,
+      rate: operations / (Number(duration) / 1e9),
+    };
+  }
+
+  finish() {
+    this.#closed = true;
+    if (this.#invalid) {
+      throw new ERR_INVALID_STATE(
+        'benchmark sample violated the start()/end() contract');
+    }
+    if (!this.#startCalled) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call start()');
+    }
+    if (!this.#endCalled || this.#sample === null) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call end()');
+    }
+    return this.#sample;
+  }
+
+  close() {
+    this.#closed = true;
+  }
+}
+
+function arithmeticMean(values) {
+  let sum = 0;
+  let compensation = 0;
+  for (let i = 0; i < values.length; i++) {
+    const adjusted = values[i] - compensation;
+    const next = sum + adjusted;
+    compensation = (next - sum) - adjusted;
+    sum = next;
+  }
+  return sum / values.length;
+}
+
+function summarizeSamples(samples) {
+  const rates = [];
+  let min = Infinity;
+  let max = -Infinity;
+  for (let i = 0; i < samples.length; i++) {
+    const rate = samples[i].rate;
+    ArrayPrototypePush(rates, rate);
+    min = MathMin(min, rate);
+    max = MathMax(max, rate);
+  }
+
+  const mean = arithmeticMean(rates);
+  let variance = 0;
+  for (let i = 0; i < rates.length; i++) {
+    const difference = rates[i] - mean;
+    variance += difference * difference;
+  }
+  variance /= rates.length;
+  const stddev = MathSqrt(variance);
+
+  const sorted = ArrayPrototypeSlice(rates);
+  ArrayPrototypeSort(sorted, (a, b) => a - b);
+  const middle = MathFloor(sorted.length / 2);
+  const median = sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+
+  const scale = MathMin(1_000_000, NumberMAX_SAFE_INTEGER / max);
+  const histogram = createHistogram({ __proto__: null, figures: 5 });
+  for (let i = 0; i < rates.length; i++) {
+    const value = MathMax(
+      1,
+      MathMin(NumberMAX_SAFE_INTEGER, MathRound(rates[i] * scale)),
+    );
+    histogram.record(value);
+  }
+
+  const meanCI = histogram.meanCI();
+  const histogramMean = meanCI.mean / scale;
+  const medianCI = histogram.percentileCI(50);
+
+  return {
+    __proto__: null,
+    mean,
+    median,
+    min,
+    max,
+    stddev,
+    coefficientOfVariation: stddev / mean,
+    confidenceInterval: {
+      __proto__: null,
+      lower: mean + meanCI.lower / scale - histogramMean,
+      upper: mean + meanCI.upper / scale - histogramMean,
+    },
+    medianConfidenceInterval: {
+      __proto__: null,
+      lower: medianCI.lower / scale,
+      upper: medianCI.upper / scale,
+    },
+    skewness: histogram.skewness,
+  };
+}
+
+function normalizeArgs(type, name, options, fn) {
+  if (typeof name === 'function') {
+    fn = name;
+    name = fn.name || '<anonymous>';
+    options = kEmptyObject;
+  } else if (name !== null && typeof name === 'object') {
+    fn = options;
+    options = name;
+    name = fn?.name || '<anonymous>';
+  } else if (typeof options === 'function') {
+    fn = options;
+    options = kEmptyObject;
+  }
+
+  validateFunction(fn, `${type} function`);
+  validateString(name, `${type} name`);
+  if (name.length === 0) {
+    throw new ERR_INVALID_ARG_VALUE(`${type} name`, name, 'must not be empty');
+  }
+  validateObject(options, 'options');
+  return { __proto__: null, fn, name, options };
+}
+
+module.exports = {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+};
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
new file mode 100644
index 000000000000..ac3896d0587e
--- /dev/null
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -0,0 +1,74 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeShift,
+  NumberMAX_SAFE_INTEGER,
+  Symbol,
+} = primordials;
+const Readable = require('internal/streams/readable');
+
+const kEmitMessage = Symbol('kEmitMessage');
+
+class BenchmarksStream extends Readable {
+  #buffer = [];
+  #canPush = true;
+
+  constructor() {
+    super({
+      __proto__: null,
+      objectMode: true,
+      highWaterMark: NumberMAX_SAFE_INTEGER,
+    });
+  }
+
+  _read() {
+    this.#canPush = true;
+    while (this.#buffer.length > 0) {
+      const record = ArrayPrototypeShift(this.#buffer);
+      if (!this.#tryPush(record)) return;
+    }
+  }
+
+  start(data) {
+    this[kEmitMessage]('bench:start', data);
+  }
+
+  sample(data) {
+    this[kEmitMessage]('bench:sample', data);
+  }
+
+  complete(data) {
+    this[kEmitMessage]('bench:complete', data);
+  }
+
+  diagnostic(data) {
+    this[kEmitMessage]('bench:diagnostic', data);
+  }
+
+  summary(data) {
+    this[kEmitMessage]('bench:summary', data);
+  }
+
+  end() {
+    this.#tryPush(null);
+  }
+
+  [kEmitMessage](type, data) {
+    this.emit(type, data);
+    this.#tryPush({ type, data });
+  }
+
+  #tryPush(record) {
+    if (this.#canPush) {
+      this.#canPush = this.push(record);
+    } else {
+      ArrayPrototypePush(this.#buffer, record);
+    }
+    return this.#canPush;
+  }
+}
+
+module.exports = {
+  BenchmarksStream,
+};
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
new file mode 100644
index 000000000000..0409b38e6b91
--- /dev/null
+++ b/lib/internal/bench_runner/harness.js
@@ -0,0 +1,687 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  FunctionPrototypeCall,
+  Promise,
+  PromisePrototypeThen,
+  PromiseResolve,
+  PromiseWithResolvers,
+  ReflectApply,
+  RegExp,
+  RegExpPrototypeExec,
+  SafeMap,
+  SafePromiseRace,
+  SymbolDispose,
+} = primordials;
+const { getCallerLocation } = internalBinding('util');
+const { exitCodes: { kGenericUserError } } = internalBinding('errors');
+const { AsyncLocalStorage } = require('async_hooks');
+const { AbortController } = require('internal/abort_controller');
+const {
+  AbortError,
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_OPERATION_FAILED,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  kEmptyObject,
+} = require('internal/util');
+const { isRegExp } = require('internal/util/types');
+const {
+  validateAbortSignal,
+  validateFunction,
+  validateObject,
+} = require('internal/validators');
+const { queueMicrotask } = require('internal/process/task_queues');
+const { clearTimeout, setImmediate, setTimeout } = require('timers');
+const {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+} = require('internal/bench_runner/benchmark');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+
+const { bigint: hrtime } = process.hrtime;
+const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
+
+function eventLoopTurn() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+function createAbortError(signal) {
+  return new AbortError(undefined, { __proto__: null, cause: signal.reason });
+}
+
+class Harness {
+  #buildPromises = [];
+  #duplicateErrors = new SafeMap();
+  #explicitRun = false;
+  #hasOnly = false;
+  #runPromise = null;
+  #scheduled = false;
+  #storage = new AsyncLocalStorage();
+
+  constructor() {
+    this.entryFile = process.argv?.[1];
+    this.stream = new BenchmarksStream();
+    this.state = 'collecting';
+    this.namePattern = null;
+    this.outerSignal = undefined;
+    this.success = true;
+    this.counts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    this.root = new Suite(
+      this,
+      null,
+      '<root>',
+      kEmptyObject,
+      undefined,
+      undefined,
+      true,
+    );
+  }
+
+  #ensureCollecting() {
+    if (this.state === 'collecting' ||
+        (this.state === 'building' &&
+         this.#storage.getStore() instanceof Suite)) return;
+    throw new ERR_INVALID_STATE(
+      'benchmarks cannot be declared after execution has started');
+  }
+
+  #getParent() {
+    const current = this.#storage.getStore();
+    return current instanceof Suite ? current : this.root;
+  }
+
+  createBench(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('benchmark', name, options, fn);
+    const parent = this.#getParent();
+    const benchmark = new Bench(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, benchmark);
+    this.#schedule();
+    return parent.isRoot ? benchmark.completion.promise : PromiseResolve();
+  }
+
+  createSuite(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('suite', name, options, fn);
+    const parent = this.#getParent();
+    const suite = new Suite(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, suite);
+    this.#buildSuite(suite);
+    this.#schedule();
+    return parent.isRoot ? suite.completion.promise : PromiseResolve();
+  }
+
+  createHook(name, fn, options = kEmptyObject) {
+    this.#ensureCollecting();
+    validateFunction(fn, 'hook function');
+    validateObject(options, 'options');
+    const parent = this.#getParent();
+    ArrayPrototypePush(parent.hooks[name], {
+      __proto__: null,
+      fn,
+      loc: getCallerLocation(),
+    });
+    this.#schedule();
+  }
+
+  #buildSuite(suite) {
+    let result;
+    try {
+      result = suite.runInAsyncScope(() => this.#storage.run(
+        suite,
+        () => FunctionPrototypeCall(suite.fn),
+      ));
+    } catch (error) {
+      suite.buildError = error;
+      result = undefined;
+    }
+
+    suite.buildPromise = PromisePrototypeThen(
+      PromiseResolve(result),
+      undefined,
+      (error) => {
+        suite.buildError = error;
+      },
+    );
+    ArrayPrototypePush(this.#buildPromises, suite.buildPromise);
+  }
+
+  configure(options = kEmptyObject) {
+    validateObject(options, 'options');
+    if (this.#runPromise !== null) {
+      if (options !== kEmptyObject) {
+        throw new ERR_INVALID_STATE('benchmark execution has already started');
+      }
+      return;
+    }
+
+    const { namePattern, signal } = options;
+    if (namePattern !== undefined) {
+      if (typeof namePattern === 'string') {
+        this.namePattern = new RegExp(namePattern);
+      } else if (isRegExp(namePattern)) {
+        this.namePattern = namePattern;
+      } else {
+        throw new ERR_INVALID_ARG_TYPE(
+          'options.namePattern', ['string', 'RegExp'], namePattern);
+      }
+    }
+    validateAbortSignal(signal, 'options.signal');
+    this.outerSignal = signal;
+    this.#explicitRun = true;
+  }
+
+  run(options = kEmptyObject) {
+    this.configure(options);
+    this.#schedule();
+    return this.stream;
+  }
+
+  #schedule() {
+    if (this.#scheduled) return;
+    this.#scheduled = true;
+    queueMicrotask(() => {
+      if (this.#runPromise === null) {
+        this.#runPromise = this.#execute();
+        PromisePrototypeThen(this.#runPromise, undefined, (error) => {
+          this.#diagnostic(error, undefined, 'error');
+          this.#finish();
+        });
+      }
+    });
+  }
+
+  async #waitForBuild() {
+    for (let i = 0; i < this.#buildPromises.length; i++) {
+      await this.#buildPromises[i];
+    }
+  }
+
+  #walk(node, callback) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      callback(child);
+      if (child instanceof Suite) this.#walk(child, callback);
+    }
+  }
+
+  #prepare() {
+    const identities = new SafeMap();
+    this.#walk(this.root, (node) => {
+      if (node.only) this.#hasOnly = true;
+      if (!(node instanceof Bench)) return;
+
+      this.counts.total++;
+      const existing = identities.get(node.benchId);
+      if (existing === undefined) {
+        identities.set(node.benchId, node);
+      } else {
+        this.#duplicateErrors.set(node, new ERR_INVALID_STATE(
+          `duplicate benchmark identity for "${node.fullName}"`));
+      }
+    });
+  }
+
+  #hasSelectedAncestor(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.only) return true;
+    }
+    return false;
+  }
+
+  #getSkip(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.skip !== undefined && current.skip !== false) {
+        return current.skip;
+      }
+    }
+    if (this.#hasOnly && !this.#hasSelectedAncestor(benchmark)) return 'only';
+    if (this.namePattern !== null) {
+      this.namePattern.lastIndex = 0;
+      if (RegExpPrototypeExec(this.namePattern, benchmark.fullName) === null) {
+        return 'name pattern';
+      }
+    }
+    return null;
+  }
+
+  #suiteHasActiveBench(suite) {
+    for (let i = 0; i < suite.children.length; i++) {
+      const child = suite.children[i];
+      if (child instanceof Suite) {
+        if (this.#suiteHasActiveBench(child)) return true;
+      } else if (this.#getSkip(child) === null) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  async #invoke(resource, store, fn, args) {
+    const result = resource.runInAsyncScope(() => this.#storage.run(
+      store,
+      () => ReflectApply(fn, undefined, args),
+    ));
+    return PromiseResolve(result);
+  }
+
+  async #runHooks(suite, name, resource, store, context) {
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      await this.#invoke(resource, store, hooks[i].fn, [context]);
+    }
+  }
+
+  async #runSuiteHooks(suite, name) {
+    const context = {
+      __proto__: null,
+      name: suite.name,
+      signal: this.outerSignal,
+    };
+    await this.#runHooks(suite, name, suite, suite, context);
+  }
+
+  #diagnostic(error, loc, level = 'info') {
+    this.success = false;
+    this.stream.diagnostic({
+      __proto__: null,
+      message: error?.message ?? `${error}`,
+      error,
+      level,
+      file: loc?.file ?? loc?.[2],
+      line: loc?.line ?? loc?.[0],
+      column: loc?.column ?? loc?.[1],
+    });
+  }
+
+  async #completeSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child instanceof Suite) {
+        await this.#completeSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+        child.emitDestroy();
+      } else {
+        await this.#executeBench(child, error);
+      }
+    }
+  }
+
+  async #executeSuite(suite) {
+    if (suite.buildError !== null) {
+      this.#diagnostic(suite.buildError, suite.loc, 'error');
+      await this.#completeSubtree(suite, suite.buildError);
+      suite.finished = true;
+      suite.completion.resolve();
+      suite.emitDestroy();
+      return;
+    }
+
+    const active = this.#suiteHasActiveBench(suite);
+    let beforeError;
+    if (active) {
+      try {
+        await this.#runSuiteHooks(suite, 'before');
+      } catch (error) {
+        beforeError = error;
+        this.#diagnostic(error, suite.loc, 'error');
+      }
+    }
+
+    if (beforeError !== undefined) {
+      await this.#completeSubtree(suite, beforeError);
+    } else {
+      for (let i = 0; i < suite.children.length; i++) {
+        const child = suite.children[i];
+        if (child instanceof Suite) {
+          await this.#executeSuite(child);
+        } else {
+          await this.#executeBench(child);
+        }
+      }
+    }
+
+    if (active) {
+      try {
+        await this.#runSuiteHooks(suite, 'after');
+      } catch (error) {
+        this.#diagnostic(error, suite.loc, 'error');
+      }
+    }
+    suite.finished = true;
+    suite.completion.resolve();
+    if (!suite.isRoot) suite.emitDestroy();
+  }
+
+  #getHookSuites(benchmark) {
+    const suites = [];
+    for (let current = benchmark.parent; current !== null; current = current.parent) {
+      ArrayPrototypePush(suites, current);
+    }
+    ArrayPrototypeReverse(suites);
+    return suites;
+  }
+
+  async #runBenchHooks(benchmark, name, context) {
+    const suites = this.#getHookSuites(benchmark);
+    if (name === 'afterEach') ArrayPrototypeReverse(suites);
+    for (let i = 0; i < suites.length; i++) {
+      await this.#runHooks(
+        suites[i], name, benchmark, benchmark, context);
+    }
+  }
+
+  async #runWithStop(benchmark, controller, callback) {
+    const signals = [];
+    if (this.outerSignal !== undefined) {
+      ArrayPrototypePush(signals, this.outerSignal);
+    }
+    if (benchmark.outerSignal !== undefined &&
+        benchmark.outerSignal !== this.outerSignal) {
+      ArrayPrototypePush(signals, benchmark.outerSignal);
+    }
+
+    for (let i = 0; i < signals.length; i++) {
+      if (signals[i].aborted) {
+        const error = createAbortError(signals[i]);
+        controller.abort(error);
+        throw error;
+      }
+    }
+
+    const stop = PromiseWithResolvers();
+    const listeners = [];
+    let timer;
+    for (let i = 0; i < signals.length; i++) {
+      const signal = signals[i];
+      ArrayPrototypePush(listeners, addAbortListener(signal, () => {
+        const error = createAbortError(signal);
+        controller.abort(error);
+        stop.reject(error);
+      }));
+    }
+    if (benchmark.timeout !== Infinity) {
+      timer = setTimeout(() => {
+        const error = new ERR_OPERATION_FAILED(
+          `Benchmark timed out after ${benchmark.timeout}ms`);
+        controller.abort(error);
+        stop.reject(error);
+      }, benchmark.timeout);
+    }
+
+    const work = callback();
+    try {
+      if (signals.length === 0 && timer === undefined) return await work;
+      return await SafePromiseRace([work, stop.promise]);
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+      for (let i = 0; i < listeners.length; i++) {
+        listeners[i][SymbolDispose]();
+      }
+    }
+  }
+
+  async #runSample(benchmark, signal) {
+    const context = new BenchContext(benchmark, signal);
+    try {
+      await this.#invoke(
+        benchmark, benchmark, benchmark.fn, [context]);
+      return context.finish();
+    } catch (error) {
+      context.close();
+      throw error;
+    }
+  }
+
+  #createResult(benchmark, samples, extra = kEmptyObject) {
+    return {
+      __proto__: null,
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+      samples,
+      ...extra,
+    };
+  }
+
+  #recordResult(benchmark, result) {
+    benchmark.finished = true;
+    benchmark.result = result;
+    this.stream.complete(result);
+    benchmark.completion.resolve(result);
+    benchmark.emitDestroy();
+  }
+
+  async #executeBench(benchmark, forcedError = undefined) {
+    const duplicateError = this.#duplicateErrors.get(benchmark);
+    if (duplicateError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: duplicateError },
+      ));
+      return;
+    }
+
+    const skip = this.#getSkip(benchmark);
+    if (skip !== null) {
+      this.counts.skipped++;
+      this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, skip },
+      ));
+      return;
+    }
+
+    if (forcedError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: forcedError },
+      ));
+      return;
+    }
+
+    this.stream.start({
+      __proto__: null,
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+    });
+
+    const controller = new AbortController();
+    const samples = [];
+    const hookContext = {
+      __proto__: null,
+      name: benchmark.name,
+      params: benchmark.params,
+      signal: controller.signal,
+    };
+    let error;
+
+    try {
+      await this.#runWithStop(benchmark, controller, async () => {
+        try {
+          await this.#runBenchHooks(
+            benchmark, 'beforeEach', hookContext);
+          const total = benchmark.warmup + benchmark.samples;
+          for (let i = 0; i < total; i++) {
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            const sample = await this.#runSample(
+              benchmark, controller.signal);
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            if (i >= benchmark.warmup) {
+              ArrayPrototypePush(samples, sample);
+              this.stream.sample({
+                __proto__: null,
+                benchId: benchmark.benchId,
+                parentId: benchmark.parentId,
+                name: benchmark.name,
+                index: i - benchmark.warmup,
+                ...sample,
+              });
+            }
+            if (i + 1 < total) await eventLoopTurn();
+          }
+        } finally {
+          await this.#runBenchHooks(
+            benchmark, 'afterEach', hookContext);
+        }
+      });
+    } catch (cause) {
+      error = cause;
+    } finally {
+      controller.abort();
+    }
+
+    if (error !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        samples,
+        { __proto__: null, error },
+      ));
+      return;
+    }
+
+    this.counts.completed++;
+    this.#recordResult(benchmark, this.#createResult(
+      benchmark,
+      samples,
+      { __proto__: null, summary: summarizeSamples(samples) },
+    ));
+  }
+
+  #finish(startTime) {
+    if (this.state === 'finished') return;
+    this.state = 'finished';
+    const duration = startTime === undefined ? 0n : hrtime() - startTime;
+    this.stream.summary({
+      __proto__: null,
+      success: this.success,
+      counts: this.counts,
+      duration_ns: duration,
+      file: this.entryFile,
+    });
+    this.stream.end();
+    this.root.finished = true;
+    this.root.completion.resolve();
+    this.root.emitDestroy();
+    this.#storage.disable();
+    if (!this.#explicitRun && !this.success) {
+      process.exitCode = kGenericUserError;
+    }
+  }
+
+  async #execute() {
+    this.state = 'building';
+    const startTime = hrtime();
+    await this.#waitForBuild();
+    this.#prepare();
+    this.state = 'running';
+    await this.#executeSuite(this.root);
+    this.#finish(startTime);
+  }
+}
+
+let globalHarness;
+
+function lazyHarness() {
+  globalHarness ??= new Harness();
+  return globalHarness;
+}
+
+function runInParentContext(type) {
+  const declare = (name, options, fn, overrides = kEmptyObject) => {
+    const harness = lazyHarness();
+    const loc = getCallerLocation();
+    const declarationOptions = { __proto__: null, ...overrides, loc };
+    return type === 'benchmark' ?
+      harness.createBench(name, options, fn, declarationOptions) :
+      harness.createSuite(name, options, fn, declarationOptions);
+  };
+
+  if (type === 'benchmark') {
+    declare.skip = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, skip: true });
+    declare.only = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, only: true });
+  }
+  return declare;
+}
+
+function hook(name) {
+  return (fn, options) => lazyHarness().createHook(name, fn, options);
+}
+
+const bench = runInParentContext('benchmark');
+const suite = runInParentContext('suite');
+
+function runBenchmarks(options) {
+  return lazyHarness().run(options);
+}
+
+module.exports = {
+  Harness,
+  after: hook(kHookNames[0]),
+  afterEach: hook(kHookNames[1]),
+  before: hook(kHookNames[2]),
+  beforeEach: hook(kHookNames[3]),
+  bench,
+  runBenchmarks,
+  suite,
+};
diff --git a/lib/internal/bench_runner/runner.js b/lib/internal/bench_runner/runner.js
new file mode 100644
index 000000000000..ee55672b5f11
--- /dev/null
+++ b/lib/internal/bench_runner/runner.js
@@ -0,0 +1,12 @@
+'use strict';
+
+const { kEmptyObject } = require('internal/util');
+const { runBenchmarks } = require('internal/bench_runner/harness');
+
+function run(options = kEmptyObject) {
+  return runBenchmarks(options);
+}
+
+module.exports = {
+  run,
+};
diff --git a/lib/internal/bootstrap/realm.js b/lib/internal/bootstrap/realm.js
index 4dfb39ae9568..356e2cae526d 100644
--- a/lib/internal/bootstrap/realm.js
+++ b/lib/internal/bootstrap/realm.js
@@ -124,6 +124,7 @@ const legacyWrapperList = new SafeSet([
 // beginning with "internal/".
 // Modules that can only be imported via the node: scheme.
 const schemelessBlockList = new SafeSet([
+  'bench',
   'dtls',
   'ffi',
   'sea',
diff --git a/test/module-hooks/test-module-hooks-builtin-require.js b/test/module-hooks/test-module-hooks-builtin-require.js
index 2086cbe062b0..b623f4157bea 100644
--- a/test/module-hooks/test-module-hooks-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-builtin-require.js
@@ -11,6 +11,7 @@ const assert = require('assert');
 const { registerHooks } = require('module');
 
 const schemelessBlockList = new Set([
+  'bench',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/module-hooks/test-module-hooks-load-builtin-require.js b/test/module-hooks/test-module-hooks-load-builtin-require.js
index 962080b3c2c8..262aa1a0d32b 100644
--- a/test/module-hooks/test-module-hooks-load-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-load-builtin-require.js
@@ -35,6 +35,7 @@ hook.deregister();
 // the one with the `node:` prefix. The one with the prefix
 // stripped for internal lookups should not get passed into the hooks.
 const schemelessBlockList = new Set([
+  'bench',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/parallel/test-bench-auto-run.js b/test/parallel/test-bench-auto-run.js
new file mode 100644
index 000000000000..ed02fed9340a
--- /dev/null
+++ b/test/parallel/test-bench-auto-run.js
@@ -0,0 +1,28 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { bench } = require('node:bench');
+
+const child = spawnSync(process.execPath, [
+  '--no-warnings',
+  '-e',
+  'require("node:bench").bench("failure", () => { throw new Error(); })',
+]);
+assert.strictEqual(child.status, 1);
+
+const completion = bench('automatic execution', common.mustCall((b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+}, 30));
+
+completion.then(common.mustCall((result) => {
+  assert.strictEqual(result.name, 'automatic execution');
+  assert.strictEqual(result.samples.length, 30);
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.skip, undefined);
+  assert.strictEqual(result.summary.mean > 0, true);
+}));
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
new file mode 100644
index 000000000000..7a6f7aec7e16
--- /dev/null
+++ b/test/parallel/test-bench-errors.js
@@ -0,0 +1,104 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { bench, run } = require('node:bench');
+
+const options = { samples: 1 };
+
+bench('missing start', options, () => {});
+bench('missing end', options, (b) => b.start());
+bench('end before start', options, (b) => b.end(1));
+bench('duplicate start', options, (b) => {
+  b.start();
+  b.start();
+});
+bench('duplicate end', options, (b) => {
+  b.start();
+  b.end(1);
+  b.end(1);
+});
+bench('invalid operations', options, (b) => {
+  b.start();
+  b.end(0);
+});
+bench('throws', options, () => {
+  throw new Error('benchmark failure');
+});
+bench('timeout', { samples: 1, timeout: 10 }, async () => {
+  await new Promise(() => {});
+});
+bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
+  b.start();
+  await new Promise((resolve) => setTimeout(resolve, 30));
+  b.end(1);
+});
+
+const signal = AbortSignal.abort(new Error('stop'));
+bench('aborted', { samples: 1, signal }, () => {});
+
+function complete(b) {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+}
+
+bench('duplicate', { samples: 1, params: { value: 1 } }, complete);
+bench('duplicate', { samples: 1, params: { value: 1 } }, complete);
+bench('continues', options, complete);
+
+const completions = [];
+const sampleNames = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:sample', (sample) => sampleNames.push(sample.name));
+stream.on('bench:summary', (result) => { summary = result; });
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(completions.length, 13);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 11,
+    skipped: 0,
+    total: 13,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map();
+  for (const result of completions) {
+    const values = byName.get(result.name) ?? [];
+    values.push(result);
+    byName.set(result.name, values);
+  }
+
+  assert.match(byName.get('missing start')[0].error.message,
+               /did not call start/);
+  assert.match(byName.get('missing end')[0].error.message,
+               /did not call end/);
+  assert.match(byName.get('end before start')[0].error.message,
+               /before start/);
+  assert.strictEqual(byName.get('duplicate start')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate end')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid operations')[0].error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('throws')[0].error.message,
+                     'benchmark failure');
+  assert.strictEqual(byName.get('timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('late timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('aborted')[0].error.code, 'ABORT_ERR');
+
+  const duplicates = byName.get('duplicate');
+  assert.strictEqual(duplicates[0].error, undefined);
+  assert.match(duplicates[1].error.message, /duplicate benchmark identity/);
+  assert.strictEqual(byName.get('continues')[0].error, undefined);
+  setTimeout(common.mustCall(() => {
+    assert.strictEqual(sampleNames.includes('late timeout'), false);
+  }), 40);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-filtering.js b/test/parallel/test-bench-filtering.js
new file mode 100644
index 000000000000..41784c0dafef
--- /dev/null
+++ b/test/parallel/test-bench-filtering.js
@@ -0,0 +1,41 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+
+const calls = [];
+
+function complete(name) {
+  return (b) => {
+    calls.push(name);
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  };
+}
+
+suite('selected', { only: true }, () => {
+  bench('included', { samples: 1 }, complete('included'));
+  bench.skip('explicitly skipped', { samples: 1 },
+             common.mustNotCall());
+  bench('pattern filtered', { samples: 1 },
+        common.mustNotCall());
+});
+bench('only filtered', { samples: 1 }, common.mustNotCall());
+
+const results = [];
+const stream = run({ namePattern: /^selected (included|explicitly skipped)$/ });
+stream.on('bench:complete', (result) => results.push(result));
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(calls, ['included']);
+  assert.strictEqual(results.length, 4);
+
+  const byName = new Map(results.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('included').error, undefined);
+  assert.strictEqual(byName.get('explicitly skipped').skip, true);
+  assert.strictEqual(byName.get('pattern filtered').skip, 'name pattern');
+  assert.strictEqual(byName.get('only filtered').skip, 'only');
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-hook-errors.js b/test/parallel/test-bench-hook-errors.js
new file mode 100644
index 000000000000..72de600b8abd
--- /dev/null
+++ b/test/parallel/test-bench-hook-errors.js
@@ -0,0 +1,84 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+function complete(b) {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+}
+
+suite('before failure', () => {
+  before(() => { throw new Error('before failure'); });
+  after(common.mustCall());
+  bench('blocked by before', { samples: 1 }, common.mustNotCall());
+});
+
+suite('beforeEach failure', () => {
+  beforeEach(() => { throw new Error('beforeEach failure'); });
+  afterEach(common.mustCall());
+  bench('blocked by beforeEach', { samples: 1 }, common.mustNotCall());
+});
+
+suite('after failure', () => {
+  after(() => { throw new Error('after failure'); });
+  bench('completes before after', { samples: 1 }, complete);
+});
+
+suite('build failure', async () => {
+  await new Promise((resolve) => setImmediate(resolve));
+  throw new Error('build failure');
+});
+
+bench('continues after suite failures', { samples: 1 }, complete);
+
+const completions = [];
+const diagnostics = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:diagnostic', (diagnostic) => {
+  diagnostics.push(diagnostic);
+});
+stream.on('bench:summary', (value) => { summary = value; });
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 2,
+    skipped: 0,
+    total: 4,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map(completions.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('blocked by before').error.message,
+                     'before failure');
+  assert.strictEqual(byName.get('blocked by beforeEach').error.message,
+                     'beforeEach failure');
+  assert.strictEqual(byName.get('completes before after').error, undefined);
+  assert.strictEqual(
+    byName.get('continues after suite failures').error, undefined);
+
+  assert.deepStrictEqual(
+    diagnostics.map(({ message }) => message).sort(),
+    ['after failure', 'before failure', 'build failure'],
+  );
+  for (const diagnostic of diagnostics) {
+    assert.strictEqual(typeof diagnostic.file, 'string');
+    assert.strictEqual(typeof diagnostic.line, 'number');
+    assert.strictEqual(typeof diagnostic.column, 'number');
+  }
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-module.mjs b/test/parallel/test-bench-module.mjs
new file mode 100644
index 000000000000..ec08413ed6b3
--- /dev/null
+++ b/test/parallel/test-bench-module.mjs
@@ -0,0 +1,41 @@
+// Flags: --no-warnings
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire, builtinModules, isBuiltin } from 'node:module';
+import benchDefault, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  describe,
+  run,
+  suite,
+} from 'node:bench';
+
+assert.strictEqual(benchDefault, bench);
+assert.strictEqual(describe, suite);
+for (const value of [
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+]) {
+  assert.strictEqual(typeof value, 'function');
+}
+assert.strictEqual(typeof bench.skip, 'function');
+assert.strictEqual(typeof bench.only, 'function');
+
+assert.strictEqual(isBuiltin('node:bench'), true);
+assert.strictEqual(isBuiltin('bench'), false);
+assert.strictEqual(builtinModules.includes('node:bench'), true);
+assert.strictEqual(process.getBuiltinModule('node:bench'), benchDefault);
+assert.strictEqual(process.getBuiltinModule('bench'), undefined);
+
+const require = createRequire(import.meta.url);
+assert.throws(() => require('bench'), { code: 'MODULE_NOT_FOUND' });
+await assert.rejects(import('bench'), { code: 'ERR_MODULE_NOT_FOUND' });
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
new file mode 100644
index 000000000000..fafc9e3309ad
--- /dev/null
+++ b/test/parallel/test-bench-run.js
@@ -0,0 +1,139 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+const calls = [];
+const contexts = new Set();
+let active = false;
+
+before(() => calls.push('root before'));
+after(() => calls.push('root after'));
+beforeEach(() => calls.push('root beforeEach'));
+afterEach(() => calls.push('root afterEach'));
+
+const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
+  await new Promise((resolve) => setImmediate(resolve));
+
+  before(() => calls.push('suite before'));
+  after(() => calls.push('suite after'));
+  beforeEach(() => calls.push('suite beforeEach'));
+  afterEach(() => calls.push('suite afterEach'));
+
+  bench('sync', {
+    params: { z: 2, a: true },
+    samples: 2,
+    tags: ['SYNC'],
+    warmup: 1,
+  }, common.mustCall((b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('sync sample');
+    assert.deepStrictEqual(b.params, { __proto__: null, a: true, z: 2 });
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+    active = false;
+  }, 3));
+
+  bench('async', { samples: 2 }, common.mustCall(async (b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('async sample');
+    await new Promise((resolve) => setImmediate(resolve));
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+    await new Promise((resolve) => setImmediate(resolve));
+    active = false;
+  }, 2));
+
+  bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+});
+
+const records = [];
+const stream = run();
+stream.on('data', (record) => records.push(record));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(active, false);
+  assert.strictEqual(contexts.size, 5);
+
+  const starts = records.filter(({ type }) => type === 'bench:start');
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  const completions = records.filter(({ type }) => type === 'bench:complete');
+  const summaries = records.filter(({ type }) => type === 'bench:summary');
+
+  assert.strictEqual(starts.length, 2);
+  assert.strictEqual(samples.length, 4);
+  assert.strictEqual(completions.length, 3);
+  assert.strictEqual(summaries.length, 1);
+
+  const sync = completions.find(({ data }) => data.name === 'sync').data;
+  assert.strictEqual(sync.error, undefined);
+  assert.strictEqual(sync.skip, undefined);
+  assert.strictEqual(sync.samples.length, 2);
+  assert.strictEqual(Object.getPrototypeOf(sync), null);
+  assert.strictEqual(Object.getPrototypeOf(sync.params), null);
+  assert.deepStrictEqual(sync.tags, ['group', 'sync']);
+  assert.match(sync.benchId, /\{"a":true,"z":2\}/);
+  assert.notStrictEqual(sync.parentId, null);
+  assert.strictEqual(sync.summary.mean > 0, true);
+  assert.strictEqual(sync.summary.min <= sync.summary.mean, true);
+  assert.strictEqual(sync.summary.mean <= sync.summary.max, true);
+  assert.strictEqual(typeof sync.summary.confidenceInterval.lower, 'number');
+  assert.strictEqual(typeof sync.samples[0].duration_ns, 'bigint');
+
+  const asyncResult = completions.find(
+    ({ data }) => data.name === 'async').data;
+  assert.strictEqual(asyncResult.error, undefined);
+  assert.strictEqual(asyncResult.skip, undefined);
+  assert.strictEqual(asyncResult.samples.length, 2);
+
+  const skipped = completions.find(
+    ({ data }) => data.name === 'skipped').data;
+  assert.strictEqual(skipped.skip, true);
+  assert.deepStrictEqual(skipped.samples, []);
+
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 0,
+    skipped: 1,
+    total: 3,
+  });
+  assert.strictEqual(summaries[0].data.success, true);
+
+  assert.deepStrictEqual(calls, [
+    'root before',
+    'suite before',
+    'root beforeEach',
+    'suite beforeEach',
+    'sync sample',
+    'sync sample',
+    'sync sample',
+    'suite afterEach',
+    'root afterEach',
+    'root beforeEach',
+    'suite beforeEach',
+    'async sample',
+    'async sample',
+    'suite afterEach',
+    'root afterEach',
+    'suite after',
+    'root after',
+  ]);
+}));
+
+suiteCompletion.then(common.mustCall());
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
new file mode 100644
index 000000000000..25a53c1b0186
--- /dev/null
+++ b/test/parallel/test-bench-validation.js
@@ -0,0 +1,45 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { bench, run } = require('node:bench');
+
+const noop = () => {};
+
+assert.throws(() => bench('', noop), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { samples: 0 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { warmup: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { timeout: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { signal: {} }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: 'fast' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: [''] }, noop),
+              { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', { params: { value: null } }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { params: { value: NaN } }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { only: 'yes' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { skip: 1 }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ namePattern: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+
+bench('valid', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
+
+const stream = run();
+stream.on('bench:start', common.mustCall(() => {
+  assert.throws(() => bench('late', noop), { code: 'ERR_INVALID_STATE' });
+}));
+stream.resume();
diff --git a/test/parallel/test-module-isBuiltin.js b/test/parallel/test-module-isBuiltin.js
index a7815a8dfc1c..54f25e599858 100644
--- a/test/parallel/test-module-isBuiltin.js
+++ b/test/parallel/test-module-isBuiltin.js
@@ -7,10 +7,12 @@ const { isBuiltin } = require('module');
 assert(isBuiltin('http'));
 assert(isBuiltin('sys'));
 assert(isBuiltin('node:fs'));
+assert(isBuiltin('node:bench'));
 assert(isBuiltin('node:test'));
 
 // Does not include internal modules
 assert(!isBuiltin('internal/errors'));
+assert(!isBuiltin('bench'));
 assert(!isBuiltin('test'));
 assert(!isBuiltin(''));
 assert(!isBuiltin(undefined));

From bc96423ce4fd861c0a618bc00785684452cc1ba3 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Thu, 27 Aug 2026 22:29:00 +0000
Subject: [PATCH 040/202] lib: implement bench/reporters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/api/bench.md                              |  60 +++++++
 lib/bench/reporters.js                        |  34 ++++
 lib/internal/bench_runner/reporter/json.js    |  64 ++++++++
 lib/internal/bench_runner/reporter/spec.js    | 149 ++++++++++++++++++
 lib/internal/bootstrap/realm.js               |   1 +
 .../test-module-hooks-builtin-require.js      |   1 +
 .../test-module-hooks-load-builtin-require.js |   1 +
 test/parallel/test-bench-custom-reporter.js   |  37 +++++
 test/parallel/test-bench-module.mjs           |  13 ++
 test/parallel/test-bench-reporters.js         | 114 ++++++++++++++
 test/parallel/test-module-isBuiltin.js        |   2 +
 11 files changed, 476 insertions(+)
 create mode 100644 lib/bench/reporters.js
 create mode 100644 lib/internal/bench_runner/reporter/json.js
 create mode 100644 lib/internal/bench_runner/reporter/spec.js
 create mode 100644 test/parallel/test-bench-custom-reporter.js
 create mode 100644 test/parallel/test-bench-reporters.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 93b303fb2e2d..b4488e119cd1 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -65,6 +65,66 @@ system load can all affect results. Keep raw samples when comparing results and
 investigate noisy or skewed distributions rather than treating a confidence
 interval as a pass/fail threshold.
 
+## Benchmark reporters
+
+The built-in reporters are available from the scheme-only
+`node:bench/reporters` module:
+
+```mjs
+import { json, spec } from 'node:bench/reporters';
+```
+
+```cjs
+const { json, spec } = require('node:bench/reporters');
+```
+
+Reporter values can be passed directly to `stream.compose()`:
+
+```mjs
+import { bench, run } from 'node:bench';
+import { spec } from 'node:bench/reporters';
+import process from 'node:process';
+
+bench('example', (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+run().compose(spec).pipe(process.stdout);
+```
+
+The `spec` reporter buffers results and outputs a concise table containing the
+sample count, mean rate, 95% confidence interval for the mean, median rate, and
+warnings. A coefficient of variation above 5% is reported as `noisy`, and an
+absolute skewness above 1 is reported as `skewed`. The exact human-readable
+format is subject to change.
+
+The `json` reporter emits every lifecycle record as newline-delimited JSON.
+BigInt values, including `duration_ns`, are encoded as decimal strings. Errors
+are represented using their `name`, `message`, `stack`, `code`, `cause`, and
+`errors` properties. As required by JSON, non-finite numbers are encoded as
+`null`.
+
+Custom reporters use the same composition contract. They can be transforms or
+functions accepted by `stream.compose()`. The composed readable can be piped to
+any writable destination:
+
+```mjs
+import { run } from 'node:bench';
+import process from 'node:process';
+
+async function* names(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:complete') {
+      yield `${data.name}\n`;
+    }
+  }
+}
+
+run().compose(names).pipe(process.stdout);
+```
+
 ## `bench([name][, options], fn)`
 
 <!-- YAML
diff --git a/lib/bench/reporters.js b/lib/bench/reporters.js
new file mode 100644
index 000000000000..8f33b423c9ad
--- /dev/null
+++ b/lib/bench/reporters.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const {
+  ObjectDefineProperties,
+  ReflectConstruct,
+} = primordials;
+const { emitExperimentalWarning } = require('internal/util');
+
+let json;
+let specFn;
+
+emitExperimentalWarning('Benchmarks');
+
+ObjectDefineProperties(module.exports, {
+  __proto__: null,
+  json: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() {
+      json ??= require('internal/bench_runner/reporter/json');
+      return json;
+    },
+  },
+  spec: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    value: function spec() {
+      specFn ??= require('internal/bench_runner/reporter/spec');
+      return ReflectConstruct(specFn, arguments);
+    },
+  },
+});
diff --git a/lib/internal/bench_runner/reporter/json.js b/lib/internal/bench_runner/reporter/json.js
new file mode 100644
index 000000000000..3237a3e1b26c
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/json.js
@@ -0,0 +1,64 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypePush,
+  JSONStringify,
+  ObjectKeys,
+  SafeWeakSet,
+  String,
+} = primordials;
+const { isError } = require('internal/util');
+
+function toJSONValue(value, seen) {
+  if (typeof value === 'bigint') return String(value);
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+
+  if (isError(value)) {
+    const result = {
+      __proto__: null,
+      name: value.name,
+      message: value.message,
+      stack: value.stack,
+      code: value.code,
+    };
+    if (value.cause !== undefined) {
+      result.cause = toJSONValue(value.cause, seen);
+    }
+    if (value.errors !== undefined) {
+      result.errors = toJSONValue(value.errors, seen);
+    }
+    return result;
+  }
+
+  if (ArrayIsArray(value)) {
+    const result = [];
+    for (let i = 0; i < value.length; i++) {
+      ArrayPrototypePush(result, toJSONValue(value[i], seen));
+    }
+    return result;
+  }
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(value);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    result[key] = toJSONValue(value[key], seen);
+  }
+  return result;
+}
+
+function stringify(record) {
+  return JSONStringify(record === undefined ? null :
+    toJSONValue(record, new SafeWeakSet()));
+}
+
+async function* jsonReporter(source) {
+  for await (const record of source) {
+    yield `${stringify(record)}\n`;
+  }
+}
+
+module.exports = jsonReporter;
diff --git a/lib/internal/bench_runner/reporter/spec.js b/lib/internal/bench_runner/reporter/spec.js
new file mode 100644
index 000000000000..34f5831553f3
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/spec.js
@@ -0,0 +1,149 @@
+'use strict';
+
+const {
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  JSONStringify,
+  MathAbs,
+  NumberIsFinite,
+  NumberPrototypeToFixed,
+  NumberPrototypeToPrecision,
+  ObjectEntries,
+  String,
+  StringPrototypeReplaceAll,
+} = primordials;
+const Transform = require('internal/streams/transform');
+
+const kHeader =
+  'benchmark | samples | mean rate | 95% CI | median rate | warning\n';
+
+function escapeCell(value) {
+  let result = String(value);
+  result = StringPrototypeReplaceAll(result, '\r', '\\r');
+  result = StringPrototypeReplaceAll(result, '\n', '\\n');
+  return StringPrototypeReplaceAll(result, '|', '\\|');
+}
+
+function formatName(data) {
+  const name = escapeCell(data.name);
+  const entries = ObjectEntries(data.params);
+  if (entries.length === 0) return name;
+
+  const params = [];
+  for (let i = 0; i < entries.length; i++) {
+    const { 0: key, 1: value } = entries[i];
+    ArrayPrototypePush(
+      params, `${escapeCell(key)}=${escapeCell(JSONStringify(value))}`);
+  }
+  return `${name} [${ArrayPrototypeJoin(params, ', ')}]`;
+}
+
+function formatRate(rate) {
+  if (!NumberIsFinite(rate)) return '-';
+
+  const absolute = MathAbs(rate);
+  let divisor = 1;
+  let prefix = '';
+  if (absolute >= 1e9) {
+    divisor = 1e9;
+    prefix = 'G';
+  } else if (absolute >= 1e6) {
+    divisor = 1e6;
+    prefix = 'M';
+  } else if (absolute >= 1e3) {
+    divisor = 1e3;
+    prefix = 'k';
+  }
+
+  const scaled = rate / divisor;
+  const formatted = MathAbs(scaled) > 0 && MathAbs(scaled) < 1 ?
+    NumberPrototypeToPrecision(scaled, 3) :
+    NumberPrototypeToFixed(scaled, 2);
+  return `${formatted}${prefix} ops/s`;
+}
+
+function formatWarning(summary) {
+  const warnings = [];
+  if (NumberIsFinite(summary.coefficientOfVariation) &&
+      summary.coefficientOfVariation > 0.05) {
+    ArrayPrototypePush(warnings, 'noisy');
+  }
+  if (NumberIsFinite(summary.skewness) && MathAbs(summary.skewness) > 1) {
+    ArrayPrototypePush(warnings, 'skewed');
+  }
+  return ArrayPrototypeJoin(warnings, ', ');
+}
+
+function formatResult(data) {
+  const name = formatName(data);
+  if (data.skip !== undefined) {
+    const reason = typeof data.skip === 'string' && data.skip.length > 0 ?
+      `: ${escapeCell(data.skip)}` : '';
+    return `${name} | 0 | - | - | - | skipped${reason}\n`;
+  }
+  if (data.error !== undefined) {
+    const message = data.error?.message ?? data.error;
+    return `${name} | ${data.samples.length} | - | - | - | ` +
+      `error: ${escapeCell(message)}\n`;
+  }
+
+  const { confidenceInterval, median } = data.summary;
+  return `${name} | ${data.samples.length} | ` +
+    `${formatRate(data.summary.mean)} | ` +
+    `[${formatRate(confidenceInterval.lower)}, ` +
+    `${formatRate(confidenceInterval.upper)}] | ` +
+    `${formatRate(median)} | ${formatWarning(data.summary)}\n`;
+}
+
+class SpecReporter extends Transform {
+  #diagnostics = [];
+  #reported = false;
+  #results = [];
+
+  constructor() {
+    super({ __proto__: null, writableObjectMode: true });
+  }
+
+  #format(summary = undefined) {
+    let output = kHeader;
+    for (let i = 0; i < this.#results.length; i++) {
+      output += formatResult(this.#results[i]);
+    }
+    for (let i = 0; i < this.#diagnostics.length; i++) {
+      output += `diagnostic: ${escapeCell(this.#diagnostics[i].message)}\n`;
+    }
+    if (summary !== undefined) {
+      const { completed, failed, skipped } = summary.counts;
+      output += `\n${completed} completed, ${failed} failed, ` +
+        `${skipped} skipped\n`;
+    }
+    return output;
+  }
+
+  _transform({ type, data }, _encoding, callback) {
+    switch (type) {
+      case 'bench:complete':
+        ArrayPrototypePush(this.#results, data);
+        break;
+      case 'bench:diagnostic':
+        ArrayPrototypePush(this.#diagnostics, data);
+        break;
+      case 'bench:summary':
+        this.#reported = true;
+        callback(null, this.#format(data));
+        return;
+    }
+    callback();
+  }
+
+  _flush(callback) {
+    if (this.#reported ||
+        (this.#results.length === 0 && this.#diagnostics.length === 0)) {
+      callback();
+      return;
+    }
+    callback(null, this.#format());
+  }
+}
+
+module.exports = SpecReporter;
diff --git a/lib/internal/bootstrap/realm.js b/lib/internal/bootstrap/realm.js
index 356e2cae526d..81ac2a0e398e 100644
--- a/lib/internal/bootstrap/realm.js
+++ b/lib/internal/bootstrap/realm.js
@@ -125,6 +125,7 @@ const legacyWrapperList = new SafeSet([
 // Modules that can only be imported via the node: scheme.
 const schemelessBlockList = new SafeSet([
   'bench',
+  'bench/reporters',
   'dtls',
   'ffi',
   'sea',
diff --git a/test/module-hooks/test-module-hooks-builtin-require.js b/test/module-hooks/test-module-hooks-builtin-require.js
index b623f4157bea..e1e137ce1169 100644
--- a/test/module-hooks/test-module-hooks-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-builtin-require.js
@@ -12,6 +12,7 @@ const { registerHooks } = require('module');
 
 const schemelessBlockList = new Set([
   'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/module-hooks/test-module-hooks-load-builtin-require.js b/test/module-hooks/test-module-hooks-load-builtin-require.js
index 262aa1a0d32b..946fc1e48766 100644
--- a/test/module-hooks/test-module-hooks-load-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-load-builtin-require.js
@@ -36,6 +36,7 @@ hook.deregister();
 // stripped for internal lookups should not get passed into the hooks.
 const schemelessBlockList = new Set([
   'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/parallel/test-bench-custom-reporter.js b/test/parallel/test-bench-custom-reporter.js
new file mode 100644
index 000000000000..9589834baf3a
--- /dev/null
+++ b/test/parallel/test-bench-custom-reporter.js
@@ -0,0 +1,37 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Writable } = require('stream');
+const { finished } = require('stream/promises');
+const { bench, run } = require('node:bench');
+
+bench('completed', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
+bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+
+async function* customReporter(source) {
+  for await (const { type, data } of source) {
+    if (type !== 'bench:complete') continue;
+    yield `${data.name}:${data.skip === undefined ? 'completed' : 'skipped'}\n`;
+  }
+}
+
+let output = '';
+const destination = new Writable({
+  write(chunk, _encoding, callback) {
+    output += chunk;
+    callback();
+  },
+});
+
+run().compose(customReporter).pipe(destination);
+
+(async () => {
+  await finished(destination);
+  assert.strictEqual(output, 'completed:completed\nskipped:skipped\n');
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-module.mjs b/test/parallel/test-bench-module.mjs
index ec08413ed6b3..3efe9a1f6151 100644
--- a/test/parallel/test-bench-module.mjs
+++ b/test/parallel/test-bench-module.mjs
@@ -13,6 +13,7 @@ import benchDefault, {
   run,
   suite,
 } from 'node:bench';
+import { json, spec } from 'node:bench/reporters';
 
 assert.strictEqual(benchDefault, bench);
 assert.strictEqual(describe, suite);
@@ -29,13 +30,25 @@ for (const value of [
 }
 assert.strictEqual(typeof bench.skip, 'function');
 assert.strictEqual(typeof bench.only, 'function');
+assert.strictEqual(typeof json, 'function');
+assert.strictEqual(typeof spec, 'function');
 
 assert.strictEqual(isBuiltin('node:bench'), true);
+assert.strictEqual(isBuiltin('node:bench/reporters'), true);
 assert.strictEqual(isBuiltin('bench'), false);
+assert.strictEqual(isBuiltin('bench/reporters'), false);
 assert.strictEqual(builtinModules.includes('node:bench'), true);
+assert.strictEqual(builtinModules.includes('node:bench/reporters'), true);
 assert.strictEqual(process.getBuiltinModule('node:bench'), benchDefault);
 assert.strictEqual(process.getBuiltinModule('bench'), undefined);
 
 const require = createRequire(import.meta.url);
+const reporters = require('node:bench/reporters');
+assert.strictEqual(reporters.json, json);
+assert.strictEqual(reporters.spec, spec);
 assert.throws(() => require('bench'), { code: 'MODULE_NOT_FOUND' });
+assert.throws(() => require('bench/reporters'), { code: 'MODULE_NOT_FOUND' });
 await assert.rejects(import('bench'), { code: 'ERR_MODULE_NOT_FOUND' });
+await assert.rejects(import('bench/reporters'), {
+  code: 'ERR_MODULE_NOT_FOUND',
+});
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
new file mode 100644
index 000000000000..c5a3b0000e9c
--- /dev/null
+++ b/test/parallel/test-bench-reporters.js
@@ -0,0 +1,114 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Readable } = require('stream');
+const { bench, run } = require('node:bench');
+const { json, spec } = require('node:bench/reporters');
+
+bench('json completed', {
+  params: { size: 'small' },
+  samples: 1,
+}, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
+
+bench('json failed', { samples: 1 }, () => {
+  const error = new Error('benchmark failed', { cause: 7n });
+  error.code = 'ERR_BENCHMARK_EXAMPLE';
+  throw error;
+});
+
+(async () => {
+  const chunks = await run().compose(json).toArray();
+  const lines = chunks.join('').trim().split('\n');
+  const records = lines.map((line) => JSON.parse(line));
+
+  assert.strictEqual(records.length, 6);
+  const sample = records.find(({ type }) => type === 'bench:sample');
+  assert.match(sample.data.duration_ns, /^\d+$/);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const completed = completions.find(
+    ({ data }) => data.name === 'json completed').data;
+  assert.match(completed.samples[0].duration_ns, /^\d+$/);
+
+  const failed = completions.find(
+    ({ data }) => data.name === 'json failed').data;
+  assert.strictEqual(failed.error.name, 'Error');
+  assert.strictEqual(failed.error.message, 'benchmark failed');
+  assert.strictEqual(failed.error.code, 'ERR_BENCHMARK_EXAMPLE');
+  assert.strictEqual(failed.error.cause, '7');
+  assert.match(failed.error.stack, /benchmark failed/);
+
+  const summary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+  assert.match(summary.duration_ns, /^\d+$/);
+  assert.deepStrictEqual(summary.counts, {
+    completed: 1,
+    failed: 1,
+    skipped: 0,
+    total: 2,
+  });
+
+  const synthetic = [
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'fast',
+        params: { size: 'small' },
+        samples: [{}, {}],
+        summary: {
+          mean: 1500,
+          median: 1400,
+          coefficientOfVariation: 0.1,
+          confidenceInterval: { lower: 1000, upper: 2000 },
+          skewness: 2,
+        },
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'later',
+        params: {},
+        samples: [],
+        skip: 'not supported',
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'broken',
+        params: {},
+        samples: [],
+        error: new Error('boom'),
+      },
+    },
+    {
+      type: 'bench:diagnostic',
+      data: { message: 'suite problem' },
+    },
+    {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 1, failed: 1, skipped: 1, total: 3 },
+      },
+    },
+  ];
+  const specChunks = await Readable.from(synthetic).compose(spec).toArray();
+  assert.strictEqual(specChunks.join(''),
+                     'benchmark | samples | mean rate | 95% CI | ' +
+                     'median rate | warning\n' +
+                     'fast [size="small"] | 2 | 1.50k ops/s | ' +
+                     '[1.00k ops/s, 2.00k ops/s] | 1.40k ops/s | ' +
+                     'noisy, skewed\n' +
+                     'later | 0 | - | - | - | skipped: not supported\n' +
+                     'broken | 0 | - | - | - | error: boom\n' +
+                     'diagnostic: suite problem\n\n' +
+                     '1 completed, 1 failed, 1 skipped\n');
+})().then(common.mustCall());
diff --git a/test/parallel/test-module-isBuiltin.js b/test/parallel/test-module-isBuiltin.js
index 54f25e599858..ccf359c32029 100644
--- a/test/parallel/test-module-isBuiltin.js
+++ b/test/parallel/test-module-isBuiltin.js
@@ -8,11 +8,13 @@ assert(isBuiltin('http'));
 assert(isBuiltin('sys'));
 assert(isBuiltin('node:fs'));
 assert(isBuiltin('node:bench'));
+assert(isBuiltin('node:bench/reporters'));
 assert(isBuiltin('node:test'));
 
 // Does not include internal modules
 assert(!isBuiltin('internal/errors'));
 assert(!isBuiltin('bench'));
+assert(!isBuiltin('bench/reporters'));
 assert(!isBuiltin('test'));
 assert(!isBuiltin(''));
 assert(!isBuiltin(undefined));

From 409242ca8c688fb7afd859dfa9dc091847a20cdf Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Thu, 27 Aug 2026 23:59:05 +0000
Subject: [PATCH 041/202] lib: complete the implementation of node:bench and
 cli
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/api/bench.md                              |  44 +-
 doc/api/cli.md                                | 110 +++
 doc/node.1                                    |  61 ++
 lib/bench.js                                  |   5 +-
 .../bench_runner/benchmarks_stream.js         |  20 +-
 lib/internal/bench_runner/cli.js              | 635 ++++++++++++++++++
 lib/internal/bench_runner/harness.js          |  37 +-
 lib/internal/main/bench_runner.js             |  31 +
 src/node.cc                                   |   4 +
 src/node_config_file.cc                       |   2 +-
 src/node_options-inl.h                        |  28 +-
 src/node_options.cc                           |  77 +++
 src/node_options.h                            |  14 +-
 test/fixtures/bench-runner/a.cjs              |  12 +
 test/fixtures/bench-runner/b.mjs              |  10 +
 test/fixtures/bench-runner/error.cjs          |  14 +
 test/fixtures/bench-runner/exit-code.cjs      |  10 +
 .../bench-runner/failing-reporter.cjs         |  10 +
 test/fixtures/bench-runner/import.mjs         |   1 +
 test/fixtures/bench-runner/imported.cjs       |  12 +
 test/fixtures/bench-runner/ipc.cjs            |  11 +
 test/fixtures/bench-runner/node.config.json   |   7 +
 test/fixtures/bench-runner/options.cjs        |  19 +
 test/fixtures/bench-runner/output.cjs         |  12 +
 test/fixtures/bench-runner/preload.cjs        |   3 +
 test/fixtures/bench-runner/preloaded.cjs      |  16 +
 test/fixtures/bench-runner/run.cjs            |  11 +
 test/fixtures/bench-runner/serial-a.cjs       |   3 +
 test/fixtures/bench-runner/serial-b.cjs       |   3 +
 test/fixtures/bench-runner/serial.js          |  17 +
 test/fixtures/bench-runner/utf8-output.cjs    |  14 +
 .../bench-runner/verifying-reporter.cjs       |  21 +
 test/parallel/test-bench-cli.js               | 381 +++++++++++
 test/parallel/test-bench-run-options.js       |  22 +
 test/parallel/test-bench-validation.js        |   4 +
 35 files changed, 1653 insertions(+), 28 deletions(-)
 create mode 100644 lib/internal/bench_runner/cli.js
 create mode 100644 lib/internal/main/bench_runner.js
 create mode 100644 test/fixtures/bench-runner/a.cjs
 create mode 100644 test/fixtures/bench-runner/b.mjs
 create mode 100644 test/fixtures/bench-runner/error.cjs
 create mode 100644 test/fixtures/bench-runner/exit-code.cjs
 create mode 100644 test/fixtures/bench-runner/failing-reporter.cjs
 create mode 100644 test/fixtures/bench-runner/import.mjs
 create mode 100644 test/fixtures/bench-runner/imported.cjs
 create mode 100644 test/fixtures/bench-runner/ipc.cjs
 create mode 100644 test/fixtures/bench-runner/node.config.json
 create mode 100644 test/fixtures/bench-runner/options.cjs
 create mode 100644 test/fixtures/bench-runner/output.cjs
 create mode 100644 test/fixtures/bench-runner/preload.cjs
 create mode 100644 test/fixtures/bench-runner/preloaded.cjs
 create mode 100644 test/fixtures/bench-runner/run.cjs
 create mode 100644 test/fixtures/bench-runner/serial-a.cjs
 create mode 100644 test/fixtures/bench-runner/serial-b.cjs
 create mode 100644 test/fixtures/bench-runner/serial.js
 create mode 100644 test/fixtures/bench-runner/utf8-output.cjs
 create mode 100644 test/fixtures/bench-runner/verifying-reporter.cjs
 create mode 100644 test/parallel/test-bench-cli.js
 create mode 100644 test/parallel/test-bench-run-options.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index b4488e119cd1..dcdd5714fccc 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -23,6 +23,10 @@ const { bench, suite } = require('node:bench');
 
 This module is only available under the `node:` scheme.
 
+## Example benchmark
+
+Save the following as `benchmark.mjs`:
+
 ```mjs
 import { bench, suite } from 'node:bench';
 
@@ -44,6 +48,12 @@ suite('URL', () => {
 });
 ```
 
+Run the benchmark from the command line:
+
+```console
+node --bench benchmark.mjs
+```
+
 Benchmarks are executed serially in declaration order. Declared benchmarks are
 scheduled automatically. Call `run()` during the same turn as the declarations
 to consume the event stream or configure filtering.
@@ -65,6 +75,31 @@ system load can all affect results. Keep raw samples when comparing results and
 investigate noisy or skewed distributions rather than treating a confidence
 interval as a pass/fail threshold.
 
+## Command-line runner
+
+The `--bench` flag runs one or more explicit benchmark files or glob patterns:
+
+```console
+node --bench benchmark.mjs
+node --bench --bench-reporter=json 'benchmarks/**/*.js'
+```
+
+Files are sorted and executed serially. The default
+`--bench-isolation=process` mode runs each file in a separate child process and
+emits one aggregate summary. Structured events are transferred to the parent
+without JSON conversion, preserving BigInt durations, errors, and parameter
+values. Child writes to stdout and stderr are emitted as diagnostic records so
+they do not corrupt reporter output.
+
+`--bench-isolation=none` imports all files into the runner process. This mode
+has lower startup overhead, but module, heap, and process state carry between
+files, and user writes share stdout and stderr with reporters.
+
+Benchmark files passed to `--bench` should declare benchmarks but must not call
+`run()`. The CLI supports `--bench-name-pattern`, `--bench-samples`,
+`--bench-warmup`, `--bench-reporter`, and `--bench-reporter-destination`. See
+the [command-line options documentation][] for details.
+
 ## Benchmark reporters
 
 The built-in reporters are available from the scheme-only
@@ -273,7 +308,11 @@ added: REPLACEME
   * `namePattern` {string|RegExp} Only runs benchmarks whose full hierarchical
     name matches the pattern. String values are interpreted as JavaScript
     regular expressions.
+  * `samples` {number} Overrides the number of measured callback invocations
+    for every benchmark. Must be a positive 32-bit unsigned integer.
   * `signal` {AbortSignal} Allows aborting in-progress benchmark execution.
+  * `warmup` {number} Overrides the number of unreported warmup callback
+    invocations for every benchmark. Must be a 32-bit unsigned integer.
 * Returns: {BenchmarksStream}
 
 Returns the object-mode event stream for the in-process benchmark run. Call
@@ -374,7 +413,9 @@ Every benchmark-scoped event contains `benchId` and `parentId`.
 additional `error` property and may contain samples recorded before the error.
 A skipped result has an additional `skip` property and an empty `samples`
 array. `'bench:diagnostic'` reports suite and hook errors. `'bench:summary'`
-contains overall `success`, `counts`, `duration_ns`, and `file` properties.
+contains overall `success`, `counts`, `duration_ns`, and `file` properties. The
+`file` is {string|null}; it is `null` when the summary aggregates multiple
+files.
 
 ## Sample result
 
@@ -412,3 +453,4 @@ A completed benchmark result contains:
   * `skewness` {number} The skewness of the scaled rate histogram.
 
 [benchmark result]: #benchmark-result
+[command-line options documentation]: cli.md#--bench
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 59945be330a2..1b7edab885f4 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -450,6 +450,109 @@ Error: Access to this API has been restricted
 }
 ```
 
+### `--bench`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+
+```console
+node --bench benchmark.mjs
+node --bench 'benchmarks/**/*.js'
+```
+
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using `node:bench`; they must not
+call `run()` themselves. See the [benchmark runner][] documentation for more
+details.
+
+This flag cannot be combined with `--test`, `--watch`, `--watch-path`,
+`--check`, `--eval`, or `--interactive`.
+
+### `--bench-isolation=mode`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Configures benchmark file isolation. When `mode` is `'process'`, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+
+When `mode` is `'none'`, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+
+### `--bench-name-pattern=pattern`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression `pattern`. Non-matching benchmarks are reported as skipped.
+
+### `--bench-reporter-destination=destination`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Specifies the destination for the corresponding benchmark reporter. The value
+can be `stdout`, `stderr`, or a file path. A single reporter defaults to
+`stdout` when no destination is specified.
+
+### `--bench-reporter=reporter`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Specifies a benchmark reporter. The built-in reporters are `spec` and `json`.
+The `json` reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding `--bench-reporter-destination`. The default reporter is
+`spec`.
+
+### `--bench-samples=count`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the number of measured callback invocations for every selected
+benchmark. `count` must be an integer between `1` and `4294967295`.
+
+### `--bench-warmup=count`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. `count` must be an integer between `0` and `4294967295`.
+
 ### `--build-sea=config`
 
 <!-- YAML
@@ -3912,6 +4015,12 @@ one is included in the list below.
 * `--allow-openssl-store`
 * `--allow-wasi`
 * `--allow-worker`
+* `--bench-isolation`
+* `--bench-name-pattern`
+* `--bench-reporter-destination`
+* `--bench-reporter`
+* `--bench-samples`
+* `--bench-warmup`
 * `--conditions`, `-C`
 * `--cpu-prof-dir`
 * `--cpu-prof-interval`
@@ -4620,6 +4729,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`v8.startupSnapshot.setDeserializeMainFunction()`]: v8.md#v8startupsnapshotsetdeserializemainfunctioncallback-data
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
 [asynchronous module customization hooks]: module.md#asynchronous-customization-hooks
+[benchmark runner]: bench.md#command-line-runner
 [captured by the built-in snapshot of Node.js]: https://github.com/nodejs/node/blob/b19525a33cc84033af4addd0f80acd4dc33ce0cf/test/parallel/test-bootstrap-modules.js#L24
 [collecting code coverage from tests]: test.md#collecting-code-coverage
 [conditional exports]: packages.md#conditional-exports
diff --git a/doc/node.1 b/doc/node.1
index e0a467967f7c..5811d541713d 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -281,6 +281,55 @@ Error: Access to this API has been restricted
 }
 .Ed
 .
+.It Fl -bench
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+.Bd -literal
+node --bench benchmark.mjs
+node --bench 'benchmarks/**/*.js'
+.Ed
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using \fBnode:bench\fR; they must not
+call \fBrun()\fR themselves. See the benchmark runner documentation for more
+details.
+This flag cannot be combined with \fB--test\fR, \fB--watch\fR, \fB--watch-path\fR,
+\fB--check\fR, \fB--eval\fR, or \fB--interactive\fR.
+.
+.It Fl -bench-isolation Ns = Ns Ar mode
+Configures benchmark file isolation. When \fBmode\fR is \fB'process'\fR, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+When \fBmode\fR is \fB'none'\fR, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+.
+.It Fl -bench-name-pattern Ns = Ns Ar pattern
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression \fBpattern\fR. Non-matching benchmarks are reported as skipped.
+.
+.It Fl -bench-reporter-destination Ns = Ns Ar destination
+Specifies the destination for the corresponding benchmark reporter. The value
+can be \fBstdout\fR, \fBstderr\fR, or a file path. A single reporter defaults to
+\fBstdout\fR when no destination is specified.
+.
+.It Fl -bench-reporter Ns = Ns Ar reporter
+Specifies a benchmark reporter. The built-in reporters are \fBspec\fR and \fBjson\fR.
+The \fBjson\fR reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding \fB--bench-reporter-destination\fR. The default reporter is
+\fBspec\fR.
+.
+.It Fl -bench-samples Ns = Ns Ar count
+Overrides the number of measured callback invocations for every selected
+benchmark. \fBcount\fR must be an integer between \fB1\fR and \fB4294967295\fR.
+.
+.It Fl -bench-warmup Ns = Ns Ar count
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. \fBcount\fR must be an integer between \fB0\fR and \fB4294967295\fR.
+.
 .It Fl -build-sea Ns = Ns Ar config
 Generates a single executable application from a JSON
 configuration file. The argument must be a path to the configuration file. If
@@ -1976,6 +2025,18 @@ one is included in the list below.
 .It
 \fB--allow-worker\fR
 .It
+\fB--bench-isolation\fR
+.It
+\fB--bench-name-pattern\fR
+.It
+\fB--bench-reporter-destination\fR
+.It
+\fB--bench-reporter\fR
+.It
+\fB--bench-samples\fR
+.It
+\fB--bench-warmup\fR
+.It
 \fB--conditions\fR, \fB-C\fR
 .It
 \fB--cpu-prof-dir\fR
diff --git a/lib/bench.js b/lib/bench.js
index 454fad4f8570..cc3aa686ee57 100644
--- a/lib/bench.js
+++ b/lib/bench.js
@@ -15,7 +15,10 @@ const {
 } = require('internal/bench_runner/harness');
 const { run } = require('internal/bench_runner/runner');
 
-emitExperimentalWarning('Benchmarks');
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
 
 module.exports = bench;
 ObjectAssign(module.exports, {
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
index ac3896d0587e..21d34896608b 100644
--- a/lib/internal/bench_runner/benchmarks_stream.js
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -3,12 +3,12 @@
 const {
   ArrayPrototypePush,
   ArrayPrototypeShift,
-  NumberMAX_SAFE_INTEGER,
   Symbol,
 } = primordials;
 const Readable = require('internal/streams/readable');
 
 const kEmitMessage = Symbol('kEmitMessage');
+const kBenchmarksStreamDrain = Symbol('kBenchmarksStreamDrain');
 
 class BenchmarksStream extends Readable {
   #buffer = [];
@@ -18,45 +18,46 @@ class BenchmarksStream extends Readable {
     super({
       __proto__: null,
       objectMode: true,
-      highWaterMark: NumberMAX_SAFE_INTEGER,
     });
   }
 
   _read() {
+    const wasBlocked = !this.#canPush;
     this.#canPush = true;
     while (this.#buffer.length > 0) {
       const record = ArrayPrototypeShift(this.#buffer);
       if (!this.#tryPush(record)) return;
     }
+    if (wasBlocked) this.emit(kBenchmarksStreamDrain);
   }
 
   start(data) {
-    this[kEmitMessage]('bench:start', data);
+    return this[kEmitMessage]('bench:start', data);
   }
 
   sample(data) {
-    this[kEmitMessage]('bench:sample', data);
+    return this[kEmitMessage]('bench:sample', data);
   }
 
   complete(data) {
-    this[kEmitMessage]('bench:complete', data);
+    return this[kEmitMessage]('bench:complete', data);
   }
 
   diagnostic(data) {
-    this[kEmitMessage]('bench:diagnostic', data);
+    return this[kEmitMessage]('bench:diagnostic', data);
   }
 
   summary(data) {
-    this[kEmitMessage]('bench:summary', data);
+    return this[kEmitMessage]('bench:summary', data);
   }
 
   end() {
-    this.#tryPush(null);
+    return this.#tryPush(null);
   }
 
   [kEmitMessage](type, data) {
     this.emit(type, data);
-    this.#tryPush({ type, data });
+    return this.#tryPush({ type, data });
   }
 
   #tryPush(record) {
@@ -71,4 +72,5 @@ class BenchmarksStream extends Readable {
 
 module.exports = {
   BenchmarksStream,
+  kBenchmarksStreamDrain,
 };
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
new file mode 100644
index 000000000000..5a1bb2cbf3a5
--- /dev/null
+++ b/lib/internal/bench_runner/cli.js
@@ -0,0 +1,635 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayPrototypeFilter,
+  ArrayPrototypeIncludes,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypePushApply,
+  ArrayPrototypeSome,
+  ArrayPrototypeSort,
+  NumberIsSafeInteger,
+  ObjectGetOwnPropertyDescriptor,
+  Promise,
+  PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
+  RegExp,
+  SafeMap,
+  SafePromiseAllReturnVoid,
+  SafeSet,
+  String,
+  StringPrototypeIndexOf,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+} = primordials;
+const { spawn } = require('child_process');
+const { createWriteStream, statSync } = require('fs');
+const { Glob } = require('internal/fs/glob');
+const {
+  BenchmarksStream,
+  kBenchmarksStreamDrain,
+} = require('internal/bench_runner/benchmarks_stream');
+const {
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  codes: {
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { getOptionValue, getOptionsAsFlagsFromBinding } = require('internal/options');
+const { kEmptyObject } = require('internal/util');
+const { validateUint32 } = require('internal/validators');
+const { pathToFileURL } = require('internal/url');
+const { pipeline } = require('stream/promises');
+const { once } = require('events');
+const { resolve, sep } = require('path');
+
+const console = require('internal/console/global');
+const esmLoader = require('internal/modules/esm/loader');
+const { bigint: hrtime } = process.hrtime;
+
+const kBuiltinDestinations = new SafeMap([
+  ['stdout', process.stdout],
+  ['stderr', process.stderr],
+]);
+const kBuiltinReporters = new SafeMap([
+  ['json', 'internal/bench_runner/reporter/json'],
+  ['spec', 'internal/bench_runner/reporter/spec'],
+]);
+const kChildMessageType = 'node:bench:record';
+const kEventTypes = new SafeSet([
+  'bench:start',
+  'bench:sample',
+  'bench:complete',
+  'bench:diagnostic',
+  'bench:summary',
+]);
+const kFilterArgs = ['--bench', '--experimental-default-config-file'];
+const kFilterArgValues = [
+  '--bench-isolation',
+  '--bench-name-pattern',
+  '--bench-reporter',
+  '--bench-reporter-destination',
+  '--bench-samples',
+  '--bench-warmup',
+  '--experimental-config-file',
+];
+
+function createBenchmarkFileList(patterns, cwd) {
+  if (patterns.length === 0) {
+    console.error('--bench requires at least one file or glob pattern');
+    return null;
+  }
+
+  const glob = new Glob(patterns, { __proto__: null, cwd });
+  const files = ArrayPrototypeFilter(glob.globSync(), (path) => {
+    try {
+      return statSync(resolve(cwd, path)).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if (files.length === 0) {
+    console.error(`Could not find '${ArrayPrototypeJoin(patterns, ', ')}'`);
+    return null;
+  }
+  return ArrayPrototypeSort(files);
+}
+
+function createChildFileList(patterns, cwd) {
+  if (patterns.length !== 1) {
+    console.error('benchmark child process requires exactly one file');
+    return null;
+  }
+  const path = resolve(cwd, patterns[0]);
+  try {
+    if (statSync(path).isFile()) return [path];
+  } catch {
+    // Fall through to the standard not-found diagnostic.
+  }
+  console.error(`Could not find '${patterns[0]}'`);
+  return null;
+}
+
+function parseNamePattern(value) {
+  if (value.length === 0) return undefined;
+  try {
+    return new RegExp(value);
+  } catch (error) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-name-pattern', value,
+      `is an invalid regular expression. ${error.message}`);
+  }
+}
+
+function parseCommandLine() {
+  const reporters = getOptionValue('--bench-reporter');
+  const destinations = getOptionValue('--bench-reporter-destination');
+  const isChild = process.env.NODE_BENCH_CONTEXT === 'child' &&
+    typeof process.send === 'function';
+
+  if (!isChild) {
+    if (reporters.length === 0 && destinations.length === 0) {
+      ArrayPrototypePush(reporters, 'spec');
+    }
+    if (reporters.length === 1 && destinations.length === 0) {
+      ArrayPrototypePush(destinations, 'stdout');
+    }
+    if (reporters.length !== destinations.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        '--bench-reporter', reporters,
+        'must match the number of specified ' +
+        "'--bench-reporter-destination'");
+    }
+  }
+
+  const samples = getOptionValue('[has_bench_samples]') ?
+    getOptionValue('--bench-samples') : undefined;
+  const warmup = getOptionValue('[has_bench_warmup]') ?
+    getOptionValue('--bench-warmup') : undefined;
+  if (samples !== undefined) {
+    validateUint32(samples, '--bench-samples', true);
+  }
+  if (warmup !== undefined) {
+    validateUint32(warmup, '--bench-warmup');
+  }
+
+  return {
+    __proto__: null,
+    cwd: process.cwd(),
+    destinations,
+    isChild,
+    isolation: getOptionValue('--bench-isolation'),
+    namePattern: parseNamePattern(getOptionValue('--bench-name-pattern')),
+    namePatternSource: getOptionValue('--bench-name-pattern'),
+    reporters,
+    samples,
+    warmup,
+  };
+}
+
+async function loadReporter(name) {
+  const builtin = kBuiltinReporters.get(name);
+  let reporter;
+  if (builtin !== undefined) {
+    reporter = require(builtin);
+  } else {
+    let parentURL;
+    try {
+      parentURL = pathToFileURL(`${process.cwd()}${sep}`).href;
+    } catch {
+      parentURL = 'file:///';
+    }
+    const loader = esmLoader.getOrInitializeCascadedLoader();
+    reporter = await loader.import(name, parentURL, kEmptyObject);
+  }
+
+  reporter = reporter?.default ?? reporter;
+  if (reporter?.prototype &&
+      ObjectGetOwnPropertyDescriptor(reporter.prototype, 'constructor')) {
+    reporter = new reporter();
+  }
+  if (!reporter) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-reporter', name, 'is not a valid reporter');
+  }
+  return reporter;
+}
+
+async function setupReporters(stream, reporters, destinations) {
+  const state = { __proto__: null, error: undefined, pending: [] };
+  try {
+    for (let i = 0; i < reporters.length; i++) {
+      const reporter = await loadReporter(reporters[i]);
+      const builtinDestination = kBuiltinDestinations.get(destinations[i]);
+      const destination = builtinDestination ??
+        createWriteStream(destinations[i], { __proto__: null, flush: true });
+      const pending = PromisePrototypeThen(pipeline(
+        stream,
+        reporter,
+        destination,
+        { __proto__: null, end: builtinDestination === undefined },
+      ), undefined, (error) => {
+        state.error ??= error;
+      });
+      ArrayPrototypePush(state.pending, pending);
+    }
+  } catch (error) {
+    stream.destroy();
+    await SafePromiseAllReturnVoid(state.pending);
+    throw error;
+  }
+  return state;
+}
+
+async function finishReporters(state) {
+  await SafePromiseAllReturnVoid(state.pending);
+  if (state.error !== undefined) throw state.error;
+}
+
+function emitRecord(stream, record) {
+  switch (record.type) {
+    case 'bench:start':
+      return stream.start(record.data);
+    case 'bench:sample':
+      return stream.sample(record.data);
+    case 'bench:complete':
+      return stream.complete(record.data);
+    case 'bench:diagnostic':
+      return stream.diagnostic(record.data);
+    case 'bench:summary':
+      return stream.summary(record.data);
+    default:
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark event type', record.type, 'is not recognized');
+  }
+}
+
+function emitRecordAndWait(stream, record) {
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  if (emitRecord(stream, record)) return undefined;
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  return once(stream, kBenchmarksStreamDrain);
+}
+
+function serializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: serializeError(record.data.error),
+    },
+  };
+}
+
+function deserializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: deserializeError(record.data.error),
+    },
+  };
+}
+
+function validateRecord(record) {
+  if (record === null || typeof record !== 'object' ||
+      !kEventTypes.has(record.type) || record.data === null ||
+      typeof record.data !== 'object') {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  if (record.type === 'bench:summary') {
+    const { counts, duration_ns, success } = record.data;
+    if (typeof success !== 'boolean' || typeof duration_ns !== 'bigint' ||
+        counts === null || typeof counts !== 'object' ||
+        !NumberIsSafeInteger(counts.completed) || counts.completed < 0 ||
+        !NumberIsSafeInteger(counts.failed) || counts.failed < 0 ||
+        !NumberIsSafeInteger(counts.skipped) || counts.skipped < 0 ||
+        !NumberIsSafeInteger(counts.total) || counts.total < 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child summary', record.data,
+        'is not a valid benchmark summary');
+    }
+  }
+  return record;
+}
+
+function sendRecord(record) {
+  return new Promise((resolve, reject) => {
+    try {
+      process.send({
+        __proto__: null,
+        type: kChildMessageType,
+        record: serializeRecord(record),
+      }, undefined, undefined, (error) => {
+        if (error) reject(error);
+        else resolve();
+      });
+    } catch (error) {
+      reject(error);
+    }
+  });
+}
+
+async function loadUserImports(options) {
+  const parentURL = pathToFileURL(`${options.cwd}${sep}`).href;
+  const loader = esmLoader.getOrInitializeCascadedLoader();
+  const userImports = getOptionValue('--import');
+  for (let i = 0; i < userImports.length; i++) {
+    await loader.import(userImports[i], parentURL, kEmptyObject);
+  }
+  return { __proto__: null, loader, parentURL };
+}
+
+async function loadBenchmarkFiles(files, options, modules, onRecord) {
+  const { loader, parentURL } = modules;
+  let loadFailed = false;
+  for (let i = 0; i < files.length; i++) {
+    const file = resolve(options.cwd, files[i]);
+    try {
+      await loader.import(pathToFileURL(file), parentURL, kEmptyObject);
+    } catch (error) {
+      loadFailed = true;
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          message: error?.message ?? String(error),
+          error,
+          level: 'error',
+          file,
+        },
+      });
+    }
+  }
+
+  const stream = runBenchmarks({
+    __proto__: null,
+    namePattern: options.namePattern,
+    samples: options.samples,
+    warmup: options.warmup,
+  }, true);
+  let summary;
+  for await (const record of stream) {
+    if (record.type === 'bench:summary' &&
+        (loadFailed || (process.exitCode ?? 0) !== 0)) {
+      record.data.success = false;
+    }
+    if (record.type === 'bench:summary') {
+      record.data.file = files.length === 1 ?
+        resolve(options.cwd, files[0]) : null;
+      summary = record.data;
+    }
+    await onRecord(record);
+  }
+  return summary;
+}
+
+function filterExecArgv(arg, index, args) {
+  return !ArrayPrototypeIncludes(kFilterArgs, arg) &&
+    !ArrayPrototypeSome(kFilterArgValues, (option) => {
+      return arg === option ||
+        StringPrototypeStartsWith(arg, `${option}=`) ||
+        (option !== '--experimental-config-file' &&
+         index > 0 && args[index - 1] === option);
+    });
+}
+
+function getOptionName(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  return equals === -1 ? arg : StringPrototypeSlice(arg, 0, equals);
+}
+
+const kOptionAliases = new SafeMap([
+  ['--loader', '--experimental-loader'],
+  ['-C', '--conditions'],
+  ['-r', '--require'],
+]);
+
+function getChildArgs(path, options) {
+  const nodeOptions = getOptionsAsFlagsFromBinding();
+  const args = ArrayPrototypeFilter(nodeOptions, filterExecArgv);
+  const nodeOptionNames = new SafeSet();
+  for (let i = 0; i < nodeOptions.length; i++) {
+    nodeOptionNames.add(getOptionName(nodeOptions[i]));
+  }
+  const unknownExecArgv = ArrayPrototypeFilter(
+    process.execArgv,
+    (arg, index, values) => {
+      if (!filterExecArgv(arg, index, values)) return false;
+      const optionName = getOptionName(arg);
+      const name = kOptionAliases.get(optionName) ?? optionName;
+      if (nodeOptionNames.has(name)) return false;
+      if (!StringPrototypeStartsWith(arg, '-') && index > 0) {
+        const previousName = getOptionName(values[index - 1]);
+        const previous = kOptionAliases.get(previousName) ?? previousName;
+        if (nodeOptionNames.has(previous)) return false;
+      }
+      return true;
+    },
+  );
+  ArrayPrototypePushApply(args, unknownExecArgv);
+  ArrayPrototypePush(args, '--bench', '--bench-isolation=none');
+  if (options.namePatternSource.length > 0) {
+    ArrayPrototypePush(
+      args, `--bench-name-pattern=${options.namePatternSource}`);
+  }
+  if (options.samples !== undefined) {
+    ArrayPrototypePush(args, `--bench-samples=${options.samples}`);
+  }
+  if (options.warmup !== undefined) {
+    ArrayPrototypePush(args, `--bench-warmup=${options.warmup}`);
+  }
+  ArrayPrototypePush(args, '--', resolve(options.cwd, path));
+  return args;
+}
+
+async function runChild(path, options, onRecord) {
+  const child = spawn(process.execPath, getChildArgs(path, options), {
+    __proto__: null,
+    cwd: options.cwd,
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_CONTEXT: 'child',
+    },
+    serialization: 'advanced',
+    stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
+  });
+  let protocolError;
+  const pendingRecords = new SafeSet();
+  const handleRecord = (record) => {
+    if (protocolError !== undefined) return;
+    try {
+      return onRecord(record);
+    } catch (error) {
+      protocolError = error;
+      child.kill();
+    }
+  };
+  const trackPending = (pending, source) => {
+    if (pending === undefined) return;
+    source?.pause();
+    const tracked = PromisePrototypeThen(PromiseResolve(pending), () => {
+      pendingRecords.delete(tracked);
+      source?.resume();
+    }, (error) => {
+      pendingRecords.delete(tracked);
+      protocolError = error;
+      child.kill();
+    });
+    pendingRecords.add(tracked);
+  };
+  const reportOutput = (source, stream, message) => {
+    const pending = handleRecord({
+      __proto__: null,
+      type: 'bench:diagnostic',
+      data: {
+        __proto__: null,
+        message,
+        level: 'info',
+        file: path,
+        stream,
+      },
+    });
+    trackPending(pending, source);
+  };
+  child.stdout.setEncoding('utf8');
+  child.stderr.setEncoding('utf8');
+  child.stdout.on('data', (data) => {
+    reportOutput(child.stdout, 'stdout', data);
+  });
+  child.stderr.on('data', (data) => {
+    reportOutput(child.stderr, 'stderr', data);
+  });
+  child.on('message', (message) => {
+    if (message?.type !== kChildMessageType) return;
+    try {
+      const pending = handleRecord(
+        deserializeRecord(validateRecord(message.record)));
+      trackPending(pending);
+    } catch (error) {
+      protocolError = error;
+      child.kill();
+    }
+  });
+  const { 0: code, 1: signal } = await once(child, 'close');
+  await SafePromiseAllReturnVoid(ArrayFrom(pendingRecords));
+  if (protocolError !== undefined) throw protocolError;
+  return { __proto__: null, code, signal };
+}
+
+async function runIsolated(files, options, output) {
+  const counts = {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 0,
+  };
+  const start = hrtime();
+  let success = true;
+
+  for (let i = 0; i < files.length; i++) {
+    const path = files[i];
+    let childSummary;
+    let result;
+    try {
+      result = await runChild(path, options, (record) => {
+        if (record.type === 'bench:summary') {
+          childSummary = record.data;
+          return;
+        }
+        return emitRecordAndWait(output, record);
+      });
+    } catch (error) {
+      success = false;
+      output.diagnostic({
+        __proto__: null,
+        message: error.message,
+        error,
+        level: 'error',
+        file: path,
+      });
+      continue;
+    }
+
+    if (childSummary !== undefined) {
+      success &&= childSummary.success;
+      counts.completed += childSummary.counts.completed;
+      counts.failed += childSummary.counts.failed;
+      counts.skipped += childSummary.counts.skipped;
+      counts.total += childSummary.counts.total;
+    }
+    if (childSummary === undefined || result.code !== 0 ||
+        result.signal !== null) {
+      success = false;
+      if (childSummary === undefined || childSummary.success) {
+        const status = result.signal === null ?
+          `exit code ${result.code}` : `signal ${result.signal}`;
+        output.diagnostic({
+          __proto__: null,
+          message: `Benchmark file '${path}' failed with ${status}`,
+          level: 'error',
+          file: path,
+        });
+      }
+    }
+  }
+
+  const summary = {
+    __proto__: null,
+    success: success && (process.exitCode ?? 0) === 0,
+    counts,
+    duration_ns: hrtime() - start,
+    file: files.length === 1 ? resolve(options.cwd, files[0]) : null,
+  };
+  output.summary(summary);
+  return summary;
+}
+
+async function run(patterns) {
+  const options = parseCommandLine();
+  const files = options.isChild ?
+    createChildFileList(patterns, options.cwd) :
+    createBenchmarkFileList(patterns, options.cwd);
+  if (files === null) return { __proto__: null, success: false };
+
+  if (options.isChild) {
+    try {
+      const modules = await loadUserImports(options);
+      return await loadBenchmarkFiles(
+        files, options, modules, sendRecord);
+    } finally {
+      if (process.connected) process.disconnect();
+    }
+  }
+
+  const output = new BenchmarksStream();
+  let executionError;
+  let reporterState;
+  let summary;
+  try {
+    options.modules = await loadUserImports(options);
+    reporterState = await setupReporters(
+      output, options.reporters, options.destinations);
+    if (options.isolation === 'process') {
+      summary = await runIsolated(files, options, output);
+    } else {
+      summary = await loadBenchmarkFiles(
+        files,
+        options,
+        options.modules,
+        (record) => emitRecordAndWait(output, record),
+      );
+    }
+  } catch (error) {
+    executionError = error;
+  } finally {
+    output.end();
+  }
+  if (reporterState !== undefined) await finishReporters(reporterState);
+  if (executionError !== undefined) throw executionError;
+  return summary;
+}
+
+module.exports = { run };
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index 0409b38e6b91..1e6dac738cb4 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -37,8 +37,10 @@ const {
   validateAbortSignal,
   validateFunction,
   validateObject,
+  validateUint32,
 } = require('internal/validators');
 const { queueMicrotask } = require('internal/process/task_queues');
+const { getOptionValue } = require('internal/options');
 const { clearTimeout, setImmediate, setTimeout } = require('timers');
 const {
   Bench,
@@ -53,6 +55,7 @@ const {
 
 const { bigint: hrtime } = process.hrtime;
 const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
+const kIsCliRunner = getOptionValue('--bench');
 
 function eventLoopTurn() {
   return new Promise((resolve) => setImmediate(resolve));
@@ -77,7 +80,9 @@ class Harness {
     this.state = 'collecting';
     this.namePattern = null;
     this.outerSignal = undefined;
+    this.samples = undefined;
     this.success = true;
+    this.warmup = undefined;
     this.counts = {
       __proto__: null,
       completed: 0,
@@ -188,7 +193,7 @@ class Harness {
       return;
     }
 
-    const { namePattern, signal } = options;
+    const { namePattern, samples, signal, warmup } = options;
     if (namePattern !== undefined) {
       if (typeof namePattern === 'string') {
         this.namePattern = new RegExp(namePattern);
@@ -199,18 +204,31 @@ class Harness {
           'options.namePattern', ['string', 'RegExp'], namePattern);
       }
     }
+    if (samples !== undefined) {
+      validateUint32(samples, 'options.samples', true);
+      this.samples = samples;
+    }
     validateAbortSignal(signal, 'options.signal');
     this.outerSignal = signal;
+    if (warmup !== undefined) {
+      validateUint32(warmup, 'options.warmup');
+      this.warmup = warmup;
+    }
     this.#explicitRun = true;
   }
 
-  run(options = kEmptyObject) {
+  run(options = kEmptyObject, force = false) {
+    if (kIsCliRunner && !force) {
+      throw new ERR_INVALID_STATE(
+        'run() cannot be called from a file run with --bench');
+    }
     this.configure(options);
-    this.#schedule();
+    this.#schedule(force);
     return this.stream;
   }
 
-  #schedule() {
+  #schedule(force = false) {
+    if (!force && kIsCliRunner) return;
     if (this.#scheduled) return;
     this.#scheduled = true;
     queueMicrotask(() => {
@@ -553,7 +571,8 @@ class Harness {
         try {
           await this.#runBenchHooks(
             benchmark, 'beforeEach', hookContext);
-          const total = benchmark.warmup + benchmark.samples;
+          const warmup = this.warmup ?? benchmark.warmup;
+          const total = warmup + (this.samples ?? benchmark.samples);
           for (let i = 0; i < total; i++) {
             if (controller.signal.aborted) {
               throw controller.signal.reason;
@@ -563,14 +582,14 @@ class Harness {
             if (controller.signal.aborted) {
               throw controller.signal.reason;
             }
-            if (i >= benchmark.warmup) {
+            if (i >= warmup) {
               ArrayPrototypePush(samples, sample);
               this.stream.sample({
                 __proto__: null,
                 benchId: benchmark.benchId,
                 parentId: benchmark.parentId,
                 name: benchmark.name,
-                index: i - benchmark.warmup,
+                index: i - warmup,
                 ...sample,
               });
             }
@@ -671,8 +690,8 @@ function hook(name) {
 const bench = runInParentContext('benchmark');
 const suite = runInParentContext('suite');
 
-function runBenchmarks(options) {
-  return lazyHarness().run(options);
+function runBenchmarks(options, force) {
+  return lazyHarness().run(options, force);
 }
 
 module.exports = {
diff --git a/lib/internal/main/bench_runner.js b/lib/internal/main/bench_runner.js
new file mode 100644
index 000000000000..ff3647fe785c
--- /dev/null
+++ b/lib/internal/main/bench_runner.js
@@ -0,0 +1,31 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  PromisePrototypeThen,
+} = primordials;
+const {
+  markBootstrapComplete,
+  prepareTestRunnerMainExecution,
+} = require('internal/process/pre_execution');
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  triggerUncaughtException,
+  exitCodes: { kGenericUserError },
+} = internalBinding('errors');
+
+prepareTestRunnerMainExecution();
+markBootstrapComplete();
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+const { run } = require('internal/bench_runner/cli');
+const patterns = ArrayPrototypeSlice(process.argv, 1);
+
+PromisePrototypeThen(run(patterns), ({ success }) => {
+  if (!success) process.exitCode = kGenericUserError;
+}, (error) => {
+  triggerUncaughtException(error, true /* fromPromise */);
+});
diff --git a/src/node.cc b/src/node.cc
index 5a926fa775a3..a43eb28b779d 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -384,6 +384,10 @@ MaybeLocal<Value> StartExecution(Environment* env,
     return StartExecution(env, "internal/main/check_syntax");
   }
 
+  if (env->options()->bench_runner) {
+    return StartExecution(env, "internal/main/bench_runner");
+  }
+
   if (env->options()->test_runner) {
     return StartExecution(env, "internal/main/test_runner");
   }
diff --git a/src/node_config_file.cc b/src/node_config_file.cc
index 68c13ad881fc..73d2342d81f1 100644
--- a/src/node_config_file.cc
+++ b/src/node_config_file.cc
@@ -451,7 +451,7 @@ ParseResult ConfigReader::ParseConfigObject(
     }
   }
 
-  // Add implicit flags for namespaces (--test, --permission, --watch)
+  // Add implicit flags for namespaces (--bench, --test, --permission, --watch)
   // These flags are automatically enabled when their namespace is present
   for (const auto& ns : namespaces_with_implicit_flags) {
     std::string flag = "--" + ns;
diff --git a/src/node_options-inl.h b/src/node_options-inl.h
index 933311c70ea8..dac206791c35 100644
--- a/src/node_options-inl.h
+++ b/src/node_options-inl.h
@@ -4,6 +4,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <algorithm>
+#include <charconv>
 #include <cstdlib>
 #include <ranges>
 #include <type_traits>
@@ -52,7 +53,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                                        const char* help_text,
                                        uint64_t Options::*field,
                                        OptionEnvvarSettings env_setting,
-                                       OptionNamespaces namespace_id) {
+                                       OptionNamespaces namespace_id,
+                                       bool strict) {
   options_.emplace(
       name,
       OptionInfo{kUInteger,
@@ -60,7 +62,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                  env_setting,
                  help_text,
                  false,
-                 NamespaceEnumToString(namespace_id)});
+                 NamespaceEnumToString(namespace_id),
+                 strict});
 }
 
 template <typename Options>
@@ -239,7 +242,8 @@ auto OptionsParser<Options>::Convert(
                     original.env_setting,
                     original.help_text,
                     original.default_is_true,
-                    original.namespace_id};
+                    original.namespace_id,
+                    original.strict};
 }
 
 template <typename Options>
@@ -502,10 +506,22 @@ void OptionsParser<Options>::Parse(
         *Lookup<int64_t>(info.field, options) = std::atoll(value.c_str());
         break;
       }
-      case kUInteger:
-        *Lookup<uint64_t>(info.field, options) =
-            std::strtoull(value.c_str(), nullptr, 10);
+      case kUInteger: {
+        if (!info.strict) {
+          *Lookup<uint64_t>(info.field, options) =
+              std::strtoull(value.c_str(), nullptr, 10);
+          break;
+        }
+        uint64_t parsed;
+        const char* end = value.data() + value.size();
+        const auto result = std::from_chars(value.data(), end, parsed);
+        if (result.ec != std::errc() || result.ptr != end) {
+          errors->push_back("invalid value for " + name);
+          break;
+        }
+        *Lookup<uint64_t>(info.field, options) = parsed;
         break;
+      }
       case kString:
         *Lookup<std::string>(info.field, options) = value;
         break;
diff --git a/src/node_options.cc b/src/node_options.cc
index 4665f1faeda7..d9c0b70fbd56 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -39,6 +39,8 @@ using v8::Undefined;
 using v8::Value;
 namespace node {
 
+constexpr bool kStrictOptionParsing = true;
+
 namespace per_process {
 Mutex cli_options_mutex;
 std::shared_ptr<PerProcessOptions> cli_options{new PerProcessOptions()};
@@ -241,6 +243,38 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors,
     errors->push_back("invalid value for --trace-require-module");
   }
 
+  if (bench_runner && test_runner) {
+    errors->push_back("either --bench or --test can be used, not both");
+  }
+
+  if (bench_runner) {
+    if (bench_isolation == "none") {
+      debug_options_.allow_attaching_debugger = true;
+    } else {
+      if (bench_isolation != "process") {
+        errors->push_back("invalid value for --bench-isolation");
+      }
+
+      debug_options_.allow_attaching_debugger = false;
+    }
+    if (has_bench_samples && bench_samples == 0) {
+      errors->push_back("--bench-samples must be greater than 0");
+    }
+    if (syntax_check_only) {
+      errors->push_back("either --bench or --check can be used, not both");
+    }
+    if (has_eval_string) {
+      errors->push_back("either --bench or --eval can be used, not both");
+    }
+    if (force_repl) {
+      errors->push_back(
+          "either --bench or --interactive can be used, not both");
+    }
+    if (watch_mode || !watch_mode_paths.empty()) {
+      errors->push_back("either --bench or --watch can be used, not both");
+    }
+  }
+
   if (test_runner) {
     if (test_isolation == "none") {
       debug_options_.allow_attaching_debugger = true;
@@ -945,6 +979,49 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "use the specified file for package map resolution",
             &EnvironmentOptions::experimental_package_map_path,
             kAllowedInEnvvar);
+  AddOption("--bench",
+            "launch benchmark runner on startup",
+            BOOL_FIELD(bench_runner),
+            kDisallowedInEnvvar,
+            false,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-isolation",
+            "configures the type of benchmark isolation used in the benchmark "
+            "runner",
+            &EnvironmentOptions::bench_isolation,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-name-pattern",
+            "run benchmarks whose name matches this regular expression",
+            &EnvironmentOptions::bench_name_pattern,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-reporter",
+            "report benchmark output using the given reporter",
+            &EnvironmentOptions::bench_reporter,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-reporter-destination",
+            "report the given benchmark reporter to the given destination",
+            &EnvironmentOptions::bench_reporter_destination,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("[has_bench_samples]", "", BOOL_FIELD(has_bench_samples));
+  AddOption("--bench-samples",
+            "specify the number of measured benchmark samples",
+            &EnvironmentOptions::bench_samples,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-samples", "[has_bench_samples]");
+  AddOption("[has_bench_warmup]", "", BOOL_FIELD(has_bench_warmup));
+  AddOption("--bench-warmup",
+            "specify the number of unreported benchmark warmup samples",
+            &EnvironmentOptions::bench_warmup,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-warmup", "[has_bench_warmup]");
   AddOption("--test",
             "launch test runner on startup",
             BOOL_FIELD(test_runner),
diff --git a/src/node_options.h b/src/node_options.h
index 322955cc38a9..7af20beaaa63 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -139,6 +139,8 @@ class EnvironmentOptions : public Options {
   std::string heap_snapshot_signal;
   std::string redirect_warnings;
   std::string diagnostic_dir;
+  std::string bench_isolation = "process";
+  std::string bench_name_pattern;
   std::string test_rerun_failures_path;
   std::string test_global_setup_path;
   std::string test_isolation = "process";
@@ -161,6 +163,8 @@ class EnvironmentOptions : public Options {
   std::vector<std::string> allow_fs_read;
   std::vector<std::string> allow_fs_write;
   std::vector<std::string> disable_warnings;
+  std::vector<std::string> bench_reporter;
+  std::vector<std::string> bench_reporter_destination;
   std::vector<std::string> env_file;
   std::vector<std::string> optional_env_file;
   std::vector<std::string> test_name_pattern;
@@ -179,6 +183,8 @@ class EnvironmentOptions : public Options {
   int64_t heap_snapshot_near_heap_limit = 0;
   uint64_t network_family_autoselection_attempt_timeout = 500;
   uint64_t max_http_header_size = 16 * 1024;
+  uint64_t bench_samples = 0;
+  uint64_t bench_warmup = 0;
   uint64_t test_runner_concurrency = 0;
   uint64_t test_runner_timeout = 0;
   uint64_t test_coverage_branches = 0;
@@ -243,6 +249,9 @@ class EnvironmentOptions : public Options {
   DEFINE_BOOL_FIELD(preserve_symlinks_main) = false;
   DEFINE_BOOL_FIELD(prof_process) = false;
   DEFINE_BOOL_FIELD(has_env_file_string) = false;
+  DEFINE_BOOL_FIELD(bench_runner) = false;
+  DEFINE_BOOL_FIELD(has_bench_samples) = false;
+  DEFINE_BOOL_FIELD(has_bench_warmup) = false;
   DEFINE_BOOL_FIELD(test_runner) = false;
   DEFINE_BOOL_FIELD(test_runner_coverage) = false;
   DEFINE_BOOL_FIELD(test_runner_force_exit) = false;
@@ -467,6 +476,7 @@ std::vector<std::string> MapAvailableNamespaces();
 // Define all namespace entries
 #define OPTION_NAMESPACE_LIST(V)                                               \
   V(kNoNamespace, "")                                                          \
+  V(kBenchRunnerNamespace, "bench")                                            \
   V(kTestRunnerNamespace, "test")                                              \
   V(kWatchNamespace, "watch")                                                  \
   V(kPermissionNamespace, "permission")
@@ -527,7 +537,8 @@ class OptionsParser {
       const char* help_text,
       uint64_t Options::*field,
       OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
-      OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
+      OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace,
+      bool strict = false);
   void AddOption(
       const char* name,
       const char* help_text,
@@ -693,6 +704,7 @@ class OptionsParser {
     std::string help_text;
     bool default_is_true = false;
     std::string namespace_id;
+    bool strict = false;
   };
 
   // An implied option is composed of the information on where to store a
diff --git a/test/fixtures/bench-runner/a.cjs b/test/fixtures/bench-runner/a.cjs
new file mode 100644
index 000000000000..54d6bb6c4a0d
--- /dev/null
+++ b/test/fixtures/bench-runner/a.cjs
@@ -0,0 +1,12 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('alpha', {
+  params: { file: 'a', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/b.mjs b/test/fixtures/bench-runner/b.mjs
new file mode 100644
index 000000000000..e82e3899f818
--- /dev/null
+++ b/test/fixtures/bench-runner/b.mjs
@@ -0,0 +1,10 @@
+import { bench } from 'node:bench';
+
+bench('beta', {
+  params: { file: 'b', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/error.cjs b/test/fixtures/bench-runner/error.cjs
new file mode 100644
index 000000000000..cf1db903e2b7
--- /dev/null
+++ b/test/fixtures/bench-runner/error.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('failure', {
+  params: { kind: 'structured-error' },
+  samples: 1,
+}, () => {
+  const error = new Error('benchmark fixture failed', {
+    cause: { value: 42n },
+  });
+  error.code = 'ERR_BENCHMARK_FIXTURE';
+  throw error;
+});
diff --git a/test/fixtures/bench-runner/exit-code.cjs b/test/fixtures/bench-runner/exit-code.cjs
new file mode 100644
index 000000000000..b687d1a46163
--- /dev/null
+++ b/test/fixtures/bench-runner/exit-code.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('sets exit code', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+  process.exitCode = 2;
+});
diff --git a/test/fixtures/bench-runner/failing-reporter.cjs b/test/fixtures/bench-runner/failing-reporter.cjs
new file mode 100644
index 000000000000..da1299fd17d5
--- /dev/null
+++ b/test/fixtures/bench-runner/failing-reporter.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { Transform } = require('stream');
+
+module.exports = new Transform({
+  writableObjectMode: true,
+  transform(_record, _encoding, callback) {
+    callback(new Error('benchmark reporter failed'));
+  },
+});
diff --git a/test/fixtures/bench-runner/import.mjs b/test/fixtures/bench-runner/import.mjs
new file mode 100644
index 000000000000..e027d905eec0
--- /dev/null
+++ b/test/fixtures/bench-runner/import.mjs
@@ -0,0 +1 @@
+globalThis.benchImport = 'loaded';
diff --git a/test/fixtures/bench-runner/imported.cjs b/test/fixtures/bench-runner/imported.cjs
new file mode 100644
index 000000000000..599be715c028
--- /dev/null
+++ b/test/fixtures/bench-runner/imported.cjs
@@ -0,0 +1,12 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('imported', {
+  samples: 1,
+  params: { imported: globalThis.benchImport },
+}, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/ipc.cjs b/test/fixtures/bench-runner/ipc.cjs
new file mode 100644
index 000000000000..e1fbca0beb98
--- /dev/null
+++ b/test/fixtures/bench-runner/ipc.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.send?.({ type: 'user-message' });
+
+bench('user IPC', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/node.config.json b/test/fixtures/bench-runner/node.config.json
new file mode 100644
index 000000000000..0344e2a4b7f4
--- /dev/null
+++ b/test/fixtures/bench-runner/node.config.json
@@ -0,0 +1,7 @@
+{
+  "bench": {
+    "bench-isolation": "none",
+    "bench-reporter": ["json"],
+    "bench-samples": 1
+  }
+}
diff --git a/test/fixtures/bench-runner/options.cjs b/test/fixtures/bench-runner/options.cjs
new file mode 100644
index 000000000000..17e5cc92943b
--- /dev/null
+++ b/test/fixtures/bench-runner/options.cjs
@@ -0,0 +1,19 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+let invocations = 0;
+bench('selected', {
+  params: { boolean: true, number: 42, string: 'value' },
+  samples: 8,
+  warmup: 8,
+}, (b) => {
+  invocations++;
+  b.start();
+  process.hrtime.bigint();
+  b.end(invocations);
+});
+
+bench('filtered out', { samples: 1 }, () => {
+  throw new Error('filtered benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/output.cjs b/test/fixtures/bench-runner/output.cjs
new file mode 100644
index 000000000000..3dd9f96e5493
--- /dev/null
+++ b/test/fixtures/bench-runner/output.cjs
@@ -0,0 +1,12 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.stdout.write('benchmark stdout\n');
+process.stderr.write('benchmark stderr\n');
+
+bench('output', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/preload.cjs b/test/fixtures/bench-runner/preload.cjs
new file mode 100644
index 000000000000..1b03dcbf65cf
--- /dev/null
+++ b/test/fixtures/bench-runner/preload.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+globalThis.benchRunnerPreloaded = true;
diff --git a/test/fixtures/bench-runner/preloaded.cjs b/test/fixtures/bench-runner/preloaded.cjs
new file mode 100644
index 000000000000..4e3b88c62009
--- /dev/null
+++ b/test/fixtures/bench-runner/preloaded.cjs
@@ -0,0 +1,16 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+if (globalThis.benchRunnerPreloaded !== true) {
+  throw new Error('benchmark preload did not run');
+}
+
+bench('preloaded', {
+  params: { preloaded: true },
+  samples: 1,
+}, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/run.cjs b/test/fixtures/bench-runner/run.cjs
new file mode 100644
index 000000000000..197ce8b55c36
--- /dev/null
+++ b/test/fixtures/bench-runner/run.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench, run } = require('node:bench');
+
+bench('declared before run', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
+
+run();
diff --git a/test/fixtures/bench-runner/serial-a.cjs b/test/fixtures/bench-runner/serial-a.cjs
new file mode 100644
index 000000000000..02ea8d8d972a
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-a.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial a');
diff --git a/test/fixtures/bench-runner/serial-b.cjs b/test/fixtures/bench-runner/serial-b.cjs
new file mode 100644
index 000000000000..58f87d933473
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-b.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial b');
diff --git a/test/fixtures/bench-runner/serial.js b/test/fixtures/bench-runner/serial.js
new file mode 100644
index 000000000000..4e6f44c3b679
--- /dev/null
+++ b/test/fixtures/bench-runner/serial.js
@@ -0,0 +1,17 @@
+'use strict';
+
+const fs = require('fs');
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+module.exports = function register(name) {
+  const lock = process.env.NODE_BENCH_LOCK;
+  fs.writeFileSync(lock, `${process.pid}`, { flag: 'wx' });
+  process.on('exit', () => fs.unlinkSync(lock));
+
+  bench(name, { samples: 1 }, async (b) => {
+    b.start();
+    await setTimeout(25);
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/utf8-output.cjs b/test/fixtures/bench-runner/utf8-output.cjs
new file mode 100644
index 000000000000..7dab41cd7c22
--- /dev/null
+++ b/test/fixtures/bench-runner/utf8-output.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+const output = Buffer.from('split:\u20ac\n');
+process.stdout.write(output.subarray(0, 7));
+
+bench('UTF-8 output', { samples: 1 }, async (b) => {
+  b.start();
+  await setTimeout(20);
+  process.stdout.write(output.subarray(7));
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/verifying-reporter.cjs b/test/fixtures/bench-runner/verifying-reporter.cjs
new file mode 100644
index 000000000000..2dd467e12597
--- /dev/null
+++ b/test/fixtures/bench-runner/verifying-reporter.cjs
@@ -0,0 +1,21 @@
+'use strict';
+
+const assert = require('assert');
+
+module.exports = async function* verify(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:sample') {
+      assert.strictEqual(typeof data.duration_ns, 'bigint');
+      assert.strictEqual(typeof data.rate, 'number');
+    }
+    if (type === 'bench:complete' && data.error !== undefined) {
+      assert(data.error instanceof Error);
+      assert.strictEqual(data.error.code, 'ERR_BENCHMARK_FIXTURE');
+      assert.deepStrictEqual(data.error.cause, { value: 42n });
+    }
+    if (type === 'bench:complete' && data.summary !== undefined) {
+      assert(Number.isFinite(data.summary.medianConfidenceInterval.lower));
+    }
+    if (type === 'bench:summary') yield 'verified\n';
+  }
+};
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
new file mode 100644
index 000000000000..5a170ab9c674
--- /dev/null
+++ b/test/parallel/test-bench-cli.js
@@ -0,0 +1,381 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const basicPattern = fixtures.path('bench-runner/[ab].*');
+
+tmpdir.refresh();
+
+function spawnBench(args, options = undefined) {
+  return spawnSync(process.execPath, [
+    '--no-warnings',
+    '--bench',
+    ...args,
+  ], { __proto__: null, encoding: 'utf8', ...options });
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /--bench requires at least one file or glob/);
+}
+
+{
+  const result = spawnBench(['does-not-exist-*.js']);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+{
+  const result = spawnBench(['--bench-reporter=json', basicPattern]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+
+  assert.deepStrictEqual(completions.map(({ data }) => data.name), [
+    'alpha',
+    'beta',
+  ]);
+  assert.notStrictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.deepStrictEqual(completions.map(({ data }) => data.params.file), [
+    'a',
+    'b',
+  ]);
+  assert.match(completions[0].data.samples[0].duration_ns, /^\d+$/);
+  assert(Number.isFinite(completions[0].data.summary.mean));
+
+  const summaries = records.filter(
+    ({ type }) => type === 'bench:summary');
+  assert.strictEqual(summaries.length, 1);
+  assert.strictEqual(summaries[0].data.file, null);
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    completed: 2,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-isolation=none',
+    basicPattern,
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.strictEqual(records.at(-1).data.file, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-name-pattern=selected',
+    '--bench-samples=2',
+    '--bench-warmup=3',
+    fixtures.path('bench-runner/options.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  assert.deepStrictEqual(samples.map(({ data }) => data.operations), [4, 5]);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const selected = completions.find(({ data }) => data.name === 'selected').data;
+  assert.deepStrictEqual(selected.params, {
+    boolean: true,
+    number: 42,
+    string: 'value',
+  });
+  assert.strictEqual(selected.samples.length, 2);
+  assert.strictEqual(
+    selected.summary.mean,
+    (selected.samples[0].rate + selected.samples[1].rate) / 2,
+  );
+  assert(Number.isFinite(selected.summary.medianConfidenceInterval.lower));
+
+  const filtered = completions.find(
+    ({ data }) => data.name === 'filtered out').data;
+  assert.strictEqual(filtered.skip, 'name pattern');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/error.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const failure = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(failure.params, { kind: 'structured-error' });
+  assert.strictEqual(failure.error.name, 'Error');
+  assert.strictEqual(failure.error.message, 'benchmark fixture failed');
+  assert.strictEqual(failure.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(failure.error.cause, { value: '42' });
+  assert.match(failure.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+for (const { file, status } of [
+  { file: 'a.cjs', status: 0 },
+  { file: 'error.cjs', status: 1 },
+]) {
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/verifying-reporter.cjs')}`,
+    fixtures.path(`bench-runner/${file}`),
+  ]);
+  assert.strictEqual(result.status, status);
+  assert.strictEqual(result.stderr, '');
+  assert.strictEqual(result.stdout, 'verified\n');
+}
+
+{
+  const result = spawnBench([
+    '--require',
+    fixtures.path('bench-runner/preload.cjs'),
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/preloaded.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { preloaded: true });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    '--import', fixtures.fileURL('bench-runner/import.mjs'),
+    fixtures.path('bench-runner/imported.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { imported: 'loaded' });
+}
+
+{
+  const lock = tmpdir.resolve('serial.lock');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/serial-[ab].cjs'),
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_LOCK: lock },
+  });
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.deepStrictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data.name), [
+    'serial a',
+    'serial b',
+  ]);
+  assert.strictEqual(fs.existsSync(lock), false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/ipc.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'user IPC');
+  assert.strictEqual(records.at(-1).data.file,
+                     fixtures.path('bench-runner/ipc.cjs'));
+}
+
+{
+  const result = spawnBench([
+    '--inspect=0',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic')
+    .map(({ data }) => data.message).join('');
+  assert.match(diagnostics, /Debugger listening on ws:\/\//);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stdout, '');
+  const records = parseOutput(result.stderr);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.deepStrictEqual(diagnostics.map(({ data }) => data.stream).sort(), [
+    'stderr',
+    'stdout',
+  ]);
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stdout\n'));
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stderr\n'));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/utf8-output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const output = records.filter(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.stream === 'stdout').map(({ data }) => data.message).join('');
+  assert.strictEqual(output, 'split:\u20ac\n');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/run.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.match(diagnostic.data.message,
+               /run\(\) cannot be called from a file run with --bench/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/failing-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter failed/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    `--experimental-config-file=${fixtures.path('bench-runner/node.config.json')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ], { __proto__: null, encoding: 'utf8' });
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.samples.length, 1);
+}
+
+{
+  const destination = tmpdir.resolve('bench.txt');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=spec',
+    `--bench-reporter-destination=${destination}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  parseRecords(result);
+  assert.match(fs.readFileSync(destination, 'utf8'),
+               /^benchmark \| samples \| mean rate/);
+}
+
+{
+  const result = spawnBench([fixtures.path('bench-runner/a.cjs')]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /^benchmark \| samples \| mean rate/);
+  assert.match(result.stdout, /1 completed, 0 failed, 0 skipped/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter=spec',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr,
+               /must match the number of specified '.*destination'/);
+}
+
+for (const { args, message } of [
+  {
+    args: ['--bench-isolation=invalid', 'unused.js'],
+    message: /invalid value for --bench-isolation/,
+  },
+  {
+    args: ['--bench-samples=0', 'unused.js'],
+    message: /--bench-samples must be greater than 0/,
+  },
+  {
+    args: ['--bench-warmup=4294967296', 'unused.js'],
+    message: /--bench-warmup.*out of range/,
+  },
+  {
+    args: ['--bench-samples=2x', 'unused.js'],
+    message: /invalid value for --bench-samples/,
+  },
+  {
+    args: ['--bench-warmup=abc', 'unused.js'],
+    message: /invalid value for --bench-warmup/,
+  },
+  {
+    args: ['--check', 'unused.js'],
+    message: /either --bench or --check can be used, not both/,
+  },
+  {
+    args: ['--test', 'unused.js'],
+    message: /either --bench or --test can be used, not both/,
+  },
+]) {
+  const result = spawnBench(args);
+  assert.notStrictEqual(result.status, 0);
+  assert.match(result.stderr, message);
+}
diff --git a/test/parallel/test-bench-run-options.js b/test/parallel/test-bench-run-options.js
new file mode 100644
index 000000000000..e9397908a42c
--- /dev/null
+++ b/test/parallel/test-bench-run-options.js
@@ -0,0 +1,22 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { bench, run } = require('node:bench');
+
+let invocations = 0;
+bench('overridden', { samples: 8, warmup: 8 }, (b) => {
+  invocations++;
+  b.start();
+  process.hrtime.bigint();
+  b.end(invocations);
+});
+
+const samples = [];
+const stream = run({ samples: 2, warmup: 3 });
+stream.on('bench:sample', ({ operations }) => samples.push(operations));
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(samples, [4, 5]);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
index 25a53c1b0186..d276c4cfa650 100644
--- a/test/parallel/test-bench-validation.js
+++ b/test/parallel/test-bench-validation.js
@@ -31,6 +31,10 @@ assert.throws(() => bench('name', { skip: 1 }, noop),
               { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => run({ namePattern: 1 }),
               { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ samples: 0 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ warmup: -1 }),
+              { code: 'ERR_OUT_OF_RANGE' });
 
 bench('valid', { samples: 1 }, (b) => {
   b.start();

From f850cea42977b79ad79790a8049bd83a95869511 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 01:09:39 +0000
Subject: [PATCH 042/202] benchmark: implement node:bench version of bench
 tools
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snel <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/README.md                           |  77 ++
 benchmark/_node-bench-analysis.js             | 736 ++++++++++++++++++
 benchmark/_node-bench.js                      | 159 ++++
 .../_buffer-compare-offset.node-bench.js      |  37 +
 benchmark/compare-node-bench.js               | 116 +++
 benchmark/crypto/_create-hash.node-bench.js   |  19 +
 benchmark/scatter-node-bench.js               | 131 ++++
 doc/api/bench.md                              |   2 +-
 .../writing-and-running-benchmarks.md         |  37 +
 .../fixtures/bench-runner/tools-collision.cjs |  14 +
 .../fixtures/bench-runner/tools-no-params.cjs |   9 +
 .../bench-runner/tools-reserved-param.cjs     |   9 +
 test/fixtures/bench-runner/tools.cjs          |  20 +
 .../test-benchmark-node-bench-tools.js        | 261 +++++++
 14 files changed, 1626 insertions(+), 1 deletion(-)
 create mode 100644 benchmark/_node-bench-analysis.js
 create mode 100644 benchmark/_node-bench.js
 create mode 100644 benchmark/buffers/_buffer-compare-offset.node-bench.js
 create mode 100644 benchmark/compare-node-bench.js
 create mode 100644 benchmark/crypto/_create-hash.node-bench.js
 create mode 100644 benchmark/scatter-node-bench.js
 create mode 100644 test/fixtures/bench-runner/tools-collision.cjs
 create mode 100644 test/fixtures/bench-runner/tools-no-params.cjs
 create mode 100644 test/fixtures/bench-runner/tools-reserved-param.cjs
 create mode 100644 test/fixtures/bench-runner/tools.cjs
 create mode 100644 test/parallel/test-benchmark-node-bench-tools.js

diff --git a/benchmark/README.md b/benchmark/README.md
index 8bccdb04d2a5..d2d1ac6a0f7c 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -10,6 +10,7 @@ directory, see [the guide on benchmarks](../doc/contributing/writing-and-running
 ## Table of Contents
 
 * [File tree structure](#file-tree-structure)
+* [`node:bench` evaluation tools](#nodebench-evaluation-tools)
 * [Common API](#common-api)
 
 ## File tree structure
@@ -44,6 +45,8 @@ directories.
 * `common.js`: see [Common API](#common-api).
 * `compare.js`: command line tool for comparing performance between different
   Node.js binaries.
+* `compare-node-bench.js`: parallel comparison tool for explicit `node:bench`
+  files. It does not change or invoke `compare.js`.
 * `compare.R`: R script for statistically analyzing the output of
   `compare.js`
 * `run.js`: command line tool for running individual benchmark suite(s).
@@ -51,9 +54,83 @@ directories.
   between different parameters in benchmark configurations,
   for example to analyze the time complexity. Pass `--analyze` to
   summarize the results without R.
+* `scatter-node-bench.js`: parallel scatter-data tool for an explicit
+  `node:bench` file. It does not change or invoke `scatter.js`.
 * `scatter.R`: R script for visualizing the output of `scatter.js` with
   scatter plots.
 
+## `node:bench` evaluation tools
+
+The `compare-node-bench.js` and `scatter-node-bench.js` tools run explicit
+`node:bench` files without changing the existing benchmark framework or its
+tools. Each repeated observation for a benchmark identity is collected by a
+separate process invocation with one measured sample. Benchmarks declared in
+the same file still execute serially in that process and can share JIT, garbage
+collector, heap, and cache state. This differs from legacy configuration-level
+process isolation and must be considered when comparing the frameworks.
+
+Compare two binaries and analyze the compatible CSV using `compare.R`:
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > compare-node-bench.csv
+Rscript benchmark/compare.R < compare-node-bench.csv
+```
+
+Pass `--analyze` to run the same Welch analysis inline. `--max-regression N`
+implies `--analyze` and makes the command fail only when the Holm-Bonferroni
+adjusted p-value is below 0.05 and the full 95% confidence interval is worse
+than `-N%`. Requiring both conditions prevents a noisy point estimate from
+failing a regression gate.
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 \
+  --max-regression 5 -- benchmark/crypto/_create-hash.node-bench.js
+```
+
+Collect parameter data for the parallel buffer benchmark and plot it using
+`scatter.R`:
+
+```console
+./node benchmark/scatter-node-bench.js --node ./node --runs 30 -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js \
+  > scatter-node-bench.csv
+Rscript benchmark/scatter.R --xaxis size --category method \
+  --plot scatter-node-bench.png < scatter-node-bench.csv
+```
+
+Pass `--analyze` with an x-axis parameter to summarize the samples without R.
+The output includes mean and median confidence intervals, skew warnings, an
+optional bar chart, and Mann-Whitney U and Cliff's delta comparisons between
+consecutive x-axis values. Use `--category` for a second grouping parameter and
+`--no-chart` to omit the chart.
+
+Because configurations in one file share a process, inline analysis averages
+aggregated configurations into one value per outer process. Consecutive
+x-axis comparisons use alternating, disjoint process sets so the unpaired
+Mann-Whitney test does not treat correlated values as independent samples.
+
+```console
+./node benchmark/scatter-node-bench.js --runs 30 --analyze \
+  --xaxis size --category method -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js
+```
+
+A file passed to `scatter-node-bench.js` must use one logical benchmark name.
+Parameter values distinguish its configurations. The tool rejects unstable
+identities and names or parameters that would merge unrelated CSV groups.
+
+The underscore-prefixed benchmark files are parallel ports used to compare the
+measurement frameworks. Legacy discovery ignores them, so the original files
+remain the source benchmarks for `run.js`, `compare.js`, and `scatter.js`. The
+ports use the platform-specific original relative filename as their benchmark
+name and preserve parameter column names to keep CSV grouping compatible. For
+a direct framework comparison, collect the same number of runs from an
+original benchmark with `scatter.js` and from its port with
+`scatter-node-bench.js`, then compare their rate distributions.
+
 ## Common API
 
 The common.js module is used by benchmarks for consistency across repeated
diff --git a/benchmark/_node-bench-analysis.js b/benchmark/_node-bench-analysis.js
new file mode 100644
index 000000000000..5fa3c34d3976
--- /dev/null
+++ b/benchmark/_node-bench-analysis.js
@@ -0,0 +1,736 @@
+'use strict';
+
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('node:util');
+
+function createRateHistogram(rates, scale, figures) {
+  const histogram = createHistogram({ figures });
+  for (const rate of rates) {
+    const value = Math.max(1, Math.round(rate * scale));
+    if (!Number.isSafeInteger(value)) {
+      throw new RangeError('Benchmark rate is too large for the histogram scale');
+    }
+    histogram.record(value);
+  }
+  return histogram;
+}
+
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, index) => ({ index, p }))
+    .sort((a, b) => a.p - b.p);
+  const adjusted = new Array(order.length);
+  let running = 0;
+  for (let index = 0; index < order.length; index++) {
+    running = Math.max(
+      running,
+      Math.min(1, (order.length - index) * order[index].p),
+    );
+    adjusted[order[index].index] = running;
+  }
+  return adjusted;
+}
+
+function isRegressionFailure(row, maxRegression) {
+  return row.pAdjusted < 0.05 &&
+         row.improvement + row.ci95 < -maxRegression;
+}
+
+function analyzeCompare(samples, scale, maxRegression) {
+  const groups = new Map();
+  for (const sample of samples) {
+    let group = groups.get(sample.identity);
+    if (group === undefined) {
+      const suffix = sample.configuration === '' ?
+        '' : ` ${sample.configuration}`;
+      group = {
+        name: `${sample.name}${suffix}`,
+        new: [],
+        old: [],
+      };
+      groups.set(sample.identity, group);
+    }
+    group[sample.binary].push(sample.rate);
+  }
+
+  const rows = [];
+  let skipped = 0;
+  for (const { name, old: oldRates, new: newRates } of groups.values()) {
+    if (oldRates.length < 2 || newRates.length < 2) {
+      skipped++;
+      continue;
+    }
+
+    const oldHistogram = createRateHistogram(oldRates, scale, 3);
+    const newHistogram = createRateHistogram(newRates, scale, 3);
+    const oldMean = oldRates.reduce((sum, rate) => sum + rate, 0) /
+      oldRates.length;
+    const newMean = newRates.reduce((sum, rate) => sum + rate, 0) /
+      newRates.length;
+    const improvement = ((newMean - oldMean) / oldMean) * 100;
+    const w95 = oldHistogram.welchTest(newHistogram, { confidence: 0.95 });
+    const w99 = oldHistogram.welchTest(newHistogram, { confidence: 0.99 });
+    const w999 = oldHistogram.welchTest(newHistogram, { confidence: 0.999 });
+    let stars = '';
+    if (w95.pValue < 0.001) stars = '***';
+    else if (w95.pValue < 0.01) stars = ' **';
+    else if (w95.pValue < 0.05) stars = '  *';
+    const ciPercent = (result) => {
+      const half = (result.confidenceInterval.upper -
+                    result.confidenceInterval.lower) / 2;
+      return (half / (oldMean * scale)) * 100;
+    };
+    rows.push({
+      ci95: ciPercent(w95),
+      ci99: ciPercent(w99),
+      ci999: ciPercent(w999),
+      improvement,
+      name,
+      pValue: Number.isNaN(w95.pValue) ? 1 : w95.pValue,
+      stars,
+    });
+  }
+
+  const adjusted = holmAdjust(rows.map(({ pValue }) => pValue));
+  let underpowered = 0;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    row.pAdjusted = adjusted[index];
+    row.inconclusive = maxRegression > 0 &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > maxRegression;
+    if (row.inconclusive) underpowered++;
+  }
+
+  const output = [];
+  const maxNameLength = rows.reduce(
+    (maximum, { name }) => Math.max(maximum, name.length), 0);
+  const pad = (value, length) =>
+    value + ' '.repeat(Math.max(0, length - value.length));
+  const padStart = (value, length) =>
+    ' '.repeat(Math.max(0, length - value.length)) + value;
+  output.push(`${pad('', maxNameLength)}  confidence` +
+              '   improvement   accuracy (*)    (**)   (***)');
+  for (const row of rows) {
+    const improvement =
+      `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)} %`;
+    output.push(
+      `${pad(row.name, maxNameLength)}  ${pad(row.stars, 10)}` +
+      `  ${padStart(improvement, 11)}` +
+      `   ±${row.ci95.toFixed(2)}%` +
+      `  ±${row.ci99.toFixed(2)}%` +
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}`,
+    );
+  }
+
+  if (skipped > 0) {
+    output.push('');
+    output.push(
+      `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
+      ' skipped because Welch\'s t-test requires at least 2 samples per' +
+      ' binary. Use --runs 2 or higher.',
+    );
+  }
+  printCompareChart(output, rows, maxNameLength);
+
+  output.push('');
+  output.push(
+    `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).`,
+    'Use --scale to adjust precision if needed.',
+    '',
+  );
+  const significant = rows.filter(({ pAdjusted }) => pAdjusted < 0.05).length;
+  output.push(
+    'The confidence markers above are per-benchmark and uncorrected. ' +
+    `After Holm-Bonferroni correction across ${rows.length} comparison` +
+    `${rows.length === 1 ? '' : 's'}, ${significant} remain` +
+    `${significant === 1 ? 's' : ''} significant at 5%.`,
+    '--max-regression uses the corrected values.',
+  );
+
+  if (maxRegression > 0 && underpowered > 0) {
+    output.push('');
+    output.push(
+      `Note: ${underpowered} of ${rows.length} comparison` +
+      `${rows.length === 1 ? '' : 's'} could not resolve an effect as small ` +
+      `as ${maxRegression}% and are marked (inconclusive). Raise --runs to ` +
+      'narrow their confidence intervals.',
+    );
+  }
+
+  const failures = maxRegression > 0 ?
+    rows.filter((row) => isRegressionFailure(row, maxRegression)) : [];
+  if (failures.length > 0) {
+    output.push('');
+    output.push(
+      `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
+      ` regressed by more than ${maxRegression}% (the 95% interval excludes ` +
+      `the threshold and significance is family-wise corrected across ` +
+      `${rows.length} comparisons):`,
+    );
+    for (const failure of failures) {
+      output.push(
+        `  ${failure.name}  ${failure.improvement.toFixed(2)}% ` +
+        `(95% CI up to ${(failure.improvement + failure.ci95).toFixed(2)}%, ` +
+        `adjusted p=${failure.pAdjusted.toExponential(2)})`,
+      );
+    }
+  }
+
+  return {
+    failed: failures.length > 0,
+    output: `${output.join('\n')}\n`,
+    rows,
+  };
+}
+
+function printCompareChart(output, rows, maxNameLength) {
+  if (rows.length === 0) return;
+  const width = 40;
+  const halfWidth = width / 2;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(maximum, Math.abs(row.improvement) + row.ci95);
+  }
+  if (maximum === 0) maximum = 1;
+  const left = `-${maximum.toFixed(1)}%`;
+  const right = `+${maximum.toFixed(1)}%`;
+  const centerLabel = '0%';
+  const labelPadding = maxNameLength + 5;
+  output.push('');
+  output.push(
+    ' '.repeat(labelPadding) + left +
+    ' '.repeat(Math.max(
+      0, halfWidth - left.length - Math.floor(centerLabel.length / 2))) +
+    centerLabel +
+    ' '.repeat(Math.max(
+      0, halfWidth - Math.ceil(centerLabel.length / 2) - right.length)) +
+    right,
+  );
+  for (const row of rows) {
+    const center = halfWidth;
+    const result = center + (row.improvement / maximum) * halfWidth;
+    const lower = center +
+      ((row.improvement - row.ci95) / maximum) * halfWidth;
+    const upper = center +
+      ((row.improvement + row.ci95) / maximum) * halfWidth;
+    let bar = '';
+    for (let index = 0; index < width; index++) {
+      const position = index + 0.5;
+      if (index === Math.floor(center)) {
+        bar += '|';
+      } else if ((row.improvement >= 0 &&
+                  position > center && position <= result) ||
+                 (row.improvement < 0 &&
+                  position < center && position >= result)) {
+        bar += row.stars === '' ? '▓' : '█';
+      } else if (position >= lower && position <= upper) {
+        bar += '░';
+      } else {
+        bar += ' ';
+      }
+    }
+    const label = `${row.improvement >= 0 ? '+' : ''}` +
+      `${row.improvement.toFixed(2)}%`;
+    output.push(
+      `${row.name.padEnd(maxNameLength)}  ${bar}  ${label} ${row.stars.trim()}`,
+    );
+  }
+}
+
+function histogramScale(rates) {
+  let minimum = Infinity;
+  let maximum = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < minimum) minimum = rate;
+    if (rate > maximum) maximum = rate;
+  }
+  if (!Number.isFinite(minimum) || maximum === 0) return 1;
+  let scale = 1;
+  while (minimum * scale < 1e6 && maximum * scale < 1e15) scale *= 10;
+  return scale;
+}
+
+function validateScatterParameters(samples, xAxis, category) {
+  if (category !== undefined && category === xAxis) {
+    throw new Error('--xaxis and --category must name different parameters');
+  }
+  for (const key of [xAxis, category]) {
+    if (key === undefined) continue;
+    if (samples.some(({ params }) =>
+      !Object.hasOwn(params, key))) {
+      const available = [...new Set(samples.flatMap(
+        ({ params }) => Object.keys(params)))].sort();
+      throw new Error(
+        `The variable '${key}' is not present in every configuration. ` +
+        `Available variables: ${available.join(', ')}`,
+      );
+    }
+  }
+}
+
+function analyzeScatter(samples, xAxis, category, showChart) {
+  validateScatterParameters(samples, xAxis, category);
+
+  const parameterNames = [...new Set(samples.flatMap(
+    ({ params }) => Object.keys(params)))];
+  const aggregated = parameterNames.filter((name) => {
+    if (name === xAxis || name === category) return false;
+    const first = samples[0].params[name];
+    return samples.some(({ params }) => params[name] !== first);
+  });
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.params[xAxis];
+    const categoryValue = category === undefined ?
+      undefined : sample.params[category];
+    const key = valueKey([xValue, categoryValue]);
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = {
+        categoryValue,
+        members: [],
+        observations: new Map(),
+        xValue,
+      };
+      groups.set(key, group);
+    }
+    group.members.push(sample);
+    let rates = group.observations.get(sample.observation);
+    if (rates === undefined) {
+      rates = [];
+      group.observations.set(sample.observation, rates);
+    }
+    rates.push(sample.rate);
+  }
+  for (const group of groups.values()) {
+    group.processRates = [...group.observations].map(([observation, rates]) => ({
+      observation,
+      rate: rates.reduce((sum, rate) => sum + rate, 0) / rates.length,
+    }));
+    group.rates = group.processRates.map(({ rate }) => rate);
+  }
+
+  const scale = histogramScale(samples.map(({ rate }) => rate));
+  const compareValues = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+  const rows = [...groups.values()]
+    .sort((a, b) => compareValues(a.xValue, b.xValue) ||
+                    compareValues(a.categoryValue, b.categoryValue))
+    .map((group) => {
+      const histogram = createRateHistogram(group.rates, scale, 5);
+      const count = group.rates.length;
+      const mean = group.rates.reduce((sum, rate) => sum + rate, 0) / count;
+      const meanInterval = histogram.meanCI();
+      const confidenceInterval = count > 1 ?
+        (meanInterval.upper - meanInterval.lower) / (2 * scale) : NaN;
+      const medianInterval = histogram.percentileCI(50);
+      const median = rawMedian(group.rates);
+      const skewed = count > 1 &&
+        (Math.abs(histogram.skewness) > 1 ||
+         Math.abs(median - mean) > confidenceInterval);
+      return {
+        ...group,
+        confidenceInterval,
+        count,
+        histogram,
+        mean,
+        median,
+        medianLower: medianInterval.lower / scale,
+        medianUpper: medianInterval.upper / scale,
+        skewed,
+      };
+    });
+
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'categoryValue', 'categoryLabel'));
+  }
+  const output = [];
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    const share = varianceShare([...groups.values()], variable);
+    contamination.set(variable, share);
+    const percent = share === 1 ?
+      '100' : (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' : ` (explains ${percent}% of within-group variance)`;
+    output.push(`aggregating variable: ${variable}${suffix}`);
+  }
+  const dominant = aggregated.filter(
+    (variable) => contamination.get(variable) > 0.5);
+  if (dominant.length > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `${dominant.join(', ')} ${dominant.length === 1 ? 'explains' : 'explain'} ` +
+      'most of the spread within each group. Pin the parameter or use it as ' +
+      '--category; increasing --runs will not remove this source of variance.',
+    );
+  }
+  if (aggregated.length > 0) output.push('');
+  printScatterTable(output, rows, xAxis, category);
+  if (showChart) printScatterChart(output, rows, xAxis, category);
+  printScatterComparisons(output, rows, xAxis, category);
+  if (legend.length > 0) {
+    output.push('', 'Abbreviated values:');
+    for (const { full, label } of legend) {
+      output.push(`  ${label}`, `    = ${full}`);
+    }
+  }
+  const singleSample = rows.filter(({ count }) => count < 2).length;
+  if (singleSample > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      'only one sample, so no confidence interval could be estimated. Use ' +
+      '--runs 2 or higher.',
+    );
+  }
+  if (rows.some(({ skewed }) => skewed)) {
+    output.push('');
+    wrapOutput(
+      output,
+      '(!) marks groups where the median falls outside the mean confidence ' +
+      'interval or the sample is strongly skewed. The median and its interval ' +
+      'describe the typical run better for those groups.',
+    );
+  }
+  return `${output.join('\n')}\n`;
+}
+
+function rawMedian(rates) {
+  const sorted = [...rates].sort((a, b) => a - b);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+}
+
+function valueKey(value) {
+  return JSON.stringify(value, (_, item) => {
+    if (typeof item === 'bigint') return { bigint: String(item) };
+    return item;
+  });
+}
+
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+  for (const group of groups) {
+    if (group.members.length < 2) continue;
+    const mean = group.members.reduce(
+      (sum, sample) => sum + sample.rate, 0) / group.members.length;
+    const levels = new Map();
+    for (const sample of group.members) {
+      const key = valueKey(sample.params[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { count: 0, sum: 0 };
+        levels.set(key, level);
+      }
+      level.count++;
+      level.sum += sample.rate;
+    }
+    for (const level of levels.values()) {
+      between += level.count * ((level.sum / level.count) - mean) ** 2;
+    }
+    for (const sample of group.members) total += (sample.rate - mean) ** 2;
+  }
+  return total === 0 ? NaN : Math.min(1, between / total);
+}
+
+function effectSizeLabel(delta) {
+  const absolute = Math.abs(delta);
+  if (absolute < 0.147) return 'negligible';
+  if (absolute < 0.33) return 'small';
+  if (absolute < 0.474) return 'medium';
+  return 'large';
+}
+
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(firstCount, secondCount) {
+  const key = `${firstCount},${secondCount}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor !== undefined) return floor;
+  const low = createHistogram({ figures: 5 });
+  const high = createHistogram({ figures: 5 });
+  for (let index = 0; index < firstCount; index++) low.record(10000 + index);
+  for (let index = 0; index < secondCount; index++) {
+    high.record(10000 + firstCount + index);
+  }
+  floor = high.mannWhitneyTest(low).pValue;
+  mannWhitneyFloors.set(key, floor);
+  return floor;
+}
+
+function printScatterComparisons(output, rows, xAxis, category) {
+  const usable = rows.filter(({ count }) => count > 1);
+  if (usable.length < 2) return;
+  const series = new Map();
+  for (const row of usable) {
+    const key = valueKey(row.categoryValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+  const sections = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+    const entries = [];
+    for (let index = 1; index < group.length; index++) {
+      const previous = group[index - 1];
+      const current = group[index];
+      // Configurations in one file share a process. Split consecutive groups
+      // across disjoint outer-process sets so the unpaired test does not treat
+      // correlated observations as independent.
+      const parity = index % 2;
+      const previousRates = previous.processRates
+        .filter(({ observation }) => observation % 2 === parity)
+        .map(({ rate }) => rate);
+      const currentRates = current.processRates
+        .filter(({ observation }) => observation % 2 !== parity)
+        .map(({ rate }) => rate);
+      if (previousRates.length === 0 || currentRates.length === 0) continue;
+      const comparisonScale = histogramScale([
+        ...previousRates,
+        ...currentRates,
+      ]);
+      const previousHistogram =
+        createRateHistogram(previousRates, comparisonScale, 5);
+      const currentHistogram =
+        createRateHistogram(currentRates, comparisonScale, 5);
+      const { pValue } = currentHistogram.mannWhitneyTest(previousHistogram);
+      const delta = currentHistogram.cliffsD(previousHistogram);
+      const previousMean = previousRates.reduce(
+        (sum, rate) => sum + rate, 0) / previousRates.length;
+      const currentMean = currentRates.reduce(
+        (sum, rate) => sum + rate, 0) / currentRates.length;
+      const change = ((currentMean - previousMean) / previousMean) * 100;
+      floor = Math.max(
+        floor, mannWhitneyFloor(previousRates.length, currentRates.length));
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previousMean > 0 && currentMean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(currentMean / previousMean) / Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+      entries.push(
+        `    ${previous.xLabel} -> ${current.xLabel}` +
+        `  ${change >= 0 ? '+' : ''}${change.toFixed(2)}%` +
+        (exponent === '' ? '' : `  ${ratio}  exponent=${exponent}`) +
+        `  p=${pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4)}` +
+        `  delta=${delta >= 0 ? '+' : ''}${delta.toFixed(3)}` +
+        ` (${effectSizeLabel(delta)})`,
+      );
+    }
+    if (entries.length > 0) {
+      sections.push({
+        entries,
+        heading: category === undefined ?
+          undefined : `${category}=${group[0].categoryLabel}`,
+      });
+    }
+  }
+  if (sections.length === 0) return;
+  output.push('', `Change between consecutive ${xAxis} values ` +
+                  `(Mann-Whitney U on disjoint process sets, Cliff's delta):`);
+  for (const section of sections) {
+    output.push('');
+    if (section.heading !== undefined) output.push(`  ${section.heading}`);
+    output.push(...section.entries);
+  }
+  if (floor >= 0.05) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      'significance. Raise --runs.',
+    );
+  } else if (floor >= 0.005) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. Raise --runs to strengthen non-significant ` +
+      'results.',
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    maximumFractionDigits: 1,
+    minimumFractionDigits: 1,
+  });
+}
+
+function displayWidth(value) {
+  return [...value].length;
+}
+
+function pad(value, width, right) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(value)));
+  return right ? padding + value : value + padding;
+}
+
+function truncateMiddle(value, maximum = 24) {
+  const characters = [...value];
+  if (characters.length <= maximum) return value;
+  const retained = maximum - 3;
+  const head = Math.ceil(retained / 2);
+  const tail = Math.floor(retained / 2);
+  return `${characters.slice(0, head).join('')}...` +
+         characters.slice(-tail).join('');
+}
+
+function assignLabels(rows, valueName, labelName) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+  for (const row of rows) {
+    const key = valueKey(row[valueName]);
+    let label = assigned.get(key);
+    if (label === undefined) {
+      const full = typeof row[valueName] === 'string' ?
+        inspect(row[valueName]) : String(row[valueName]);
+      const abbreviated = truncateMiddle(full);
+      const collisions = used.get(abbreviated) ?? 0;
+      used.set(abbreviated, collisions + 1);
+      label = collisions === 0 ?
+        abbreviated : `${abbreviated}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (label !== full) legend.push({ full, label });
+    }
+    row[labelName] = label;
+  }
+  return legend;
+}
+
+function printScatterTable(output, rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push(
+    'samples', 'rate', 'confidence.interval', 'median', 'median.interval', '');
+  const body = rows.map((row) => {
+    const values = [row.xLabel];
+    if (category !== undefined) values.push(row.categoryLabel);
+    const medianInterval = row.count > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+    values.push(
+      String(row.count),
+      formatRate(row.mean),
+      Number.isNaN(row.confidenceInterval) ?
+        'NA' :
+        `${formatRate(row.confidenceInterval)} ` +
+        `(±${((row.confidenceInterval / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return values;
+  });
+  const widths = header.map((value, index) => Math.max(
+    displayWidth(value),
+    ...body.map((values) => displayWidth(values[index])),
+  ));
+  const right = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    right.push(typeof rows[0].categoryValue === 'number');
+  }
+  right.push(true, true, true, true, true, false);
+  const format = (values) => values.map(
+    (value, index) => pad(value, widths[index], right[index])).join('  ').trimEnd();
+  output.push(format(header));
+  for (const values of body) output.push(format(values));
+}
+
+function printScatterChart(output, rows, xAxis, category) {
+  if (rows.length === 0) return;
+  const width = 40;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(
+      maximum,
+      row.mean + (Number.isNaN(row.confidenceInterval) ?
+        0 : row.confidenceInterval),
+    );
+  }
+  if (maximum === 0) return;
+  const labels = rows.map((row) => {
+    let label = `${xAxis}=${row.xLabel}`;
+    if (category !== undefined) label += ` ${category}=${row.categoryLabel}`;
+    return truncateMiddle(label, 44);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(...rows.map(({ mean }) =>
+    displayWidth(formatRate(mean))));
+  const axis = formatRate(maximum);
+  const indent = ' '.repeat(labelWidth + 2);
+  output.push(
+    '',
+    'Rate in operations/second; longer is faster. │ marks the mean and the',
+    'shaded band (░) is its 95% confidence interval.',
+    '',
+    `${indent}0${' '.repeat(Math.max(1, width - 1 - displayWidth(axis)))}${axis}`,
+    `${indent}+${'-'.repeat(width - 2)}+`,
+  );
+  let previous;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    if (previous !== undefined && previous !== row.xValue) output.push('');
+    previous = row.xValue;
+    const interval = Number.isNaN(row.confidenceInterval) ?
+      0 : row.confidenceInterval;
+    const end = (row.mean / maximum) * width;
+    const lower = ((row.mean - interval) / maximum) * width;
+    const upper = ((row.mean + interval) / maximum) * width;
+    const meanCell = Math.min(width - 1, Math.floor(end));
+    let bar = '';
+    for (let cell = 0; cell < width; cell++) {
+      const position = cell + 0.5;
+      if (cell === meanCell) bar += '│';
+      else if (position >= lower && position <= upper) bar += '░';
+      else if (position <= end) bar += '█';
+      else bar += ' ';
+    }
+    output.push(
+      `${pad(labels[index], labelWidth, false)}  ${bar}  ` +
+      pad(formatRate(row.mean), rateWidth, true),
+    );
+  }
+}
+
+function wrapOutput(output, text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') line = word;
+    else if (displayWidth(line) + displayWidth(word) + 1 <= width) {
+      line += ` ${word}`;
+    } else {
+      output.push(line);
+      line = word;
+    }
+  }
+  if (line !== '') output.push(line);
+}
+
+module.exports = {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+  validateScatterParameters,
+};
diff --git a/benchmark/_node-bench.js b/benchmark/_node-bench.js
new file mode 100644
index 000000000000..6c8d1acffdfa
--- /dev/null
+++ b/benchmark/_node-bench.js
@@ -0,0 +1,159 @@
+'use strict';
+
+const { spawn } = require('node:child_process');
+const path = require('node:path');
+const { inspect } = require('node:util');
+
+function parseInteger(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (!/^(?:0|[1-9]\d*)$/.test(value)) {
+    throw new TypeError(`${name} must be an integer`);
+  }
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function parseNumber(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (value.trim() === '') throw new TypeError(`${name} must be a number`);
+  const number = Number(value);
+  if (!Number.isFinite(number)) throw new TypeError(`${name} must be a number`);
+  if (number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function csvEncode(value) {
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  const string = String(value);
+  return `"${string.replace(/"/g, '""')}"`;
+}
+
+function formatConfiguration(params) {
+  return Object.keys(params)
+    .map((key) => `${key}=${inspect(params[key])}`)
+    .join(' ');
+}
+
+function durationToSeconds(duration) {
+  if (!/^\d+$/.test(duration)) {
+    throw new TypeError(`Invalid benchmark duration '${duration}'`);
+  }
+  const padded = duration.padStart(10, '0');
+  return `${padded.slice(0, -9)}.${padded.slice(-9)}`;
+}
+
+function runBenchmark(binary, file, options) {
+  const args = [
+    ...options.nodeArgs,
+    '--no-warnings',
+    '--bench',
+    '--bench-reporter=json',
+    '--bench-samples=1',
+    `--bench-warmup=${options.warmup}`,
+  ];
+  if (options.namePattern !== undefined) {
+    args.push(`--bench-name-pattern=${options.namePattern}`);
+  }
+  args.push('--', path.resolve(file));
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      env: process.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (data) => { stdout += data; });
+    child.stderr.on('data', (data) => { stderr += data; });
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      let records;
+      try {
+        records = stdout.trim().split('\n')
+          .filter((line) => line.length > 0)
+          .map((line) => JSON.parse(line));
+      } catch (error) {
+        reject(new Error(
+          `Could not parse benchmark output from '${binary}': ${error.message}`,
+          { cause: error },
+        ));
+        return;
+      }
+
+      const summary = records.findLast(
+        ({ type }) => type === 'bench:summary')?.data;
+      if (code !== 0 || signal !== null || summary?.success !== true) {
+        const diagnostics = records
+          .filter(({ type }) => type === 'bench:diagnostic')
+          .map(({ data }) => data.message)
+          .join('\n');
+        const status = signal === null ? `exit code ${code}` : `signal ${signal}`;
+        const details = stderr || diagnostics;
+        reject(new Error(
+          `Benchmark '${file}' failed with ${status}` +
+          (details ? `:\n${details}` : ''),
+        ));
+        return;
+      }
+
+      const samples = [];
+      for (const record of records) {
+        if (record.type !== 'bench:complete' ||
+            record.data.skip !== undefined) {
+          continue;
+        }
+        if (record.data.error !== undefined) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' failed: ` +
+            record.data.error.message,
+          ));
+          return;
+        }
+        if (record.data.samples.length !== 1) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' did not produce exactly one sample`,
+          ));
+          return;
+        }
+        const sample = record.data.samples[0];
+        if (!Number.isFinite(sample.rate)) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' produced a non-finite rate`,
+          ));
+          return;
+        }
+        samples.push({
+          configuration: formatConfiguration(record.data.params),
+          duration: durationToSeconds(sample.duration_ns),
+          identity: record.data.benchId,
+          logicalIdentity: JSON.stringify([
+            record.data.file,
+            record.data.parentId,
+            record.data.name,
+          ]),
+          name: record.data.name,
+          params: record.data.params,
+          rate: sample.rate,
+        });
+      }
+      resolve(samples);
+    });
+  });
+}
+
+module.exports = {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+};
diff --git a/benchmark/buffers/_buffer-compare-offset.node-bench.js b/benchmark/buffers/_buffer-compare-offset.node-bench.js
new file mode 100644
index 000000000000..b16c3a3da7db
--- /dev/null
+++ b/benchmark/buffers/_buffer-compare-offset.node-bench.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const path = require('node:path');
+
+const methods = ['offset', 'slice'];
+const sizes = [16, 512, 4096, 16386];
+const n = 1e6;
+const name = path.join('buffers', 'buffer-compare-offset.js');
+
+function compareUsingSlice(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    Buffer.compare(b0.slice(1, len), b1.slice(1, len));
+}
+
+function compareUsingOffset(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    b0.compare(b1, 1, len, 1, len);
+}
+
+for (const method of methods) {
+  for (const size of sizes) {
+    const compare = method === 'slice' ?
+      compareUsingSlice : compareUsingOffset;
+
+    bench(name, {
+      params: { method, n, size },
+    }, (b) => {
+      b.start();
+      compare(Buffer.alloc(size, 'a'),
+              Buffer.alloc(size, 'b'),
+              size >> 1,
+              n);
+      b.end(n);
+    });
+  }
+}
diff --git a/benchmark/compare-node-bench.js b/benchmark/compare-node-bench.js
new file mode 100644
index 000000000000..d2bc6071bed7
--- /dev/null
+++ b/benchmark/compare-node-bench.js
@@ -0,0 +1,116 @@
+'use strict';
+
+const path = require('node:path');
+const CLI = require('./_cli.js');
+const { analyzeCompare } = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node compare-node-bench.js [options] [--] <file> ...
+  Run explicit node:bench files repeatedly with two Node.js binaries. Each
+  observation runs in a fresh process. Output is compatible with compare.R,
+  or --analyze can summarize it directly.
+
+  --new          binary     new Node.js binary (required)
+  --old          binary     old Node.js binary (required)
+  --runs         30         observations per binary
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to both binaries (repeatable)
+  --analyze                 analyze with Welch's t-test instead of writing CSV
+  --scale        1000       rate multiplier used for histogram precision
+  --max-regression N        fail if a family-wise significant regression's
+                            95% confidence interval is entirely beyond N%
+                            (implies --analyze)
+`, { arrayArgs: ['node-arg'], boolArgs: ['analyze'] });
+
+if (!cli.optional.new || !cli.optional.old || cli.items.length === 0) {
+  cli.abort(cli.usage);
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const scale = parseInteger(cli.optional.scale, 1000, '--scale', 1);
+  const maxRegression = parseNumber(
+    cli.optional['max-regression'], 0, '--max-regression', 0);
+  const analyze = !!cli.optional.analyze || maxRegression > 0;
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binaries = [
+    { label: 'old', path: cli.optional.old },
+    { label: 'new', path: cli.optional.new },
+  ];
+  const rows = [];
+  const counts = new Map();
+  const csvGroups = new Map();
+
+  for (const file of cli.items) {
+    const resolved = path.resolve(file);
+    for (let run = 0; run < runs; run++) {
+      const order = run % 2 === 0 ? binaries : [binaries[1], binaries[0]];
+      for (const binary of order) {
+        const samples = await runBenchmark(binary.path, resolved, options);
+        for (const sample of samples) {
+          const identity = JSON.stringify([resolved, sample.identity]);
+          const csvGroup = JSON.stringify([
+            sample.name,
+            sample.configuration,
+          ]);
+          const groupedIdentity = csvGroups.get(csvGroup);
+          if (groupedIdentity !== undefined && groupedIdentity !== identity) {
+            throw new Error(
+              `Distinct benchmarks would share the CSV group '${sample.name} ` +
+              `${sample.configuration}'`,
+            );
+          }
+          csvGroups.set(csvGroup, identity);
+          let count = counts.get(identity);
+          if (count === undefined) {
+            count = { name: sample.name, new: 0, old: 0 };
+            counts.set(identity, count);
+          }
+          count[binary.label]++;
+          rows.push({ binary: binary.label, ...sample });
+        }
+      }
+    }
+  }
+
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+  for (const count of counts.values()) {
+    if (count.old !== runs || count.new !== runs) {
+      throw new Error(
+        `Benchmark '${count.name}' was not reported by both binaries in every run`,
+      );
+    }
+  }
+
+  if (analyze) {
+    const result = analyzeCompare(rows, scale, maxRegression);
+    process.stdout.write(result.output);
+    if (result.failed) process.exitCode = 1;
+    return;
+  }
+
+  const output = ['"binary","filename","configuration","rate","time"'];
+  for (const row of rows) {
+    output.push(`${csvEncode(row.binary)},${csvEncode(row.name)},` +
+                `${csvEncode(row.configuration)},${row.rate},${row.duration}`);
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/crypto/_create-hash.node-bench.js b/benchmark/crypto/_create-hash.node-bench.js
new file mode 100644
index 000000000000..4481bc6c6527
--- /dev/null
+++ b/benchmark/crypto/_create-hash.node-bench.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const assert = require('node:assert');
+const { bench } = require('node:bench');
+const { createHash } = require('node:crypto');
+const path = require('node:path');
+
+const n = 1e5;
+const name = path.join('crypto', 'create-hash.js');
+
+bench(name, { params: { n } }, (b) => {
+  const array = [];
+  for (let i = 0; i < n; ++i) array.push(null);
+  b.start();
+  for (let i = 0; i < n; ++i)
+    array[i] = createHash('sha1');
+  b.end(n);
+  assert.strictEqual(typeof array[n - 1], 'object');
+});
diff --git a/benchmark/scatter-node-bench.js b/benchmark/scatter-node-bench.js
new file mode 100644
index 000000000000..4527ecc6b8b4
--- /dev/null
+++ b/benchmark/scatter-node-bench.js
@@ -0,0 +1,131 @@
+'use strict';
+
+const CLI = require('./_cli.js');
+const {
+  analyzeScatter,
+  validateScatterParameters,
+} = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node scatter-node-bench.js [options] [--] <file>
+  Run an explicit node:bench file repeatedly and output each independent
+  observation with its benchmark parameters as CSV, or summarize the results
+  directly with --analyze.
+
+  --node         ./node     Node.js binary
+  --runs         30         number of observations
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to the binary (repeatable)
+  --analyze                 print a statistical summary instead of CSV
+  --xaxis        parameter  parameter to group by with --analyze (required)
+  --category     parameter  optional second grouping parameter
+  --no-chart                omit the analysis bar chart
+`, {
+  arrayArgs: ['node-arg'],
+  boolArgs: ['analyze', 'no-chart'],
+});
+
+if (cli.items.length !== 1) cli.abort(cli.usage);
+if (cli.optional.analyze && cli.optional.xaxis === undefined) {
+  cli.abort('--analyze requires --xaxis <parameter>');
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binary = cli.optional.node || process.execPath;
+  const rows = [];
+  const paramNames = new Set();
+  const csvGroups = new Map();
+  let expectedIdentities;
+  let logicalIdentity;
+
+  for (let run = 0; run < runs; run++) {
+    const samples = await runBenchmark(binary, cli.items[0], options);
+    if (run === 0 && cli.optional.analyze) {
+      validateScatterParameters(
+        samples, cli.optional.xaxis, cli.optional.category);
+    }
+    const identities = new Set();
+    for (const sample of samples) {
+      if (logicalIdentity !== undefined &&
+          logicalIdentity !== sample.logicalIdentity) {
+        throw new Error(
+          'scatter-node-bench.js requires one logical benchmark name per file',
+        );
+      }
+      logicalIdentity = sample.logicalIdentity;
+      if (identities.has(sample.identity)) {
+        throw new Error(`Benchmark '${sample.name}' was reported more than once`);
+      }
+      identities.add(sample.identity);
+      const csvGroup = JSON.stringify([sample.name, sample.params]);
+      const groupedIdentity = csvGroups.get(csvGroup);
+      if (groupedIdentity !== undefined &&
+          groupedIdentity !== sample.identity) {
+        throw new Error(
+          `Distinct benchmarks would share the CSV group '${sample.name}'`,
+        );
+      }
+      csvGroups.set(csvGroup, sample.identity);
+      rows.push({ ...sample, observation: run });
+      for (const name of Object.keys(sample.params)) paramNames.add(name);
+    }
+    if (expectedIdentities === undefined) {
+      expectedIdentities = identities;
+    } else if (identities.size !== expectedIdentities.size ||
+               ![...identities].every((id) => expectedIdentities.has(id))) {
+      throw new Error('The set of reported benchmarks changed between runs');
+    }
+  }
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+
+  const params = [...paramNames].sort();
+  if (cli.optional.analyze) {
+    const output = analyzeScatter(
+      rows,
+      cli.optional.xaxis,
+      cli.optional.category,
+      !cli.optional['no-chart'],
+    );
+    process.stdout.write(output);
+    return;
+  }
+
+  for (const name of params) {
+    if (name === 'filename' || name === 'rate' || name === 'time') {
+      throw new Error(`Benchmark parameter '${name}' is reserved in scatter CSV`);
+    }
+  }
+  const header = ['filename', ...params, 'rate', 'time']
+    .map(csvEncode)
+    .join(',');
+  const output = [header];
+  for (const row of rows) {
+    const values = [
+      csvEncode(row.name),
+      ...params.map((name) => csvEncode(row.params[name] ?? '')),
+      row.rate,
+      row.duration,
+    ];
+    output.push(values.join(','));
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/doc/api/bench.md b/doc/api/bench.md
index dcdd5714fccc..4acea0f98c9d 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -6,7 +6,7 @@
 added: REPLACEME
 -->
 
-> Stability: 1 - Experimental
+> Stability: 1.0 - Early Development
 
 <!-- source_link=lib/bench.js -->
 
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index aa28cf8e6d92..26d42dc17594 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -17,6 +17,7 @@
     * [Using `--analyze` (no external tools needed)](#using---analyze-no-external-tools-needed)
     * [Using R scripts or node-benchmark-compare](#using-r-scripts-or-node-benchmark-compare)
   * [Comparing parameters](#comparing-parameters)
+  * [Evaluating `node:bench` ports](#evaluating-nodebench-ports)
   * [Running benchmarks on the CI](#running-benchmarks-on-the-ci)
 * [Creating a benchmark](#creating-a-benchmark)
   * [Basics of a benchmark](#basics-of-a-benchmark)
@@ -706,6 +707,41 @@ chunkLen     encoding      rate confidence.interval
 
 ![compare tool boxplot](doc_img/scatter-plot.png)
 
+### Evaluating `node:bench` ports
+
+The experimental `compare-node-bench.js` and `scatter-node-bench.js` tools are
+parallel versions of the existing tools for explicit `node:bench` files. They
+do not modify or replace the legacy benchmark framework. Each repeated
+observation for a benchmark identity uses one measured sample from a separate
+process invocation. Configurations declared in the same file still execute
+serially in that process, unlike the legacy framework's configuration-level
+process isolation, and can share runtime state.
+
+Both parallel tools support inline analysis. `scatter-node-bench.js --analyze`
+uses the same `--xaxis`, `--category`, and `--no-chart` interface described for
+`scatter.js`. `compare-node-bench.js --analyze` performs Welch's t-test, while
+`--max-regression N` adds a corrected regression gate. The gate requires both a
+Holm-Bonferroni-adjusted p-value below 0.05 and a 95% confidence interval lying
+entirely beyond `-N%`; the point estimate alone cannot fail the command.
+Scatter analysis reduces aggregated configurations to one value per outer
+process and uses disjoint process sets for consecutive Mann-Whitney comparisons
+so configurations sharing a process are not treated as independent samples.
+
+Underscore-prefixed ports are kept beside selected legacy benchmarks and are
+excluded from legacy discovery. For example:
+
+```console
+./node benchmark/scatter.js --runs 30 \
+  benchmark/crypto/create-hash.js > legacy.csv
+./node benchmark/scatter-node-bench.js --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > node-bench.csv
+```
+
+The port uses the legacy relative filename as its benchmark name and preserves
+the same parameter names. The two CSV files can therefore be analyzed with the
+same scripts to check whether their rate distributions and measurement units
+agree. See [`benchmark/README.md`][] for compare and scatter examples.
+
 ### Running benchmarks on the CI
 
 To see the performance impact of a pull request by running benchmarks on
@@ -889,6 +925,7 @@ Supported options keys are:
 
 [Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Effect_size_for_ordinal_data
 [Mann-Whitney U test]: https://en.wikipedia.org/wiki/Mann%E2%80%93Whitney_U_test
+[`benchmark/README.md`]: ../../benchmark/README.md#nodebench-evaluation-tools
 [autocannon]: https://github.com/mcollina/autocannon
 [benchmark-ci]: https://github.com/nodejs/benchmarking/blob/HEAD/docs/core_benchmarks.md
 [git-for-windows]: https://git-scm.com/download/win
diff --git a/test/fixtures/bench-runner/tools-collision.cjs b/test/fixtures/bench-runner/tools-collision.cjs
new file mode 100644
index 000000000000..5fb27dd956d7
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-collision.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench, suite } = require('node:bench');
+
+function register(name) {
+  bench(name, { params: { size: 1 } }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+}
+
+suite('first', () => register('same'));
+suite('second', () => register('same'));
diff --git a/test/fixtures/bench-runner/tools-no-params.cjs b/test/fixtures/bench-runner/tools-no-params.cjs
new file mode 100644
index 000000000000..2dde0c2a0c69
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-no-params.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/no-params.js', (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/tools-reserved-param.cjs b/test/fixtures/bench-runner/tools-reserved-param.cjs
new file mode 100644
index 000000000000..00052b0c8e4b
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-reserved-param.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/reserved.js', { params: { rate: 'parameter' } }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/tools.cjs b/test/fixtures/bench-runner/tools.cjs
new file mode 100644
index 000000000000..108a6f81dd63
--- /dev/null
+++ b/test/fixtures/bench-runner/tools.cjs
@@ -0,0 +1,20 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+if (process.env.NODE_BENCH_PID_LOG !== undefined) {
+  require('fs').appendFileSync(
+    process.env.NODE_BENCH_PID_LOG, `${process.pid}\n`);
+}
+
+for (const size of [1, 2]) {
+  bench('tools/simple.js', {
+    params: { method: 'loop', size },
+  }, (b) => {
+    let value = 0;
+    b.start();
+    for (let i = 0; i < 1_000; i++) value += size;
+    b.end(1_000);
+    if (value === 0) throw new Error('unreachable');
+  });
+}
diff --git a/test/parallel/test-benchmark-node-bench-tools.js b/test/parallel/test-benchmark-node-bench-tools.js
new file mode 100644
index 000000000000..84b5f98e9eec
--- /dev/null
+++ b/test/parallel/test-benchmark-node-bench-tools.js
@@ -0,0 +1,261 @@
+// Flags: --no-warnings
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const {
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+} = require('../../benchmark/_node-bench-analysis.js');
+const { csvEncode } = require('../../benchmark/_node-bench.js');
+
+const compare = path.resolve(__dirname, '../../benchmark/compare-node-bench.js');
+const legacyScatter = path.resolve(__dirname, '../../benchmark/scatter.js');
+const scatter = path.resolve(__dirname, '../../benchmark/scatter-node-bench.js');
+const benchmark = fixtures.path('bench-runner/tools.cjs');
+
+tmpdir.refresh();
+
+assert.strictEqual(csvEncode(true), 'true');
+assert.deepStrictEqual(holmAdjust([0.01, 0.03, 0.04]), [0.03, 0.06, 0.06]);
+assert.strictEqual(isRegressionFailure({
+  ci95: 3,
+  improvement: -12,
+  pAdjusted: 0.01,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pAdjusted: 0.06,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pAdjusted: 0.01,
+}, 10), true);
+assert.throws(
+  () => analyzeScatter([{
+    observation: 0,
+    params: { size: 1 },
+    rate: 1,
+  }], 'size', 'size', false),
+  /must name different parameters/,
+);
+assert.doesNotMatch(analyzeScatter([0, 1].map((observation) => ({
+  observation,
+  params: { size: 1 },
+  rate: 1_234_567.89,
+})), 'size', undefined, false), /\(!\)/);
+assert.match(analyzeScatter([
+  { observation: 0, params: { method: 'a', size: 1 }, rate: 10 },
+  { observation: 0, params: { method: 'b', size: 1 }, rate: 20 },
+  { observation: 1, params: { method: 'a', size: 1 }, rate: 30 },
+  { observation: 1, params: { method: 'b', size: 1 }, rate: 50 },
+], 'size', undefined, false), /\n\s*1\s+2\s+/);
+
+function run(script, args, options = undefined) {
+  return spawnSync(process.execPath, [script, ...args], {
+    encoding: 'utf8',
+    timeout: 30_000,
+    ...options,
+  });
+}
+
+{
+  const pidLog = tmpdir.resolve('pids');
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_PID_LOG: pidLog },
+  });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"binary","filename","configuration","rate","time"');
+  assert.strictEqual(lines.length, 9);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"old",')).length,
+                     4);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"new",')).length,
+                     4);
+  assert.deepStrictEqual(lines.slice(1).map((line) => line.slice(0, 5)), [
+    '"old"', '"old"', '"new"', '"new"',
+    '"new"', '"new"', '"old"', '"old"',
+  ]);
+  assert(lines.slice(1).every(
+    (line) => line.includes('"tools/simple.js"')));
+  const pids = fs.readFileSync(pidLog, 'utf8').trim().split('\n');
+  assert.strictEqual(new Set(pids).size, 4);
+}
+
+{
+  const result = run(scatter, [
+    '--node', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"filename","method","size","rate","time"');
+  assert.strictEqual(lines.length, 5);
+  assert(lines.slice(1).every(
+    (line) => line.startsWith('"tools/simple.js","loop",')));
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0], '"filename","rate","time"');
+  assert.strictEqual(lines.length, 2);
+  assert.strictEqual(lines[1].split(',').length, 3);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-reserved-param.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /parameter 'rate' is reserved/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /requires one logical benchmark name per file/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /Distinct benchmarks would share the CSV group/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--', fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /set of reported benchmarks changed between runs/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--name-pattern', 'missing',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /No benchmark samples were produced/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', 'invalid',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--runs must be an integer/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--analyze',
+    '--xaxis', 'size',
+    '--category', 'method',
+    '--no-chart',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout,
+               /size\s+method\s+samples\s+rate\s+confidence\.interval/);
+  assert.match(result.stdout, /Change between consecutive size values/);
+  assert.match(result.stdout, /Mann-Whitney U.*Cliff's delta/);
+  assert.doesNotMatch(result.stdout, /"filename","method"/);
+}
+
+{
+  const result = run(scatter, [
+    '--analyze',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--analyze requires --xaxis/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--max-regression', '100',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /Holm-Bonferroni correction/);
+  assert.match(result.stdout, /--max-regression uses the corrected values/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const legacy = run(legacyScatter, [
+    '--runs', '1',
+    path.resolve(__dirname, '../../benchmark/crypto/create-hash.js'),
+  ]);
+  const modern = run(scatter, [
+    '--runs', '1',
+    '--', path.resolve(
+      __dirname, '../../benchmark/crypto/_create-hash.node-bench.js'),
+  ]);
+  assert.strictEqual(legacy.status, 0, legacy.stderr);
+  assert.strictEqual(modern.status, 0, modern.stderr);
+  const legacyLines = legacy.stdout.trim().split('\n');
+  const modernLines = modern.stdout.trim().split('\n');
+  assert.strictEqual(legacyLines[0].replaceAll(' ', ''), modernLines[0]);
+  const name = path.join('crypto', 'create-hash.js');
+  assert(legacyLines[1].startsWith(`"${name}",`));
+  assert(modernLines[1].startsWith(`"${name}",`));
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', path.resolve(
+      __dirname,
+      '../../benchmark/buffers/_buffer-compare-offset.node-bench.js',
+    ),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"filename","method","n","size","rate","time"');
+  assert.strictEqual(lines.length, 9);
+}

From cc914f9a2506dfea6cc718aa9c84cf58b67f644c Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 01:29:13 +0000
Subject: [PATCH 043/202] src: fixup histogram and options linting issues
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 src/histogram.cc   |  4 ++--
 src/node_options.h | 13 ++++++-------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/histogram.cc b/src/histogram.cc
index 1008c63c04d4..f2b93d3b8be4 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -501,8 +501,8 @@ Histogram::MeanCIResult Histogram::MeanCI(double confidence) const {
                     static_cast<double>(count - 1);
   double standard_error = std::sqrt(variance / static_cast<double>(count));
   double alpha = 1.0 - confidence;
-  double t_crit = StudentTUpperQuantile(
-      alpha / 2.0, static_cast<double>(count - 1));
+  double t_crit =
+      StudentTUpperQuantile(alpha / 2.0, static_cast<double>(count - 1));
   double margin = t_crit * standard_error;
   return {mean, mean - margin, mean + margin};
 }
diff --git a/src/node_options.h b/src/node_options.h
index 7af20beaaa63..4ee8a575cb3e 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -532,13 +532,12 @@ class OptionsParser {
       OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
       bool default_is_true = false,
       OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
-  void AddOption(
-      const char* name,
-      const char* help_text,
-      uint64_t Options::*field,
-      OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
-      OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace,
-      bool strict = false);
+  void AddOption(const char* name,
+                 const char* help_text,
+                 uint64_t Options::*field,
+                 OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
+                 OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace,
+                 bool strict = false);
   void AddOption(
       const char* name,
       const char* help_text,

From 1b644eac8e588818e3342420205c69f36ce85eaa Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 16:03:14 +0000
Subject: [PATCH 044/202] lib: add `node:bench` explicit createRunner
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Makes it easier for benchmark tools to build on top of
the bench runner primitives.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/api/bench.md                              | 163 +++++++++++++++--
 doc/api/cli.md                                |   5 +-
 doc/node.1                                    |   5 +-
 lib/bench.js                                  |   6 +-
 lib/internal/bench_runner/benchmark.js        | 141 +++++++++++++--
 lib/internal/bench_runner/harness.js          | 165 ++++++++++++++----
 lib/internal/bench_runner/runner.js           |   6 +-
 .../fixtures/bench-runner/recorded-detail.cjs |  17 ++
 test/parallel/test-bench-cli.js               |  19 ++
 test/parallel/test-bench-context-control.js   |  86 +++++++++
 test/parallel/test-bench-context-errors.js    |  82 +++++++++
 test/parallel/test-bench-create-runner.js     |  96 ++++++++++
 test/parallel/test-bench-validation.js        |  10 +-
 .../test-bench-yield-between-samples.js       |  79 +++++++++
 14 files changed, 805 insertions(+), 75 deletions(-)
 create mode 100644 test/fixtures/bench-runner/recorded-detail.cjs
 create mode 100644 test/parallel/test-bench-context-control.js
 create mode 100644 test/parallel/test-bench-context-errors.js
 create mode 100644 test/parallel/test-bench-create-runner.js
 create mode 100644 test/parallel/test-bench-yield-between-samples.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 4acea0f98c9d..7cb5720ffe28 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -63,18 +63,55 @@ exit code is set to `1`.
 ## Measurement model
 
 Each warmup and measured sample invokes the benchmark function once with a
-fresh {BenchContext}. The function must call `context.start()` and
-`context.end(operations)` exactly once. Setup before `start()` and cleanup after
-`end()` are outside the measured region. Promise-returning functions are
-awaited.
-
-An event loop turn occurs between sample invocations. The runner executes
+fresh {BenchContext}. The function must either call `context.start()` and
+`context.end(operations)` exactly once, or call `context.record(sample)` exactly
+once to provide an externally measured sample. Setup before `start()` and
+cleanup after `end()` are outside the measured region. Promise-returning
+functions are awaited.
+
+By default, an event loop turn occurs between sample invocations. An embedded
+runner can disable this using `yieldBetweenSamples`. The runner executes
 benchmarks serially, but it does not provide process isolation. Other work in
 the process, JIT compilation, garbage collection, CPU frequency changes, and
 system load can all affect results. Keep raw samples when comparing results and
 investigate noisy or skewed distributions rather than treating a confidence
 interval as a pass/fail threshold.
 
+Calling `context.done()` during a measured sample completes the benchmark after
+that sample. This allows a higher-level tool to treat `samples` as a maximum and
+implement a dynamic sampling policy.
+
+## Reusable runners
+
+The module-level declaration functions use a shared runner and schedule it
+automatically. Higher-level tools can create isolated, explicitly started
+runners instead:
+
+```mjs
+import { createRunner } from 'node:bench';
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('example', { samples: 100 }, (b) => {
+  const operations = chooseOperationCount();
+  b.start();
+  runOperations(operations);
+  const sample = b.end(operations);
+
+  if (hasEnoughData(sample)) b.done();
+});
+
+for await (const record of runner.run()) {
+  // Consume structured benchmark records.
+}
+```
+
+Each runner has independent declarations, hooks, filtering, and output. Unlike
+the module-level declarations, creating a benchmark on an explicit runner does
+not schedule execution. This allows packages to collect declarations and start
+them later. Calling the explicit runner's `run()` function prevents additional
+declarations and a second call to `run()` is an error.
+
 ## Command-line runner
 
 The `--bench` flag runs one or more explicit benchmark files or glob patterns:
@@ -160,6 +197,29 @@ async function* names(source) {
 run().compose(names).pipe(process.stdout);
 ```
 
+## `createRunner([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. Disabling this also prevents timer-based abort signals from
+    firing between synchronous callbacks. Benchmark timeouts continue to be
+    checked against a monotonic deadline. **Default:** `true`.
+* Returns: {Object} An isolated benchmark runner with bound `after`, `afterEach`,
+  `before`, `beforeEach`, `bench`, `describe`, `run`, and `suite` functions.
+
+Creates an explicitly started benchmark runner. Declarations made through one
+runner do not interact with declarations made through another runner or through
+the module-level functions. Call the returned `run()` function to start the
+runner and obtain its {BenchmarksStream}.
+
+Each runner can be started once. Its `run()` function accepts the same options
+as the module-level [`run()`][]. `run({ yieldBetweenSamples })` overrides the
+value passed to `createRunner()`.
+
 ## `bench([name][, options], fn)`
 
 <!-- YAML
@@ -175,8 +235,9 @@ added: REPLACEME
   * `params` {Object} String, finite number, or boolean metadata identifying
     this benchmark configuration. Parameter keys are sorted when constructing
     the stable benchmark identity. **Default:** An empty object.
-  * `samples` {number} The number of measured callback invocations. Must be a
-    positive 32-bit unsigned integer. **Default:** `30`.
+  * `samples` {number} The maximum number of measured callback invocations.
+    Must be a positive 32-bit unsigned integer. The benchmark may finish earlier
+    by calling `context.done()`. **Default:** `30`.
   * `signal` {AbortSignal} Allows aborting this benchmark.
   * `skip` {boolean|string} If truthy, the benchmark is skipped. A string is
     included in the result as the skip reason. **Default:** `false`.
@@ -283,7 +344,7 @@ added: REPLACEME
 
 Registers a hook that runs once before each complete logical benchmark in the
 current suite. It does not run before every sample. Per-sample setup belongs in
-the benchmark function before `context.start()`.
+the benchmark function before `context.start()` or `context.record()`.
 
 ## `afterEach(fn)`
 
@@ -296,7 +357,7 @@ added: REPLACEME
 
 Registers a hook that runs once after each complete logical benchmark in the
 current suite. It does not run after every sample. Per-sample cleanup belongs
-in the benchmark function after `context.end()`.
+in the benchmark function after `context.end()` or `context.record()`.
 
 ## `run([options])`
 
@@ -308,17 +369,21 @@ added: REPLACEME
   * `namePattern` {string|RegExp} Only runs benchmarks whose full hierarchical
     name matches the pattern. String values are interpreted as JavaScript
     regular expressions.
-  * `samples` {number} Overrides the number of measured callback invocations
-    for every benchmark. Must be a positive 32-bit unsigned integer.
+  * `samples` {number} Overrides the maximum number of measured callback
+    invocations for every benchmark. Must be a positive 32-bit unsigned integer.
   * `signal` {AbortSignal} Allows aborting in-progress benchmark execution.
   * `warmup` {number} Overrides the number of unreported warmup callback
     invocations for every benchmark. Must be a 32-bit unsigned integer.
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. **Default:** `true`, or the value passed to `createRunner()` for
+    an explicit runner.
 * Returns: {BenchmarksStream}
 
 Returns the object-mode event stream for the in-process benchmark run. Call
 `run()` during the same turn in which benchmarks are declared, before automatic
 execution begins. Calling `run()` is optional when the returned stream is not
-needed.
+needed. An explicit runner created by `createRunner()` does not run
+automatically, so its `run()` function may be called later.
 
 ```mjs
 import { bench, run } from 'node:bench';
@@ -341,6 +406,17 @@ for await (const { type, data } of run()) {
 An instance of `BenchContext` is passed to every benchmark invocation. A new
 instance is created for every warmup and measured sample.
 
+### `context.index`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {number}
+
+The zero-based invocation index within the current `context.phase`. Warmup and
+measured samples have separate index sequences.
+
 ### `context.name`
 
 <!-- YAML
@@ -361,6 +437,17 @@ added: REPLACEME
 
 The benchmark's canonicalized parameter metadata.
 
+### `context.phase`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {string}
+
+The current sample phase. It is `'warmup'` for an unreported warmup invocation
+and `'measurement'` for a measured invocation.
+
 ### `context.signal`
 
 <!-- YAML
@@ -381,7 +468,7 @@ added: REPLACEME
 Starts the measured region using `process.hrtime.bigint()`. Calling `start()`
 more than once is an error.
 
-### `context.end(operations)`
+### `context.end(operations[, options])`
 
 <!-- YAML
 added: REPLACEME
@@ -389,10 +476,52 @@ added: REPLACEME
 
 * `operations` {number} The number of completed operations. Must be a positive
   safe integer.
+* `options` {Object}
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The sample's `operations`, `duration_ns`, computed `rate`,
+  and optional cloned `detail`.
 
 Ends the measured region. The end timestamp is captured before `operations` is
 validated. Calling `end()` before `start()`, calling it more than once, or
-recording a zero-duration sample is an error.
+recording a zero-duration sample is an error. When provided, `detail` is cloned
+after the end timestamp is captured, so cloning time is outside the measured
+region.
+
+### `context.record(sample)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `sample` {Object}
+  * `operations` {number} The number of completed operations. Must be a positive
+    safe integer.
+  * `duration_ns` {bigint} An externally measured positive duration in
+    nanoseconds no greater than `Number.MAX_SAFE_INTEGER`.
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The normalized sample, including its computed `rate` and
+  optional cloned `detail`.
+
+Records a measurement made by another clock or execution environment. This is
+useful when a higher-level tool measures work in a worker and needs to exclude
+message transport from the duration. `record()` is mutually exclusive with
+`start()` and `end()` within one callback and must be called exactly once.
+
+### `context.done()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Requests successful benchmark completion after the current measured sample.
+The callback must still call either `start()` and `end()`, or `record()`.
+Calling `done()` during a warmup invocation is an error. The configured
+`samples` value remains the maximum number of measured invocations if `done()`
+is not called.
 
 ## Class: `BenchmarksStream`
 
@@ -422,9 +551,10 @@ files.
 Each measured sample has the following properties:
 
 * `operations` {number} The positive operation count passed to
-  `context.end()`.
+  `context.end()` or `context.record()`.
 * `duration_ns` {bigint} The measured duration in nanoseconds.
 * `rate` {number} Operations per second.
+* `detail` {any} The optional cloned sample detail.
 
 ## Benchmark result
 
@@ -452,5 +582,6 @@ A completed benchmark result contains:
     interval for the median rate, with `lower` and `upper` properties.
   * `skewness` {number} The skewness of the scaled rate histogram.
 
+[`run()`]: #runoptions
 [benchmark result]: #benchmark-result
 [command-line options documentation]: cli.md#--bench
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 1b7edab885f4..804cc1472007 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -539,8 +539,9 @@ added: REPLACEME
 
 > Stability: 1 - Experimental
 
-Overrides the number of measured callback invocations for every selected
-benchmark. `count` must be an integer between `1` and `4294967295`.
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+`context.done()`. `count` must be an integer between `1` and `4294967295`.
 
 ### `--bench-warmup=count`
 
diff --git a/doc/node.1 b/doc/node.1
index 5811d541713d..7307ebf4abf3 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -323,8 +323,9 @@ have a corresponding \fB--bench-reporter-destination\fR. The default reporter is
 \fBspec\fR.
 .
 .It Fl -bench-samples Ns = Ns Ar count
-Overrides the number of measured callback invocations for every selected
-benchmark. \fBcount\fR must be an integer between \fB1\fR and \fB4294967295\fR.
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+\fBcontext.done()\fR. \fBcount\fR must be an integer between \fB1\fR and \fB4294967295\fR.
 .
 .It Fl -bench-warmup Ns = Ns Ar count
 Overrides the number of unreported warmup callback invocations for every
diff --git a/lib/bench.js b/lib/bench.js
index cc3aa686ee57..9d1bd24fcebd 100644
--- a/lib/bench.js
+++ b/lib/bench.js
@@ -13,7 +13,10 @@ const {
   bench,
   suite,
 } = require('internal/bench_runner/harness');
-const { run } = require('internal/bench_runner/runner');
+const {
+  createRunner,
+  run,
+} = require('internal/bench_runner/runner');
 
 if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
     typeof process.send !== 'function') {
@@ -27,6 +30,7 @@ ObjectAssign(module.exports, {
   before,
   beforeEach,
   bench,
+  createRunner,
   describe: suite,
   run,
   suite,
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
index 27f372d7295f..d3c55c1b2ef5 100644
--- a/lib/internal/bench_runner/benchmark.js
+++ b/lib/internal/bench_runner/benchmark.js
@@ -43,6 +43,7 @@ const {
   validateString,
   validateUint32,
 } = require('internal/validators');
+const { structuredClone } = require('internal/worker/js_transferable');
 
 const { bigint: hrtime } = process.hrtime;
 const kDefaultSamples = 30;
@@ -138,6 +139,19 @@ function getNamePath(parent, name) {
   return path;
 }
 
+function cloneSample(sample) {
+  const result = {
+    __proto__: null,
+    operations: sample.operations,
+    duration_ns: sample.duration_ns,
+    rate: sample.rate,
+  };
+  if (sample.detail !== undefined) {
+    result.detail = structuredClone(sample.detail);
+  }
+  return result;
+}
+
 class Suite extends AsyncResource {
   constructor(harness, parent, name, options, fn, loc, isRoot = false) {
     super('BenchSuite');
@@ -219,16 +233,30 @@ class Bench extends AsyncResource {
 
 class BenchContext {
   #closed = false;
+  #done = false;
   #endCalled = false;
+  #index;
   #invalid = false;
+  #phase;
+  #recordCalled = false;
   #sample = null;
   #startCalled = false;
   #startTime;
 
-  constructor(bench, signal) {
+  constructor(bench, signal, phase, index) {
     this.name = bench.name;
     this.params = bench.params;
     this.signal = signal;
+    this.#phase = phase;
+    this.#index = index;
+  }
+
+  get index() {
+    return this.#index;
+  }
+
+  get phase() {
+    return this.#phase;
   }
 
   start() {
@@ -236,6 +264,11 @@ class BenchContext {
       this.#invalid = true;
       throw new ERR_INVALID_STATE('benchmark sample is no longer active');
     }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() cannot be combined with record()');
+    }
     if (this.#startCalled) {
       this.#invalid = true;
       throw new ERR_INVALID_STATE(
@@ -245,12 +278,17 @@ class BenchContext {
     this.#startTime = hrtime();
   }
 
-  end(operations) {
+  end(operations, options = kEmptyObject) {
     const endTime = hrtime();
     if (this.#closed) {
       this.#invalid = true;
       throw new ERR_INVALID_STATE('benchmark sample is no longer active');
     }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() cannot be combined with record()');
+    }
     if (this.#endCalled) {
       this.#invalid = true;
       throw new ERR_INVALID_STATE(
@@ -263,24 +301,93 @@ class BenchContext {
     }
 
     try {
+      validateObject(options, 'options');
+      const { detail } = options;
       validateInteger(operations, 'operations', 1, NumberMAX_SAFE_INTEGER);
+      const duration = endTime - this.#startTime;
+      if (duration === 0n) {
+        throw new ERR_INVALID_STATE(
+          'insufficient clock precision for benchmark sample');
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns: duration,
+        rate: operations / (Number(duration) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
     } catch (error) {
       this.#invalid = true;
       throw error;
     }
+    return cloneSample(this.#sample);
+  }
 
-    const duration = endTime - this.#startTime;
-    if (duration === 0n) {
+  record(sample) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
       this.#invalid = true;
       throw new ERR_INVALID_STATE(
-        'insufficient clock precision for benchmark sample');
+        'record() must be called exactly once per benchmark sample');
     }
-    this.#sample = {
-      __proto__: null,
-      operations,
-      duration_ns: duration,
-      rate: operations / (Number(duration) / 1e9),
-    };
+    if (this.#startCalled || this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() cannot be combined with start() or end()');
+    }
+    this.#recordCalled = true;
+
+    try {
+      validateObject(sample, 'sample');
+      const { detail, duration_ns, operations } = sample;
+      validateInteger(
+        operations, 'sample.operations', 1, NumberMAX_SAFE_INTEGER);
+      if (typeof duration_ns !== 'bigint') {
+        throw new ERR_INVALID_ARG_TYPE(
+          'sample.duration_ns', 'bigint', duration_ns);
+      }
+      if (duration_ns <= 0n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns', 'a positive bigint', duration_ns);
+      }
+      if (duration_ns > 9_007_199_254_740_991n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns',
+          'less than or equal to Number.MAX_SAFE_INTEGER',
+          duration_ns);
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns,
+        rate: operations / (Number(duration_ns) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  done() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#phase !== 'measurement') {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'done() can only be called during a measured sample');
+    }
+    this.#done = true;
   }
 
   finish() {
@@ -289,15 +396,19 @@ class BenchContext {
       throw new ERR_INVALID_STATE(
         'benchmark sample violated the start()/end() contract');
     }
-    if (!this.#startCalled) {
+    if (!this.#recordCalled && !this.#startCalled) {
       throw new ERR_INVALID_STATE(
-        'benchmark callback did not call start()');
+        'benchmark callback did not call start() or record()');
     }
-    if (!this.#endCalled || this.#sample === null) {
+    if (!this.#recordCalled && (!this.#endCalled || this.#sample === null)) {
       throw new ERR_INVALID_STATE(
         'benchmark callback did not call end()');
     }
-    return this.#sample;
+    return {
+      __proto__: null,
+      done: this.#done,
+      sample: this.#sample,
+    };
   }
 
   close() {
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index 1e6dac738cb4..59b85860c2e9 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -4,7 +4,9 @@ const {
   ArrayPrototypePush,
   ArrayPrototypeReverse,
   ArrayPrototypeSlice,
+  BigInt,
   FunctionPrototypeCall,
+  MathCeil,
   Promise,
   PromisePrototypeThen,
   PromiseResolve,
@@ -35,6 +37,7 @@ const {
 const { isRegExp } = require('internal/util/types');
 const {
   validateAbortSignal,
+  validateBoolean,
   validateFunction,
   validateObject,
   validateUint32,
@@ -65,16 +68,34 @@ function createAbortError(signal) {
   return new AbortError(undefined, { __proto__: null, cause: signal.reason });
 }
 
+function createTimeoutError(benchmark) {
+  return new ERR_OPERATION_FAILED(
+    `Benchmark timed out after ${benchmark.timeout}ms`);
+}
+
 class Harness {
+  #autoRun;
   #buildPromises = [];
   #duplicateErrors = new SafeMap();
   #explicitRun = false;
   #hasOnly = false;
   #runPromise = null;
   #scheduled = false;
+  #starting = false;
   #storage = new AsyncLocalStorage();
+  #yieldBetweenSamples;
 
-  constructor() {
+  constructor(options = kEmptyObject) {
+    validateObject(options, 'options');
+    const {
+      autoRun = true,
+      yieldBetweenSamples = true,
+    } = options;
+    validateBoolean(autoRun, 'options.autoRun');
+    validateBoolean(
+      yieldBetweenSamples, 'options.yieldBetweenSamples');
+    this.#autoRun = autoRun;
+    this.#yieldBetweenSamples = yieldBetweenSamples;
     this.entryFile = process.argv?.[1];
     this.stream = new BenchmarksStream();
     this.state = 'collecting';
@@ -102,9 +123,10 @@ class Harness {
   }
 
   #ensureCollecting() {
-    if (this.state === 'collecting' ||
-        (this.state === 'building' &&
-         this.#storage.getStore() instanceof Suite)) return;
+    if (this.state === 'building' &&
+        this.#storage.getStore() instanceof Suite) return;
+    if (!this.#explicitRun && !this.#starting &&
+        this.state === 'collecting') return;
     throw new ERR_INVALID_STATE(
       'benchmarks cannot be declared after execution has started');
   }
@@ -186,19 +208,23 @@ class Harness {
 
   configure(options = kEmptyObject) {
     validateObject(options, 'options');
-    if (this.#runPromise !== null) {
-      if (options !== kEmptyObject) {
-        throw new ERR_INVALID_STATE('benchmark execution has already started');
-      }
-      return;
-    }
 
-    const { namePattern, samples, signal, warmup } = options;
+    const {
+      namePattern,
+      samples,
+      signal,
+      warmup,
+      yieldBetweenSamples,
+    } = options;
+    let nextNamePattern = this.namePattern;
+    let nextSamples = this.samples;
+    let nextWarmup = this.warmup;
+    let nextYieldBetweenSamples = this.#yieldBetweenSamples;
     if (namePattern !== undefined) {
       if (typeof namePattern === 'string') {
-        this.namePattern = new RegExp(namePattern);
+        nextNamePattern = new RegExp(namePattern);
       } else if (isRegExp(namePattern)) {
-        this.namePattern = namePattern;
+        nextNamePattern = namePattern;
       } else {
         throw new ERR_INVALID_ARG_TYPE(
           'options.namePattern', ['string', 'RegExp'], namePattern);
@@ -206,15 +232,30 @@ class Harness {
     }
     if (samples !== undefined) {
       validateUint32(samples, 'options.samples', true);
-      this.samples = samples;
+      nextSamples = samples;
     }
     validateAbortSignal(signal, 'options.signal');
-    this.outerSignal = signal;
     if (warmup !== undefined) {
       validateUint32(warmup, 'options.warmup');
-      this.warmup = warmup;
+      nextWarmup = warmup;
+    }
+    if (yieldBetweenSamples !== undefined) {
+      validateBoolean(
+        yieldBetweenSamples, 'options.yieldBetweenSamples');
+      nextYieldBetweenSamples = yieldBetweenSamples;
+    }
+
+    this.namePattern = nextNamePattern;
+    this.samples = nextSamples;
+    this.outerSignal = signal;
+    this.warmup = nextWarmup;
+    this.#yieldBetweenSamples = nextYieldBetweenSamples;
+  }
+
+  #ensureCanRun() {
+    if (this.#explicitRun || this.#starting || this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE('benchmark execution has already started');
     }
-    this.#explicitRun = true;
   }
 
   run(options = kEmptyObject, force = false) {
@@ -222,13 +263,21 @@ class Harness {
       throw new ERR_INVALID_STATE(
         'run() cannot be called from a file run with --bench');
     }
-    this.configure(options);
-    this.#schedule(force);
+    this.#ensureCanRun();
+    this.#starting = true;
+    try {
+      this.configure(options);
+      this.#explicitRun = true;
+    } finally {
+      this.#starting = false;
+    }
+    this.#schedule(force, true);
     return this.stream;
   }
 
-  #schedule(force = false) {
+  #schedule(force = false, explicit = false) {
     if (!force && kIsCliRunner) return;
+    if (!explicit && !this.#autoRun) return;
     if (this.#scheduled) return;
     this.#scheduled = true;
     queueMicrotask(() => {
@@ -454,8 +503,7 @@ class Harness {
     }
     if (benchmark.timeout !== Infinity) {
       timer = setTimeout(() => {
-        const error = new ERR_OPERATION_FAILED(
-          `Benchmark timed out after ${benchmark.timeout}ms`);
+        const error = createTimeoutError(benchmark);
         controller.abort(error);
         stop.reject(error);
       }, benchmark.timeout);
@@ -473,8 +521,9 @@ class Harness {
     }
   }
 
-  async #runSample(benchmark, signal) {
-    const context = new BenchContext(benchmark, signal);
+  async #runSample(benchmark, signal, phase, index) {
+    const context = new BenchContext(
+      benchmark, signal, phase, index);
     try {
       await this.#invoke(
         benchmark, benchmark, benchmark.fn, [context]);
@@ -557,6 +606,15 @@ class Harness {
     });
 
     const controller = new AbortController();
+    const deadline = benchmark.timeout === Infinity ?
+      null : hrtime() + BigInt(MathCeil(benchmark.timeout * 1e6));
+    const checkDeadline = () => {
+      if (deadline !== null && hrtime() >= deadline) {
+        const timeoutError = createTimeoutError(benchmark);
+        controller.abort(timeoutError);
+        throw timeoutError;
+      }
+    };
     const samples = [];
     const hookContext = {
       __proto__: null,
@@ -571,14 +629,18 @@ class Harness {
         try {
           await this.#runBenchHooks(
             benchmark, 'beforeEach', hookContext);
+          checkDeadline();
           const warmup = this.warmup ?? benchmark.warmup;
           const total = warmup + (this.samples ?? benchmark.samples);
           for (let i = 0; i < total; i++) {
             if (controller.signal.aborted) {
               throw controller.signal.reason;
             }
-            const sample = await this.#runSample(
-              benchmark, controller.signal);
+            const phase = i < warmup ? 'warmup' : 'measurement';
+            const index = phase === 'warmup' ? i : i - warmup;
+            const { done, sample } = await this.#runSample(
+              benchmark, controller.signal, phase, index);
+            checkDeadline();
             if (controller.signal.aborted) {
               throw controller.signal.reason;
             }
@@ -593,11 +655,15 @@ class Harness {
                 ...sample,
               });
             }
-            if (i + 1 < total) await eventLoopTurn();
+            if (done) break;
+            if (i + 1 < total && this.#yieldBetweenSamples) {
+              await eventLoopTurn();
+            }
           }
         } finally {
           await this.#runBenchHooks(
             benchmark, 'afterEach', hookContext);
+          checkDeadline();
         }
       });
     } catch (cause) {
@@ -664,9 +730,9 @@ function lazyHarness() {
   return globalHarness;
 }
 
-function runInParentContext(type) {
+function createDeclaration(type, getHarness) {
   const declare = (name, options, fn, overrides = kEmptyObject) => {
-    const harness = lazyHarness();
+    const harness = getHarness();
     const loc = getCallerLocation();
     const declarationOptions = { __proto__: null, ...overrides, loc };
     return type === 'benchmark' ?
@@ -683,12 +749,36 @@ function runInParentContext(type) {
   return declare;
 }
 
-function hook(name) {
-  return (fn, options) => lazyHarness().createHook(name, fn, options);
+function createHook(name, getHarness) {
+  return (fn, options) => getHarness().createHook(name, fn, options);
 }
 
-const bench = runInParentContext('benchmark');
-const suite = runInParentContext('suite');
+const bench = createDeclaration('benchmark', lazyHarness);
+const suite = createDeclaration('suite', lazyHarness);
+
+function createRunner(options = kEmptyObject) {
+  validateObject(options, 'options');
+  const harness = new Harness({
+    __proto__: null,
+    autoRun: false,
+    yieldBetweenSamples: options.yieldBetweenSamples === undefined ?
+      true : options.yieldBetweenSamples,
+  });
+  const getHarness = () => harness;
+  const runnerBench = createDeclaration('benchmark', getHarness);
+  const runnerSuite = createDeclaration('suite', getHarness);
+  return {
+    __proto__: null,
+    after: createHook(kHookNames[0], getHarness),
+    afterEach: createHook(kHookNames[1], getHarness),
+    before: createHook(kHookNames[2], getHarness),
+    beforeEach: createHook(kHookNames[3], getHarness),
+    bench: runnerBench,
+    describe: runnerSuite,
+    run: (runOptions = kEmptyObject) => harness.run(runOptions),
+    suite: runnerSuite,
+  };
+}
 
 function runBenchmarks(options, force) {
   return lazyHarness().run(options, force);
@@ -696,11 +786,12 @@ function runBenchmarks(options, force) {
 
 module.exports = {
   Harness,
-  after: hook(kHookNames[0]),
-  afterEach: hook(kHookNames[1]),
-  before: hook(kHookNames[2]),
-  beforeEach: hook(kHookNames[3]),
+  after: createHook(kHookNames[0], lazyHarness),
+  afterEach: createHook(kHookNames[1], lazyHarness),
+  before: createHook(kHookNames[2], lazyHarness),
+  beforeEach: createHook(kHookNames[3], lazyHarness),
   bench,
+  createRunner,
   runBenchmarks,
   suite,
 };
diff --git a/lib/internal/bench_runner/runner.js b/lib/internal/bench_runner/runner.js
index ee55672b5f11..fc8595d2a35d 100644
--- a/lib/internal/bench_runner/runner.js
+++ b/lib/internal/bench_runner/runner.js
@@ -1,12 +1,16 @@
 'use strict';
 
 const { kEmptyObject } = require('internal/util');
-const { runBenchmarks } = require('internal/bench_runner/harness');
+const {
+  createRunner,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
 
 function run(options = kEmptyObject) {
   return runBenchmarks(options);
 }
 
 module.exports = {
+  createRunner,
   run,
 };
diff --git a/test/fixtures/bench-runner/recorded-detail.cjs b/test/fixtures/bench-runner/recorded-detail.cjs
new file mode 100644
index 000000000000..1643783225d0
--- /dev/null
+++ b/test/fixtures/bench-runner/recorded-detail.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('recorded detail', { samples: 3 }, (b) => {
+  b.record({
+    __proto__: null,
+    detail: {
+      index: b.index,
+      phase: b.phase,
+      value: 42n,
+    },
+    duration_ns: 4n,
+    operations: 2,
+  });
+  b.done();
+});
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 5a170ab9c674..8ed5afddad67 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -145,6 +145,25 @@ function parseOutput(output) {
   assert.strictEqual(records.at(-1).data.success, false);
 }
 
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/recorded-detail.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.samples.length, 1);
+  const { rate, ...sample } = completion.samples[0];
+  assert.deepStrictEqual(sample, {
+    detail: { index: 0, phase: 'measurement', value: '42' },
+    duration_ns: '4',
+    operations: 2,
+  });
+  assert(Math.abs(rate - 500_000_000) < 1);
+}
+
 for (const { file, status } of [
   { file: 'a.cjs', status: 0 },
   { file: 'error.cjs', status: 1 },
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
new file mode 100644
index 000000000000..ec28923f874f
--- /dev/null
+++ b/test/parallel/test-bench-context-control.js
@@ -0,0 +1,86 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const invocations = [];
+  let closedContext;
+
+  const controlledCompletion = runner.bench('controlled', {
+    samples: 5,
+    warmup: 2,
+  }, common.mustCall((b) => {
+    invocations.push(`${b.phase}:${b.index}`);
+    const detail = { index: b.index, phase: b.phase };
+    b.start();
+    process.hrtime.bigint();
+    const sample = b.end(2, { detail });
+    detail.index = -1;
+
+    assert.strictEqual(sample.operations, 2);
+    assert.strictEqual(typeof sample.duration_ns, 'bigint');
+    assert.strictEqual(sample.rate > 0, true);
+    assert.notStrictEqual(sample.detail, detail);
+    assert.notStrictEqual(sample.detail.index, -1);
+    sample.operations = 0;
+    sample.rate = NaN;
+    sample.detail.index = -2;
+
+    if (b.phase === 'measurement' && b.index === 1) {
+      b.done();
+      closedContext = b;
+    }
+  }, 4));
+
+  const recordedCompletion = runner.bench(
+    'recorded', { samples: 3 }, common.mustCall((b) => {
+      const detail = { source: 'worker', value: 1n };
+      const sample = b.record({
+        __proto__: null,
+        detail,
+        duration_ns: 20n,
+        operations: 5,
+      });
+      detail.source = 'changed';
+      assert.deepStrictEqual(sample, {
+        __proto__: null,
+        detail: { source: 'worker', value: 1n },
+        duration_ns: 20n,
+        operations: 5,
+        rate: 250_000_000,
+      });
+      sample.operations = 0;
+      sample.rate = NaN;
+      sample.detail.source = 'returned value changed';
+      b.done();
+    }));
+
+  const records = await runner.run().toArray();
+  const [controlled, recorded] = await Promise.all([
+    controlledCompletion,
+    recordedCompletion,
+  ]);
+
+  assert.deepStrictEqual(invocations, [
+    'warmup:0',
+    'warmup:1',
+    'measurement:0',
+    'measurement:1',
+  ]);
+  assert.strictEqual(controlled.samples.length, 2);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ operations }) => operations), [2, 2]);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ detail }) => detail.index), [0, 1]);
+  assert.strictEqual(controlled.samples.every(({ rate }) => rate > 0), true);
+  assert.strictEqual(recorded.samples.length, 1);
+  assert.deepStrictEqual(recorded.samples[0].detail,
+                         { source: 'worker', value: 1n });
+  assert.strictEqual(
+    records.filter(({ type }) => type === 'bench:sample').length, 3);
+  assert.throws(() => closedContext.done(), { code: 'ERR_INVALID_STATE' });
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
new file mode 100644
index 000000000000..40aca29bfcc5
--- /dev/null
+++ b/test/parallel/test-bench-context-errors.js
@@ -0,0 +1,82 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('done during warmup', { samples: 1, warmup: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+  b.done();
+});
+runner.bench('invalid record', { samples: 1 }, (b) => b.record(null));
+runner.bench('invalid duration type', { samples: 1 }, (b) => b.record({
+  duration_ns: 1,
+  operations: 1,
+}));
+runner.bench('invalid duration value', { samples: 1 }, (b) => b.record({
+  duration_ns: 0n,
+  operations: 1,
+}));
+runner.bench('duration too large', { samples: 1 }, (b) => b.record({
+  duration_ns: 9_007_199_254_740_992n,
+  operations: 1,
+}));
+runner.bench('invalid operations', { samples: 1 }, (b) => b.record({
+  duration_ns: 1n,
+  operations: 0,
+}));
+runner.bench('mixed timing', { samples: 1 }, (b) => {
+  b.start();
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('duplicate record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('reentrant record', { samples: 1 }, (b) => {
+  const sample = { duration_ns: 1n };
+  Object.defineProperty(sample, 'operations', {
+    get() {
+      b.record({ duration_ns: 1n, operations: 1 });
+      return 1;
+    },
+  });
+  b.record(sample);
+});
+runner.bench('uncloneable detail', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
+});
+
+(async () => {
+  const records = await runner.run().toArray();
+  const completions = records
+    .filter(({ type }) => type === 'bench:complete')
+    .map(({ data }) => data);
+  const byName = new Map(completions.map((result) => [result.name, result]));
+
+  assert.strictEqual(byName.get('done during warmup').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid record').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration type').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration value').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('duration too large').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('invalid operations').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('mixed timing').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('reentrant record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('uncloneable detail').error.name,
+                     'DataCloneError');
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
new file mode 100644
index 000000000000..a8c25533ee63
--- /dev/null
+++ b/test/parallel/test-bench-create-runner.js
@@ -0,0 +1,96 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+(async () => {
+  const first = createRunner({ yieldBetweenSamples: false });
+  const second = createRunner({ yieldBetweenSamples: false });
+  let firstCalls = 0;
+  let secondCalls = 0;
+
+  first.before(common.mustCall());
+  second.before(common.mustCall());
+
+  const firstCompletion = first.bench(
+    'same name', { samples: 2 }, common.mustCall((b) => {
+      firstCalls++;
+      b.start();
+      process.hrtime.bigint();
+      b.end(1);
+    }, 2));
+  const secondCompletion = second.bench(
+    'same name', { samples: 1 }, common.mustCall((b) => {
+      secondCalls++;
+      b.start();
+      process.hrtime.bigint();
+      b.end(1);
+    }));
+
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.strictEqual(firstCalls, 0);
+  assert.strictEqual(secondCalls, 0);
+
+  const firstStream = first.run();
+  const secondStream = second.run();
+  assert.throws(() => first.run(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => first.bench('late', common.mustNotCall()),
+                { code: 'ERR_INVALID_STATE' });
+  const [firstRecords, secondRecords] = await Promise.all([
+    firstStream.toArray(),
+    secondStream.toArray(),
+  ]);
+  const [firstResult, secondResult] = await Promise.all([
+    firstCompletion,
+    secondCompletion,
+  ]);
+
+  assert.strictEqual(firstCalls, 2);
+  assert.strictEqual(secondCalls, 1);
+  assert.strictEqual(firstResult.samples.length, 2);
+  assert.strictEqual(secondResult.samples.length, 1);
+  assert.strictEqual(firstResult.error, undefined);
+  assert.strictEqual(secondResult.error, undefined);
+  assert.strictEqual(
+    firstRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(
+    secondRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(typeof first.bench.skip, 'function');
+  assert.strictEqual(typeof first.bench.only, 'function');
+  assert.strictEqual(first.describe, first.suite);
+
+  const retry = createRunner({ yieldBetweenSamples: false });
+  retry.bench('not filtered', { samples: 1 }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+  assert.throws(() => retry.run({
+    namePattern: 'filtered',
+    samples: 0,
+  }), { code: 'ERR_OUT_OF_RANGE' });
+  const retryRecords = await retry.run().toArray();
+  const retryResult = retryRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(retryResult.skip, undefined);
+  assert.strictEqual(retryResult.samples.length, 1);
+
+  const reentrant = createRunner({ yieldBetweenSamples: false });
+  reentrant.bench('reentrant options', { samples: 1 }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+  const reentrantOptions = {};
+  Object.defineProperty(reentrantOptions, 'samples', {
+    get: common.mustCall(() => reentrant.run()),
+  });
+  assert.throws(() => reentrant.run(reentrantOptions),
+                { code: 'ERR_INVALID_STATE' });
+  const reentrantRecords = await reentrant.run().toArray();
+  const reentrantResult = reentrantRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(reentrantResult.samples.length, 1);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
index d276c4cfa650..cdbaee9e6ee6 100644
--- a/test/parallel/test-bench-validation.js
+++ b/test/parallel/test-bench-validation.js
@@ -3,7 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { bench, run } = require('node:bench');
+const { bench, createRunner, run } = require('node:bench');
 
 const noop = () => {};
 
@@ -35,6 +35,14 @@ assert.throws(() => run({ samples: 0 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => run({ warmup: -1 }),
               { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner(null),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: null }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
 
 bench('valid', { samples: 1 }, (b) => {
   b.start();
diff --git a/test/parallel/test-bench-yield-between-samples.js b/test/parallel/test-bench-yield-between-samples.js
new file mode 100644
index 000000000000..f10ae6a2f6c4
--- /dev/null
+++ b/test/parallel/test-bench-yield-between-samples.js
@@ -0,0 +1,79 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+async function observe(factoryOptions, runOptions) {
+  const runner = createRunner(factoryOptions);
+  const observed = [];
+  let turnOccurred = false;
+  const turn = new Promise((resolve) => setImmediate(() => {
+    turnOccurred = true;
+    resolve();
+  }));
+
+  runner.bench('yielding', { samples: 2 }, (b) => {
+    observed.push(turnOccurred);
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+
+  await runner.run(runOptions).toArray();
+  await turn;
+  return observed;
+}
+
+async function observeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let invocations = 0;
+  const completion = runner.bench('timeout', {
+    samples: 10,
+    timeout: 5,
+  }, (b) => {
+    invocations++;
+    const until = process.hrtime.bigint() + 2_000_000n;
+    b.start();
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+    b.end(1);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(invocations < 10, true);
+}
+
+async function observeAfterEachTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.afterEach(common.mustCall(() => {
+    const until = process.hrtime.bigint() + 10_000_000n;
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+  }));
+  const completion = runner.bench('afterEach timeout', {
+    samples: 1,
+    timeout: 5,
+  }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+}
+
+(async () => {
+  assert.deepStrictEqual(await observe(undefined, undefined), [false, true]);
+  assert.deepStrictEqual(
+    await observe({ yieldBetweenSamples: false }, undefined), [false, false]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: false },
+    { yieldBetweenSamples: true }), [false, true]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: true },
+    { yieldBetweenSamples: false }), [false, false]);
+  await observeTimeout();
+  await observeAfterEachTimeout();
+})().then(common.mustCall());

From edc45f915408b0299be465e17fba749726fa7a2c Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 16:19:13 +0000
Subject: [PATCH 045/202] test: update bench tests to not fail on no-crypto
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 test/parallel/test-bench-cli.js               |  4 +--
 .../test-benchmark-node-bench-tools.js        | 35 ++++++++-----------
 2 files changed, 17 insertions(+), 22 deletions(-)

diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 8ed5afddad67..3180dcfeab12 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -1,6 +1,6 @@
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const { spawnSync } = require('child_process');
 const fs = require('fs');
@@ -236,7 +236,7 @@ for (const isolation of ['process', 'none']) {
                      fixtures.path('bench-runner/ipc.cjs'));
 }
 
-{
+if (common.hasInspector) {
   const result = spawnBench([
     '--inspect=0',
     '--bench-reporter=json',
diff --git a/test/parallel/test-benchmark-node-bench-tools.js b/test/parallel/test-benchmark-node-bench-tools.js
index 84b5f98e9eec..90dd02028de3 100644
--- a/test/parallel/test-benchmark-node-bench-tools.js
+++ b/test/parallel/test-benchmark-node-bench-tools.js
@@ -226,36 +226,31 @@ function run(script, args, options = undefined) {
 }
 
 {
+  const benchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/buffer-compare-offset.js');
+  const nodeBenchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/_buffer-compare-offset.node-bench.js');
   const legacy = run(legacyScatter, [
     '--runs', '1',
-    path.resolve(__dirname, '../../benchmark/crypto/create-hash.js'),
+    benchmark,
   ]);
   const modern = run(scatter, [
     '--runs', '1',
-    '--', path.resolve(
-      __dirname, '../../benchmark/crypto/_create-hash.node-bench.js'),
+    '--', nodeBenchmark,
   ]);
   assert.strictEqual(legacy.status, 0, legacy.stderr);
   assert.strictEqual(modern.status, 0, modern.stderr);
   const legacyLines = legacy.stdout.trim().split('\n');
   const modernLines = modern.stdout.trim().split('\n');
-  assert.strictEqual(legacyLines[0].replaceAll(' ', ''), modernLines[0]);
-  const name = path.join('crypto', 'create-hash.js');
+  assert.deepStrictEqual(
+    legacyLines[0].replaceAll(' ', '').split(',').sort(),
+    modernLines[0].split(',').sort(),
+  );
+  assert.strictEqual(modernLines[0],
+                     '"filename","method","n","size","rate","time"');
+  assert.strictEqual(legacyLines.length, 9);
+  assert.strictEqual(modernLines.length, 9);
+  const name = path.join('buffers', 'buffer-compare-offset.js');
   assert(legacyLines[1].startsWith(`"${name}",`));
   assert(modernLines[1].startsWith(`"${name}",`));
 }
-
-{
-  const result = run(scatter, [
-    '--runs', '1',
-    '--', path.resolve(
-      __dirname,
-      '../../benchmark/buffers/_buffer-compare-offset.node-bench.js',
-    ),
-  ]);
-  assert.strictEqual(result.status, 0, result.stderr);
-  const lines = result.stdout.trim().split('\n');
-  assert.strictEqual(lines[0],
-                     '"filename","method","n","size","rate","time"');
-  assert.strictEqual(lines.length, 9);
-}

From 7f7bbc8ebed6d2f7a1867d714837c21fba66ae2e Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 17:15:51 +0000
Subject: [PATCH 046/202] test: improve node:bench test coverage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 lib/internal/bench_runner/cli.js              |   2 +
 test/fixtures/bench-runner/abrupt-exit.cjs    |  18 ++
 .../bench-runner/destroying-reporter.cjs      |   8 +
 test/fixtures/bench-runner/fake-ipc.cjs       |   3 +
 test/fixtures/bench-runner/inspector.cjs      |  15 ++
 .../bench-runner/malformed-record.cjs         |  15 ++
 test/fixtures/bench-runner/many-records.cjs   |  10 +
 test/fixtures/bench-runner/send-error.cjs     |  17 ++
 test/fixtures/bench-runner/slow-reporter.cjs  |  35 +++
 test/fixtures/bench-runner/throws-null.cjs    |   3 +
 test/fixtures/bench-runner/v8-option.cjs      |  13 ++
 test/parallel/test-bench-cli.js               | 210 +++++++++++++++++-
 test/parallel/test-bench-clock-precision.js   |  22 ++
 test/parallel/test-bench-context-control.js   |   6 +
 test/parallel/test-bench-context-errors.js    |  20 ++
 test/parallel/test-bench-create-runner.js     |   3 +-
 test/parallel/test-bench-errors.js            |   7 +-
 test/parallel/test-bench-harness-errors.js    | 113 ++++++++++
 test/parallel/test-bench-hook-errors.js       |   3 +-
 test/parallel/test-bench-reporters.js         |  62 ++++++
 test/parallel/test-bench-run.js               |   7 +-
 test/parallel/test-bench-validation.js        |  24 ++
 .../test-bench-yield-between-samples.js       |   6 +-
 23 files changed, 603 insertions(+), 19 deletions(-)
 create mode 100644 test/fixtures/bench-runner/abrupt-exit.cjs
 create mode 100644 test/fixtures/bench-runner/destroying-reporter.cjs
 create mode 100644 test/fixtures/bench-runner/fake-ipc.cjs
 create mode 100644 test/fixtures/bench-runner/inspector.cjs
 create mode 100644 test/fixtures/bench-runner/malformed-record.cjs
 create mode 100644 test/fixtures/bench-runner/many-records.cjs
 create mode 100644 test/fixtures/bench-runner/send-error.cjs
 create mode 100644 test/fixtures/bench-runner/slow-reporter.cjs
 create mode 100644 test/fixtures/bench-runner/throws-null.cjs
 create mode 100644 test/fixtures/bench-runner/v8-option.cjs
 create mode 100644 test/parallel/test-bench-clock-precision.js
 create mode 100644 test/parallel/test-bench-harness-errors.js

diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index 5a1bb2cbf3a5..ce54be0e1e22 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -428,6 +428,8 @@ function getChildArgs(path, options) {
     },
   );
   ArrayPrototypePushApply(args, unknownExecArgv);
+  // Option serialization omits port 0, which would otherwise become 9229.
+  if (process.debugPort === 0) ArrayPrototypePush(args, '--inspect-port=0');
   ArrayPrototypePush(args, '--bench', '--bench-isolation=none');
   if (options.namePatternSource.length > 0) {
     ArrayPrototypePush(
diff --git a/test/fixtures/bench-runner/abrupt-exit.cjs b/test/fixtures/bench-runner/abrupt-exit.cjs
new file mode 100644
index 000000000000..04be350b7259
--- /dev/null
+++ b/test/fixtures/bench-runner/abrupt-exit.cjs
@@ -0,0 +1,18 @@
+'use strict';
+
+const mode = process.env.NODE_BENCH_EXIT_MODE;
+
+if (mode === 'code') process.exit(2);
+if (mode === 'signal') process.kill(process.pid, 'SIGTERM');
+
+const { bench } = require('node:bench');
+
+if (mode === 'late') {
+  process.on('beforeExit', () => { process.exitCode = 2; });
+}
+
+bench('abrupt exit', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/destroying-reporter.cjs b/test/fixtures/bench-runner/destroying-reporter.cjs
new file mode 100644
index 000000000000..9e3c04fb1fb0
--- /dev/null
+++ b/test/fixtures/bench-runner/destroying-reporter.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = async function* destroyingReporter(source) {
+  source.once('bench:start', () => {
+    source.destroy(new Error('benchmark reporter closed the stream'));
+  });
+  yield* source;
+};
diff --git a/test/fixtures/bench-runner/fake-ipc.cjs b/test/fixtures/bench-runner/fake-ipc.cjs
new file mode 100644
index 000000000000..7b2afa8dda93
--- /dev/null
+++ b/test/fixtures/bench-runner/fake-ipc.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+process.send = () => {};
diff --git a/test/fixtures/bench-runner/inspector.cjs b/test/fixtures/bench-runner/inspector.cjs
new file mode 100644
index 000000000000..6ea7a71a2264
--- /dev/null
+++ b/test/fixtures/bench-runner/inspector.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+const inspectPort = process.execArgv.filter(
+  (arg) => arg.startsWith('--inspect-port=')).at(-1);
+
+bench('inspector option', {
+  params: { inspectPort },
+  samples: 1,
+}, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
new file mode 100644
index 000000000000..5744bf1ea4b0
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+const common = require('../../common');
+
+const record = process.env.NODE_BENCH_MALFORMED_RECORD === 'summary' ? {
+  type: 'bench:summary',
+  data: {
+    counts: { completed: 0, failed: 0, skipped: 0, total: -1 },
+    duration_ns: 1n,
+    success: true,
+  },
+} : null;
+
+process.send?.({ type: 'node:bench:record', record });
+setTimeout(() => process.exit(2), common.platformTimeout(10_000));
diff --git a/test/fixtures/bench-runner/many-records.cjs b/test/fixtures/bench-runner/many-records.cjs
new file mode 100644
index 000000000000..e841c39458f7
--- /dev/null
+++ b/test/fixtures/bench-runner/many-records.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('many records', { samples: 30 }, (b) => {
+  process.stdout.write(`${b.index}\n`);
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/send-error.cjs b/test/fixtures/bench-runner/send-error.cjs
new file mode 100644
index 000000000000..a647305fca76
--- /dev/null
+++ b/test/fixtures/bench-runner/send-error.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+if (process.env.NODE_BENCH_SEND_ERROR === 'callback') {
+  process.send = (_message, _handle, _options, callback) => {
+    callback(new Error('benchmark send callback failed'));
+  };
+} else {
+  process.send = () => { throw new Error('benchmark send threw'); };
+}
+
+const { bench } = require('node:bench');
+
+bench('send error', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/slow-reporter.cjs b/test/fixtures/bench-runner/slow-reporter.cjs
new file mode 100644
index 000000000000..b5670d28ea70
--- /dev/null
+++ b/test/fixtures/bench-runner/slow-reporter.cjs
@@ -0,0 +1,35 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+
+module.exports = async function* slowReporter(source) {
+  const { promise, resolve } = Promise.withResolvers();
+  let emitted = 0;
+  const onRecord = () => {
+    if (++emitted === source.readableHighWaterMark) resolve();
+  };
+  for (const type of [
+    'bench:start',
+    'bench:sample',
+    'bench:complete',
+    'bench:diagnostic',
+    'bench:summary',
+  ]) {
+    source.on(type, onRecord);
+  }
+  await promise;
+
+  let samples = 0;
+  let stdout = '';
+  for await (const record of source) {
+    await setTimeout(2);
+    if (record.type === 'bench:sample') samples++;
+    if (record.type === 'bench:diagnostic' &&
+        record.data.stream === 'stdout') {
+      stdout += record.data.message;
+    }
+    if (record.type === 'bench:summary') {
+      yield `${JSON.stringify({ samples, stdout })}\n`;
+    }
+  }
+};
diff --git a/test/fixtures/bench-runner/throws-null.cjs b/test/fixtures/bench-runner/throws-null.cjs
new file mode 100644
index 000000000000..562e969ac350
--- /dev/null
+++ b/test/fixtures/bench-runner/throws-null.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+throw null;
diff --git a/test/fixtures/bench-runner/v8-option.cjs b/test/fixtures/bench-runner/v8-option.cjs
new file mode 100644
index 000000000000..a4e60ddf738f
--- /dev/null
+++ b/test/fixtures/bench-runner/v8-option.cjs
@@ -0,0 +1,13 @@
+'use strict';
+
+const assert = require('assert');
+const { bench } = require('node:bench');
+
+assert.strictEqual(Error.stackTraceLimit, 17);
+assert(process.execArgv.includes('--random-seed=17'));
+
+bench('V8 option', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 3180dcfeab12..28dcc8b2dbb7 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -8,15 +8,24 @@ const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 
 const basicPattern = fixtures.path('bench-runner/[ab].*');
+const spawnTimeout = common.platformTimeout(30_000);
 
 tmpdir.refresh();
 
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
 function spawnBench(args, options = undefined) {
-  return spawnSync(process.execPath, [
-    '--no-warnings',
-    '--bench',
-    ...args,
-  ], { __proto__: null, encoding: 'utf8', ...options });
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
 }
 
 function parseRecords(result) {
@@ -42,6 +51,42 @@ function parseOutput(output) {
   assert.match(result.stderr, /^Could not find/);
 }
 
+if (common.canCreateSymLink()) {
+  const dangling = tmpdir.resolve('dangling.cjs');
+  fs.symlinkSync(tmpdir.resolve('missing.cjs'), dangling);
+  const result = spawnBench([dangling]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+for (const { patterns, message } of [
+  {
+    patterns: [
+      fixtures.path('bench-runner/a.cjs'),
+      fixtures.path('bench-runner/b.mjs'),
+    ],
+    message: /benchmark child process requires exactly one file/,
+  },
+  {
+    patterns: [fixtures.path('bench-runner/missing.cjs')],
+    message: /^Could not find/,
+  },
+]) {
+  const result = spawnNode([
+    '--no-warnings',
+    '--require', fixtures.path('bench-runner/fake-ipc.cjs'),
+    '--bench',
+    ...patterns,
+  ], {
+    __proto__: null,
+    env: { __proto__: null, ...process.env, NODE_BENCH_CONTEXT: 'child' },
+  });
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, message);
+}
+
 {
   const result = spawnBench(['--bench-reporter=json', basicPattern]);
   assert.strictEqual(result.status, 0);
@@ -145,6 +190,20 @@ function parseOutput(output) {
   assert.strictEqual(records.at(-1).data.success, false);
 }
 
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/throws-null.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.message, 'null');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
 {
   const result = spawnBench([
     '--bench-reporter=json',
@@ -236,11 +295,89 @@ for (const isolation of ['process', 'none']) {
                      fixtures.path('bench-runner/ipc.cjs'));
 }
 
+for (const { kind, message } of [
+  { kind: 'record', message: /not a valid benchmark record/ },
+  { kind: 'summary', message: /not a valid benchmark summary/ },
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-record.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_MALFORMED_RECORD: kind,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+for (const { mode, message } of [
+  { mode: 'code', message: /failed with exit code 2/ },
+  { mode: 'late', message: /failed with exit code 2/ },
+  ...common.isWindows ? [] : [
+    { mode: 'signal', message: /failed with signal SIGTERM/ },
+  ],
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/abrupt-exit.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_EXIT_MODE: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+}
+
+for (const mode of ['callback', 'throw']) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/send-error.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_SEND_ERROR: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const messages = diagnostics.map(({ data }) => data.message).join('');
+  assert.match(messages, /benchmark send/);
+}
+
+{
+  const result = spawnBench([
+    '--stack-trace-limit=17',
+    '--random-seed=17',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/v8-option.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'V8 option');
+}
+
 if (common.hasInspector) {
   const result = spawnBench([
     '--inspect=0',
     '--bench-reporter=json',
-    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/inspector.cjs'),
   ]);
   assert.strictEqual(result.status, 0);
   const records = parseRecords(result);
@@ -248,6 +385,9 @@ if (common.hasInspector) {
     ({ type }) => type === 'bench:diagnostic')
     .map(({ data }) => data.message).join('');
   assert.match(diagnostics, /Debugger listening on ws:\/\//);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.params.inspectPort, '--inspect-port=0');
 }
 
 {
@@ -307,6 +447,40 @@ if (common.hasInspector) {
   assert.match(result.stderr, /benchmark reporter failed/);
 }
 
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/slow-reporter.cjs')}`,
+    fixtures.path('bench-runner/many-records.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const report = JSON.parse(result.stdout);
+  assert.strictEqual(report.samples, 30);
+  assert.strictEqual(report.stdout,
+                     Array.from({ length: 30 }, (_, i) => `${i}\n`).join(''));
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/destroying-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter closed the stream/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=data:text/javascript,export default 0',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /is not a valid reporter/);
+}
+
 {
   const result = spawnBench([
     '--bench-reporter=json',
@@ -318,11 +492,11 @@ if (common.hasInspector) {
 }
 
 {
-  const result = spawnSync(process.execPath, [
+  const result = spawnNode([
     '--no-warnings',
     `--experimental-config-file=${fixtures.path('bench-runner/node.config.json')}`,
     fixtures.path('bench-runner/a.cjs'),
-  ], { __proto__: null, encoding: 'utf8' });
+  ]);
   assert.strictEqual(result.status, 0);
   const records = parseRecords(result);
   assert.strictEqual(records.find(
@@ -385,6 +559,26 @@ for (const { args, message } of [
     args: ['--bench-warmup=abc', 'unused.js'],
     message: /invalid value for --bench-warmup/,
   },
+  {
+    args: ['--bench-name-pattern=[', 'unused.js'],
+    message: /invalid regular expression/,
+  },
+  {
+    args: ['--eval=1', 'unused.js'],
+    message: /either --bench or --eval can be used, not both/,
+  },
+  {
+    args: ['--interactive', 'unused.js'],
+    message: /either --bench or --interactive can be used, not both/,
+  },
+  {
+    args: ['--watch', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--watch-path=.', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
   {
     args: ['--check', 'unused.js'],
     message: /either --bench or --check can be used, not both/,
diff --git a/test/parallel/test-bench-clock-precision.js b/test/parallel/test-bench-clock-precision.js
new file mode 100644
index 000000000000..93158e51319b
--- /dev/null
+++ b/test/parallel/test-bench-clock-precision.js
@@ -0,0 +1,22 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const originalHrtimeBigint = process.hrtime.bigint;
+process.hrtime.bigint = () => 1n;
+const { bench, run } = require('node:bench');
+process.hrtime.bigint = originalHrtimeBigint;
+
+const completion = bench('zero duration', { samples: 1 }, (b) => {
+  b.start();
+  b.end(1);
+});
+
+(async () => {
+  await run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_INVALID_STATE');
+  assert.match(result.error.message, /insufficient clock precision/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
index ec28923f874f..b9adb9f2f9f1 100644
--- a/test/parallel/test-bench-context-control.js
+++ b/test/parallel/test-bench-context-control.js
@@ -82,5 +82,11 @@ const { createRunner } = require('node:bench');
                          { source: 'worker', value: 1n });
   assert.strictEqual(
     records.filter(({ type }) => type === 'bench:sample').length, 3);
+  assert.throws(() => closedContext.start(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.end(1), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.record({
+    duration_ns: 1n,
+    operations: 1,
+  }), { code: 'ERR_INVALID_STATE' });
   assert.throws(() => closedContext.done(), { code: 'ERR_INVALID_STATE' });
 })().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
index 40aca29bfcc5..072b9b3e2a9d 100644
--- a/test/parallel/test-bench-context-errors.js
+++ b/test/parallel/test-bench-context-errors.js
@@ -34,6 +34,14 @@ runner.bench('mixed timing', { samples: 1 }, (b) => {
   b.start();
   b.record({ duration_ns: 1n, operations: 1 });
 });
+runner.bench('start after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.start();
+});
+runner.bench('end after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.end(1);
+});
 runner.bench('duplicate record', { samples: 1 }, (b) => {
   b.record({ duration_ns: 1n, operations: 1 });
   b.record({ duration_ns: 1n, operations: 1 });
@@ -51,6 +59,12 @@ runner.bench('reentrant record', { samples: 1 }, (b) => {
 runner.bench('uncloneable detail', { samples: 1 }, (b) => {
   b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
 });
+runner.bench('caught contract violation', { samples: 1 },
+             common.mustCall((b) => {
+               b.start();
+               assert.throws(() => b.start(), { code: 'ERR_INVALID_STATE' });
+               b.end(1);
+             }));
 
 (async () => {
   const records = await runner.run().toArray();
@@ -73,10 +87,16 @@ runner.bench('uncloneable detail', { samples: 1 }, (b) => {
                      'ERR_OUT_OF_RANGE');
   assert.strictEqual(byName.get('mixed timing').error.code,
                      'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('start after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('end after record').error.code,
+                     'ERR_INVALID_STATE');
   assert.strictEqual(byName.get('duplicate record').error.code,
                      'ERR_INVALID_STATE');
   assert.strictEqual(byName.get('reentrant record').error.code,
                      'ERR_INVALID_STATE');
   assert.strictEqual(byName.get('uncloneable detail').error.name,
                      'DataCloneError');
+  assert.match(byName.get('caught contract violation').error.message,
+               /violated the start\(\)\/end\(\) contract/);
 })().then(common.mustCall());
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
index a8c25533ee63..a7194d002d55 100644
--- a/test/parallel/test-bench-create-runner.js
+++ b/test/parallel/test-bench-create-runner.js
@@ -4,6 +4,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
 
 (async () => {
   const first = createRunner({ yieldBetweenSamples: false });
@@ -29,7 +30,7 @@ const { createRunner } = require('node:bench');
       b.end(1);
     }));
 
-  await new Promise((resolve) => setImmediate(resolve));
+  await setImmediate();
   assert.strictEqual(firstCalls, 0);
   assert.strictEqual(secondCalls, 0);
 
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
index 7a6f7aec7e16..b0774965a26f 100644
--- a/test/parallel/test-bench-errors.js
+++ b/test/parallel/test-bench-errors.js
@@ -4,6 +4,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { bench, run } = require('node:bench');
+const { setTimeout } = require('timers/promises');
 
 const options = { samples: 1 };
 
@@ -31,7 +32,7 @@ bench('timeout', { samples: 1, timeout: 10 }, async () => {
 });
 bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
   b.start();
-  await new Promise((resolve) => setTimeout(resolve, 30));
+  await setTimeout(30);
   b.end(1);
 });
 
@@ -97,8 +98,8 @@ stream.on('end', common.mustCall(() => {
   assert.strictEqual(duplicates[0].error, undefined);
   assert.match(duplicates[1].error.message, /duplicate benchmark identity/);
   assert.strictEqual(byName.get('continues')[0].error, undefined);
-  setTimeout(common.mustCall(() => {
+  setTimeout(40).then(common.mustCall(() => {
     assert.strictEqual(sampleNames.includes('late timeout'), false);
-  }), 40);
+  }));
 }));
 stream.resume();
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
new file mode 100644
index 000000000000..3e4ebefd2ebf
--- /dev/null
+++ b/test/parallel/test-bench-harness-errors.js
@@ -0,0 +1,113 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+function complete(b) {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+}
+
+async function testSynchronousSuiteFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.suite('outer', () => {
+    runner.suite('nested', () => {
+      runner.bench('blocked', { samples: 1 }, common.mustNotCall());
+    });
+    throw new Error('synchronous suite failure');
+  });
+  const records = await runner.run().toArray();
+  await completion;
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.name, 'blocked');
+  assert.strictEqual(result.error.message, 'synchronous suite failure');
+}
+
+async function testRunSignal() {
+  const runner = createRunner();
+  const controller = new AbortController();
+  let invocations = 0;
+  let abortPromise;
+  const completion = runner.bench('aborted between samples', {
+    samples: 3,
+  }, (b) => {
+    invocations++;
+    complete(b);
+    if (b.index === 0) {
+      abortPromise = setImmediate().then(() => {
+        controller.abort(new Error('run aborted'));
+      });
+    }
+  });
+  await runner.run({ signal: controller.signal }).toArray();
+  const result = await completion;
+  await abortPromise;
+  await setImmediate();
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause.message, 'run aborted');
+  assert.strictEqual(invocations, 1);
+}
+
+async function testRunSignalAfterSample() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const controller = new AbortController();
+  const completion = runner.bench('aborted after sample', {
+    samples: 1,
+  }, (b) => {
+    complete(b);
+    controller.abort(new Error('sample aborted'));
+  });
+  await runner.run({ signal: controller.signal }).toArray();
+  const result = await completion;
+  await setImmediate();
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause.message, 'sample aborted');
+}
+
+async function testStringNamePattern() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('included', { samples: 1 }, complete);
+  runner.bench('excluded', { samples: 1 }, common.mustNotCall());
+  const records = await runner.run({ namePattern: 'included' }).toArray();
+  const excluded = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'excluded').data;
+  const included = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'included').data;
+  assert.strictEqual(included.error, undefined);
+  assert.strictEqual(included.samples.length, 1);
+  assert.strictEqual(excluded.skip, 'name pattern');
+}
+
+async function testTopLevelRecovery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('listener failure', { samples: 1 }, complete);
+  const stream = runner.run();
+  const failure = new Error();
+  failure.message = undefined;
+  stream.on('bench:start', common.mustCall(() => { throw failure; }));
+  const records = await stream.toArray();
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const summary = records.find(({ type }) => type === 'bench:summary').data;
+  assert.strictEqual(diagnostic.message, 'Error');
+  assert.strictEqual(diagnostic.file, undefined);
+  assert.strictEqual(diagnostic.line, undefined);
+  assert.strictEqual(diagnostic.column, undefined);
+  assert.strictEqual(summary.duration_ns, 0n);
+  assert.strictEqual(summary.success, false);
+}
+
+(async () => {
+  await testSynchronousSuiteFailure();
+  await testRunSignal();
+  await testRunSignalAfterSample();
+  await testStringNamePattern();
+  await testTopLevelRecovery();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-hook-errors.js b/test/parallel/test-bench-hook-errors.js
index 72de600b8abd..c4615419674a 100644
--- a/test/parallel/test-bench-hook-errors.js
+++ b/test/parallel/test-bench-hook-errors.js
@@ -3,6 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
+const { setImmediate } = require('timers/promises');
 const {
   after,
   afterEach,
@@ -37,7 +38,7 @@ suite('after failure', () => {
 });
 
 suite('build failure', async () => {
-  await new Promise((resolve) => setImmediate(resolve));
+  await setImmediate();
   throw new Error('build failure');
 });
 
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
index c5a3b0000e9c..ed6039d9da3a 100644
--- a/test/parallel/test-bench-reporters.js
+++ b/test/parallel/test-bench-reporters.js
@@ -111,4 +111,66 @@ bench('json failed', { samples: 1 }, () => {
                      'broken | 0 | - | - | - | error: boom\n' +
                      'diagnostic: suite problem\n\n' +
                      '1 completed, 1 failed, 1 skipped\n');
+
+  const circular = {};
+  circular.self = circular;
+  const aggregate = new AggregateError([1n], 'aggregate failure');
+  const jsonEdgeChunks = await Readable.from([{
+    type: 'bench:diagnostic',
+    data: { aggregate, circular },
+  }]).compose(json).toArray();
+  const jsonEdge = JSON.parse(jsonEdgeChunks.join(''));
+  assert.deepStrictEqual(jsonEdge.data.aggregate.errors, ['1']);
+  assert.strictEqual(jsonEdge.data.circular.self, '[Circular]');
+
+  async function* undefinedRecord() {
+    yield undefined;
+  }
+  const undefinedChunks = [];
+  for await (const chunk of json(undefinedRecord())) {
+    undefinedChunks.push(chunk);
+  }
+  assert.strictEqual(undefinedChunks.join(''), 'null\n');
+
+  function result(name, rate) {
+    return {
+      type: 'bench:complete',
+      data: {
+        name,
+        params: {},
+        samples: [{}],
+        summary: {
+          mean: rate,
+          median: rate,
+          coefficientOfVariation: 0,
+          confidenceInterval: { lower: rate, upper: rate },
+          skewness: 0,
+        },
+      },
+    };
+  }
+
+  const specEdgeChunks = await Readable.from([
+    result('giga', 1_500_000_000),
+    result('mega', 1_500_000),
+    result('fractional', 0.5),
+    {
+      type: 'bench:complete',
+      data: { name: 'skip', params: {}, samples: [], skip: true },
+    },
+    {
+      type: 'bench:complete',
+      data: { name: 'error', params: {}, samples: [], error: 'failure' },
+    },
+  ]).compose(spec).toArray();
+  const specEdgeOutput = specEdgeChunks.join('');
+  assert.match(specEdgeOutput, /giga \| 1 \| 1\.50G ops\/s/);
+  assert.match(specEdgeOutput, /mega \| 1 \| 1\.50M ops\/s/);
+  assert.match(specEdgeOutput, /fractional \| 1 \| 0\.500 ops\/s/);
+  assert.match(specEdgeOutput, /skip \| 0 \| - \| - \| - \| skipped\n/);
+  assert.match(specEdgeOutput,
+               /error \| 0 \| - \| - \| - \| error: failure/);
+
+  const emptySpecChunks = await Readable.from([]).compose(spec).toArray();
+  assert.deepStrictEqual(emptySpecChunks, []);
 })().then(common.mustCall());
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
index fafc9e3309ad..5b7edb4e6418 100644
--- a/test/parallel/test-bench-run.js
+++ b/test/parallel/test-bench-run.js
@@ -3,6 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
+const { setImmediate } = require('timers/promises');
 const {
   after,
   afterEach,
@@ -23,7 +24,7 @@ beforeEach(() => calls.push('root beforeEach'));
 afterEach(() => calls.push('root afterEach'));
 
 const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
-  await new Promise((resolve) => setImmediate(resolve));
+  await setImmediate();
 
   before(() => calls.push('suite before'));
   after(() => calls.push('suite after'));
@@ -52,11 +53,11 @@ const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
     active = true;
     contexts.add(b);
     calls.push('async sample');
-    await new Promise((resolve) => setImmediate(resolve));
+    await setImmediate();
     b.start();
     process.hrtime.bigint();
     b.end(1);
-    await new Promise((resolve) => setImmediate(resolve));
+    await setImmediate();
     active = false;
   }, 2));
 
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
index cdbaee9e6ee6..7071dd2d915f 100644
--- a/test/parallel/test-bench-validation.js
+++ b/test/parallel/test-bench-validation.js
@@ -6,6 +6,23 @@ const assert = require('assert');
 const { bench, createRunner, run } = require('node:bench');
 
 const noop = () => {};
+let functionOverloadCalls = 0;
+let objectOverloadCalls = 0;
+
+function functionOverload(b) {
+  functionOverloadCalls++;
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+  b.done();
+}
+
+function objectOverload(b) {
+  objectOverloadCalls++;
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+}
 
 assert.throws(() => bench('', noop), { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => bench('name', null), { code: 'ERR_INVALID_ARG_TYPE' });
@@ -44,6 +61,9 @@ assert.throws(() => createRunner({ yieldBetweenSamples: 1 }),
 assert.throws(() => createRunner({ yieldBetweenSamples: null }),
               { code: 'ERR_INVALID_ARG_TYPE' });
 
+bench(functionOverload);
+bench({ samples: 1 }, objectOverload);
+
 bench('valid', { samples: 1 }, (b) => {
   b.start();
   process.hrtime.bigint();
@@ -53,5 +73,9 @@ bench('valid', { samples: 1 }, (b) => {
 const stream = run();
 stream.on('bench:start', common.mustCall(() => {
   assert.throws(() => bench('late', noop), { code: 'ERR_INVALID_STATE' });
+}, 3));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(functionOverloadCalls, 1);
+  assert.strictEqual(objectOverloadCalls, 1);
 }));
 stream.resume();
diff --git a/test/parallel/test-bench-yield-between-samples.js b/test/parallel/test-bench-yield-between-samples.js
index f10ae6a2f6c4..7d08318a027a 100644
--- a/test/parallel/test-bench-yield-between-samples.js
+++ b/test/parallel/test-bench-yield-between-samples.js
@@ -4,15 +4,15 @@
 const common = require('../common');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
 
 async function observe(factoryOptions, runOptions) {
   const runner = createRunner(factoryOptions);
   const observed = [];
   let turnOccurred = false;
-  const turn = new Promise((resolve) => setImmediate(() => {
+  const turn = setImmediate().then(() => {
     turnOccurred = true;
-    resolve();
-  }));
+  });
 
   runner.bench('yielding', { samples: 2 }, (b) => {
     observed.push(turnOccurred);

From f3750c1c281b14e267d1392e0d6828ad3a50e2aa Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 20:11:50 +0000
Subject: [PATCH 047/202] test: fix node:bench test timing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65606
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 test/fixtures/bench-runner/a.cjs                    | 4 +---
 test/fixtures/bench-runner/abrupt-exit.cjs          | 4 +---
 test/fixtures/bench-runner/b.mjs                    | 4 +---
 test/fixtures/bench-runner/exit-code.cjs            | 4 +---
 test/fixtures/bench-runner/imported.cjs             | 4 +---
 test/fixtures/bench-runner/inspector.cjs            | 4 +---
 test/fixtures/bench-runner/ipc.cjs                  | 4 +---
 test/fixtures/bench-runner/many-records.cjs         | 4 +---
 test/fixtures/bench-runner/options.cjs              | 4 +---
 test/fixtures/bench-runner/output.cjs               | 4 +---
 test/fixtures/bench-runner/preloaded.cjs            | 4 +---
 test/fixtures/bench-runner/run.cjs                  | 4 +---
 test/fixtures/bench-runner/send-error.cjs           | 4 +---
 test/fixtures/bench-runner/tools-collision.cjs      | 4 +---
 test/fixtures/bench-runner/tools-no-params.cjs      | 4 +---
 test/fixtures/bench-runner/tools-reserved-param.cjs | 4 +---
 test/fixtures/bench-runner/v8-option.cjs            | 4 +---
 test/parallel/test-bench-auto-run.js                | 4 +---
 18 files changed, 18 insertions(+), 54 deletions(-)

diff --git a/test/fixtures/bench-runner/a.cjs b/test/fixtures/bench-runner/a.cjs
index 54d6bb6c4a0d..3edaf85ad856 100644
--- a/test/fixtures/bench-runner/a.cjs
+++ b/test/fixtures/bench-runner/a.cjs
@@ -6,7 +6,5 @@ bench('alpha', {
   params: { file: 'a', pid: process.pid },
   samples: 1,
 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/abrupt-exit.cjs b/test/fixtures/bench-runner/abrupt-exit.cjs
index 04be350b7259..3489f424b8da 100644
--- a/test/fixtures/bench-runner/abrupt-exit.cjs
+++ b/test/fixtures/bench-runner/abrupt-exit.cjs
@@ -12,7 +12,5 @@ if (mode === 'late') {
 }
 
 bench('abrupt exit', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/b.mjs b/test/fixtures/bench-runner/b.mjs
index e82e3899f818..ca35178ecf79 100644
--- a/test/fixtures/bench-runner/b.mjs
+++ b/test/fixtures/bench-runner/b.mjs
@@ -4,7 +4,5 @@ bench('beta', {
   params: { file: 'b', pid: process.pid },
   samples: 1,
 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/exit-code.cjs b/test/fixtures/bench-runner/exit-code.cjs
index b687d1a46163..67f065fea7eb 100644
--- a/test/fixtures/bench-runner/exit-code.cjs
+++ b/test/fixtures/bench-runner/exit-code.cjs
@@ -3,8 +3,6 @@
 const { bench } = require('node:bench');
 
 bench('sets exit code', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
   process.exitCode = 2;
 });
diff --git a/test/fixtures/bench-runner/imported.cjs b/test/fixtures/bench-runner/imported.cjs
index 599be715c028..9a5fb24bb33d 100644
--- a/test/fixtures/bench-runner/imported.cjs
+++ b/test/fixtures/bench-runner/imported.cjs
@@ -6,7 +6,5 @@ bench('imported', {
   samples: 1,
   params: { imported: globalThis.benchImport },
 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/inspector.cjs b/test/fixtures/bench-runner/inspector.cjs
index 6ea7a71a2264..d357b54f864e 100644
--- a/test/fixtures/bench-runner/inspector.cjs
+++ b/test/fixtures/bench-runner/inspector.cjs
@@ -9,7 +9,5 @@ bench('inspector option', {
   params: { inspectPort },
   samples: 1,
 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/ipc.cjs b/test/fixtures/bench-runner/ipc.cjs
index e1fbca0beb98..e6b9ceb49823 100644
--- a/test/fixtures/bench-runner/ipc.cjs
+++ b/test/fixtures/bench-runner/ipc.cjs
@@ -5,7 +5,5 @@ const { bench } = require('node:bench');
 process.send?.({ type: 'user-message' });
 
 bench('user IPC', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/many-records.cjs b/test/fixtures/bench-runner/many-records.cjs
index e841c39458f7..aacb17821035 100644
--- a/test/fixtures/bench-runner/many-records.cjs
+++ b/test/fixtures/bench-runner/many-records.cjs
@@ -4,7 +4,5 @@ const { bench } = require('node:bench');
 
 bench('many records', { samples: 30 }, (b) => {
   process.stdout.write(`${b.index}\n`);
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/options.cjs b/test/fixtures/bench-runner/options.cjs
index 17e5cc92943b..e9a1bcde9af3 100644
--- a/test/fixtures/bench-runner/options.cjs
+++ b/test/fixtures/bench-runner/options.cjs
@@ -9,9 +9,7 @@ bench('selected', {
   warmup: 8,
 }, (b) => {
   invocations++;
-  b.start();
-  process.hrtime.bigint();
-  b.end(invocations);
+  b.record({ duration_ns: 1n, operations: invocations });
 });
 
 bench('filtered out', { samples: 1 }, () => {
diff --git a/test/fixtures/bench-runner/output.cjs b/test/fixtures/bench-runner/output.cjs
index 3dd9f96e5493..3500f2a23383 100644
--- a/test/fixtures/bench-runner/output.cjs
+++ b/test/fixtures/bench-runner/output.cjs
@@ -6,7 +6,5 @@ process.stdout.write('benchmark stdout\n');
 process.stderr.write('benchmark stderr\n');
 
 bench('output', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/preloaded.cjs b/test/fixtures/bench-runner/preloaded.cjs
index 4e3b88c62009..b141b49e9695 100644
--- a/test/fixtures/bench-runner/preloaded.cjs
+++ b/test/fixtures/bench-runner/preloaded.cjs
@@ -10,7 +10,5 @@ bench('preloaded', {
   params: { preloaded: true },
   samples: 1,
 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/run.cjs b/test/fixtures/bench-runner/run.cjs
index 197ce8b55c36..4064dc1c9797 100644
--- a/test/fixtures/bench-runner/run.cjs
+++ b/test/fixtures/bench-runner/run.cjs
@@ -3,9 +3,7 @@
 const { bench, run } = require('node:bench');
 
 bench('declared before run', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
 
 run();
diff --git a/test/fixtures/bench-runner/send-error.cjs b/test/fixtures/bench-runner/send-error.cjs
index a647305fca76..9e1df941dfeb 100644
--- a/test/fixtures/bench-runner/send-error.cjs
+++ b/test/fixtures/bench-runner/send-error.cjs
@@ -11,7 +11,5 @@ if (process.env.NODE_BENCH_SEND_ERROR === 'callback') {
 const { bench } = require('node:bench');
 
 bench('send error', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/tools-collision.cjs b/test/fixtures/bench-runner/tools-collision.cjs
index 5fb27dd956d7..40ab0a4d4a50 100644
--- a/test/fixtures/bench-runner/tools-collision.cjs
+++ b/test/fixtures/bench-runner/tools-collision.cjs
@@ -4,9 +4,7 @@ const { bench, suite } = require('node:bench');
 
 function register(name) {
   bench(name, { params: { size: 1 } }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    b.record({ duration_ns: 1n, operations: 1 });
   });
 }
 
diff --git a/test/fixtures/bench-runner/tools-no-params.cjs b/test/fixtures/bench-runner/tools-no-params.cjs
index 2dde0c2a0c69..182a7886286e 100644
--- a/test/fixtures/bench-runner/tools-no-params.cjs
+++ b/test/fixtures/bench-runner/tools-no-params.cjs
@@ -3,7 +3,5 @@
 const { bench } = require('node:bench');
 
 bench('tools/no-params.js', (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/tools-reserved-param.cjs b/test/fixtures/bench-runner/tools-reserved-param.cjs
index 00052b0c8e4b..8084d6c33f81 100644
--- a/test/fixtures/bench-runner/tools-reserved-param.cjs
+++ b/test/fixtures/bench-runner/tools-reserved-param.cjs
@@ -3,7 +3,5 @@
 const { bench } = require('node:bench');
 
 bench('tools/reserved.js', { params: { rate: 'parameter' } }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/fixtures/bench-runner/v8-option.cjs b/test/fixtures/bench-runner/v8-option.cjs
index a4e60ddf738f..833024161c50 100644
--- a/test/fixtures/bench-runner/v8-option.cjs
+++ b/test/fixtures/bench-runner/v8-option.cjs
@@ -7,7 +7,5 @@ assert.strictEqual(Error.stackTraceLimit, 17);
 assert(process.execArgv.includes('--random-seed=17'));
 
 bench('V8 option', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/parallel/test-bench-auto-run.js b/test/parallel/test-bench-auto-run.js
index ed02fed9340a..6baf7b327cdc 100644
--- a/test/parallel/test-bench-auto-run.js
+++ b/test/parallel/test-bench-auto-run.js
@@ -14,9 +14,7 @@ const child = spawnSync(process.execPath, [
 assert.strictEqual(child.status, 1);
 
 const completion = bench('automatic execution', common.mustCall((b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  b.record({ duration_ns: 1n, operations: 1 });
 }, 30));
 
 completion.then(common.mustCall((result) => {

From c6ab55ca48d51ede3234626d2351f8e29e5210df Mon Sep 17 00:00:00 2001
From: Stewart X Addison <6487691+sxa@users.noreply.github.com>
Date: Thu, 3 Sep 2026 16:56:30 +0100
Subject: [PATCH 048/202] build: activate correct default flags for riscv64

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/65708
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 common.gypi              | 8 ++++++++
 tools/v8_gypfiles/v8.gyp | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/common.gypi b/common.gypi
index a982da03f78b..5aef7768323c 100644
--- a/common.gypi
+++ b/common.gypi
@@ -611,6 +611,10 @@
                 'cflags': [ '-m64', '-march=z14' ],
                 'ldflags': [ '-m64', '-march=z14' ],
               }],
+              [ 'host_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
           ['_toolset=="target"', {
@@ -636,6 +640,10 @@
                 'cflags': [ '-m64', '-march=z14' ],
                 'ldflags': [ '-m64', '-march=z14' ],
               }],
+              [ 'target_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
         ],
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 32fc99e2af9f..7c7ebc8af42a 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -2485,6 +2485,9 @@
         ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
           'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
         }],
+        ['v8_target_arch=="riscv64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
+        }],
       ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',

From 0947809aac26f49b76865ff5c00ac3639b0155d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Jos=C3=A9?= <soyjuanarbol@gmail.com>
Date: Thu, 3 Sep 2026 10:57:18 -0500
Subject: [PATCH 049/202] doc: update `changelog-maker` instructions for
 releasing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `changelog-maker` v5 removed the `--markdown` option, docs should
reflect that.

Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65707
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/contributing/releases.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index c214f8c97cc5..57bf2dc31bf8 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -460,7 +460,7 @@ Collect a formatted list of commits since the last release. Use
 [`changelog-maker`](https://github.com/nodejs/changelog-maker) to do this:
 
 ```bash
-changelog-maker --group --markdown
+changelog-maker --group --format=markdown
 ```
 
 `changelog-maker` counts commits since the last tag and if the last tag
@@ -468,7 +468,7 @@ in the repository was not on the current branch you may have to supply a
 `--start-ref` argument:
 
 ```bash
-changelog-maker --group --markdown --filter-release --start-ref v1.2.2
+changelog-maker --group --format=markdown --filter-release --start-ref v1.2.2
 ```
 
 `--filter-release` will remove the release commit from the previous release.

From 761e49e3c85d5658867aaa1c9ca13985e09dc96f Mon Sep 17 00:00:00 2001
From: Stewart X Addison <6487691+sxa@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:22:34 +0100
Subject: [PATCH 050/202] build: skip dockit on riscv64

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/62251
Reviewed-By: Richard Lau <richard.lau@ibm.com>
---
 Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Makefile b/Makefile
index df31980e4fc6..62a9bc34e93e 100644
--- a/Makefile
+++ b/Makefile
@@ -882,6 +882,11 @@ else ifeq ($(OSTYPE),os400)
 # TODO(@nodejs/web-infra): IBMi is currently hanging during HTML minification
 $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json:
 	@echo "Skipping $@ (not currently supported by $(OSTYPE) machines)"
+else ifeq ($(ARCHTYPE),riscv64)
+# Many riscv64 environments (except qemu) fail on the wasm steps here
+# https://github.com/nodejs/build/issues/4099#issuecomment-4038743335
+$(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json:
+	@echo "Skipping $@ (not currently supported by $(DESTCPU) machines)"
 else
 $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json &: $(apidoc_sources) tools/doc/node_modules | out/doc/api
 	@if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \

From 11977abf2b0ad7115996140aa23f8398a69e2aeb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:54:50 +0000
Subject: [PATCH 051/202] meta: bump github/codeql-action/analyze from 4.37.3
 to 4.37.9

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65723
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 23084c68ac5e..3cfb48d1fee4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,6 +37,6 @@ jobs:
         uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: /language:${{matrix.language}}

From 49d41015284957575e7ce6f3436f2c958c365cda Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:55:04 +0000
Subject: [PATCH 052/202] meta: bump github/codeql-action/upload-sarif from
 4.37.3 to 4.37.9

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65722
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f84c91e1a381..f7edc013a0f9 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: results.sarif

From 5cb19602e96edb50e5c2161500848561df156f65 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:55:25 +0000
Subject: [PATCH 053/202] meta: bump step-security/harden-runner from 2.20.0 to
 2.21.0

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.20.0 to 2.21.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...05e31511f85b41b11d1cf0ef85d0992719546e2c)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65721
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f7edc013a0f9..d0ebd5fc2f40 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 

From 5155a99d06ac404e1eab8800f19265bfdb0cf7b6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:55:38 +0000
Subject: [PATCH 054/202] meta: bump actions/setup-node from 6.4.0 to 7.0.0

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65720
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .github/workflows/auto-start-ci.yml               | 2 +-
 .github/workflows/commit-lint.yml                 | 2 +-
 .github/workflows/commit-queue.yml                | 2 +-
 .github/workflows/create-release-proposal.yml     | 2 +-
 .github/workflows/daily-wpt-fyi.yml               | 2 +-
 .github/workflows/daily.yml                       | 2 +-
 .github/workflows/doc.yml                         | 2 +-
 .github/workflows/find-inactive-collaborators.yml | 2 +-
 .github/workflows/find-inactive-tsc.yml           | 2 +-
 .github/workflows/linters.yml                     | 6 +++---
 .github/workflows/notify-on-push.yml              | 2 +-
 .github/workflows/update-v8.yml                   | 2 +-
 .github/workflows/update-wpt.yml                  | 2 +-
 13 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 271bcfc13fa8..8c01b0592c2e 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 896340ba3a82..389396d364c8 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
       - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commit message
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 4deb0d72b133..4037554f6d70 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
index 883bb48b0df2..0782a6e9a9e2 100644
--- a/.github/workflows/create-release-proposal.yml
+++ b/.github/workflows/create-release-proposal.yml
@@ -40,7 +40,7 @@ jobs:
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 8dda0ff75d6e..5becd70c71a0 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -50,7 +50,7 @@ jobs:
         run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-arm64"))][0].version')" >> $GITHUB_ENV
       - name: Install Node.js
         id: setup-node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NIGHTLY || matrix.node-version }}
           check-latest: true
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 6c4b2ec9a4be..46af9ae4555c 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build lto
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 6e5dfe732646..24a211b539dd 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -28,7 +28,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build
diff --git a/.github/workflows/find-inactive-collaborators.yml b/.github/workflows/find-inactive-collaborators.yml
index e6e0c7f54f69..5f780458a0f1 100644
--- a/.github/workflows/find-inactive-collaborators.yml
+++ b/.github/workflows/find-inactive-collaborators.yml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/find-inactive-tsc.yml b/.github/workflows/find-inactive-tsc.yml
index c1804b78d378..52f4960c49ea 100644
--- a/.github/workflows/find-inactive-tsc.yml
+++ b/.github/workflows/find-inactive-tsc.yml
@@ -34,7 +34,7 @@ jobs:
           repository: nodejs/TSC
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index 6917eb995c9e..fcb7b081fc5d 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint addon docs
@@ -57,7 +57,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -93,7 +93,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint JavaScript files
diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index 3c7b21752138..16bd91bccd2a 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commits
diff --git a/.github/workflows/update-v8.yml b/.github/workflows/update-v8.yml
index e365cf770174..bd17757325f5 100644
--- a/.github/workflows/update-v8.yml
+++ b/.github/workflows/update-v8.yml
@@ -30,7 +30,7 @@ jobs:
             ~/.npm
           key: ${{ runner.os }}-build-${{ env.cache-name }}
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
diff --git a/.github/workflows/update-wpt.yml b/.github/workflows/update-wpt.yml
index 4f752cc18985..1f46f442f204 100644
--- a/.github/workflows/update-wpt.yml
+++ b/.github/workflows/update-wpt.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 

From a77fc297c98bc11e083d58f44c89610f3bbe2073 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:55:50 +0000
Subject: [PATCH 055/202] meta: bump cachix/install-nix-action from 31.11.0 to
 31.11.1

Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.11.0 to 31.11.1.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](https://github.com/cachix/install-nix-action/compare/630ae543ea3a38a9a4166f03376c02c50f408342...13d8dd58da0234aa297dedd986986ccb8e7f3e24)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65719
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/benchmark.yml    | 4 ++--
 .github/workflows/build-shared.yml | 2 +-
 .github/workflows/nix-changes.yml  | 4 ++--
 .github/workflows/test-shared.yml  | 2 +-
 .github/workflows/tools.yml        | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 561f8d56813f..7471e0c1c52e 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -92,7 +92,7 @@ jobs:
         env:
           EXPECTED_SHA: ${{ inputs.commit }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -211,7 +211,7 @@ jobs:
           merge-multiple: true
           path: raw-results
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/build-shared.yml b/.github/workflows/build-shared.yml
index 908116021c27..6b0ef92c3df7 100644
--- a/.github/workflows/build-shared.yml
+++ b/.github/workflows/build-shared.yml
@@ -53,7 +53,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index ed25798152e3..6c8d43a223ac 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -54,7 +54,7 @@ jobs:
             tools/nix/
           sparse-checkout-cone-mode: false
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -108,7 +108,7 @@ jobs:
           persist-credentials: false
           sparse-checkout: '*.nix'
           sparse-checkout-cone-mode: false
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
       - name: Lint Nix files
         run: |
           nix-shell -I nixpkgs=./tools/nix/pkgs.nix -p 'nixfmt-tree' --run '
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 8a04fe4d74fc..a3fad5319526 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -184,7 +184,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index e80b65315a4a..51231cd65a9c 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -330,7 +330,7 @@ jobs:
           allow-prereleases: true
       - name: Set up Nix
         if: matrix.id == 'nixpkgs-unstable' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
       - run: ${{ matrix.run }}
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         env:

From abc66cbda1a789304551337a8aef9eb6e8bef4fb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:56:03 +0000
Subject: [PATCH 056/202] meta: bump actions/checkout from 7.0.0 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65718
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .github/workflows/benchmark.yml               |  4 ++--
 .github/workflows/build-tarball.yml           |  4 ++--
 .github/workflows/codeql.yml                  |  2 +-
 .github/workflows/commit-lint.yml             |  2 +-
 .github/workflows/commit-queue.yml            |  2 +-
 .../workflows/coverage-linux-without-intl.yml |  2 +-
 .github/workflows/coverage-linux.yml          |  2 +-
 .github/workflows/coverage-windows.yml        |  2 +-
 .github/workflows/create-release-proposal.yml |  2 +-
 .github/workflows/daily-wpt-fyi.yml           |  6 +++---
 .github/workflows/daily.yml                   |  2 +-
 .github/workflows/doc.yml                     |  2 +-
 .../workflows/find-inactive-collaborators.yml |  2 +-
 .github/workflows/find-inactive-tsc.yml       |  4 ++--
 .github/workflows/license-builder.yml         |  2 +-
 .github/workflows/lint-release-proposal.yml   |  2 +-
 .github/workflows/linters.yml                 | 20 +++++++++----------
 .github/workflows/nix-changes.yml             |  4 ++--
 .github/workflows/scorecard.yml               |  2 +-
 .github/workflows/stress-test.yml             |  2 +-
 .github/workflows/test-internet.yml           |  2 +-
 .github/workflows/test-linux-quic.yml         |  2 +-
 .github/workflows/test-linux.yml              |  2 +-
 .github/workflows/test-macos.yml              |  2 +-
 .github/workflows/test-shared.yml             |  2 +-
 .github/workflows/timezone-update.yml         |  4 ++--
 .github/workflows/tools.yml                   |  2 +-
 .github/workflows/update-openssl.yml          |  2 +-
 .github/workflows/update-v8.yml               |  2 +-
 .github/workflows/update-wpt.yml              |  2 +-
 30 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 7471e0c1c52e..b512153621d8 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -78,7 +78,7 @@ jobs:
     name: '${{ matrix.system }}: with shared libraries'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: ${{ inputs.repo || github.repository }}
           ref: refs/pull/${{ inputs.pr_id }}/merge
@@ -195,7 +195,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index 248e64bab776..e173d4a544e0 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -76,7 +76,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -104,7 +104,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions/install-clang
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3cfb48d1fee4..a2304fcb1c17 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 389396d364c8..5537d1e19c65 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -20,7 +20,7 @@ jobs:
         run: |
           echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
           echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
           persist-credentials: false
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 4037554f6d70..600dadc17bc4 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -180,7 +180,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 92c9f3b88217..7a73d69b70ec 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index e97b759bc6a4..79c6eaaebc91 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
index d0236cd7d609..5da225b17127 100644
--- a/.github/workflows/coverage-windows.yml
+++ b/.github/workflows/coverage-windows.yml
@@ -72,7 +72,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
index 0782a6e9a9e2..735b15ffd12f 100644
--- a/.github/workflows/create-release-proposal.yml
+++ b/.github/workflows/create-release-proposal.yml
@@ -33,7 +33,7 @@ jobs:
       RELEASE_LINE: ${{ inputs.release-line }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ env.STAGING_BRANCH }}
           persist-credentials: false
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 5becd70c71a0..043de271faa9 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -62,7 +62,7 @@ jobs:
           SHORT_SHA=$(node -p 'process.version.split(/-nightly\d{8}/)[1]')
           echo "NIGHTLY_REF=$(gh api /repos/nodejs/node/commits/$SHORT_SHA --jq '.sha')" >> $GITHUB_ENV
       - name: Checkout ${{ steps.setup-node.outputs.node-version }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ env.NIGHTLY_REF || steps.setup-node.outputs.node-version }}
@@ -78,7 +78,7 @@ jobs:
         run: rm -rf wpt
         working-directory: test/fixtures
       - name: Checkout epochs/daily WPT
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: web-platform-tests/wpt
           persist-credentials: false
@@ -109,7 +109,7 @@ jobs:
       # version-specific checkout above overwrites .github/actions/
       - name: Checkout undici WPT actions
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           sparse-checkout: |
             .github/actions/undici-wpt-current
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 46af9ae4555c..b7a616e2df5d 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 24a211b539dd..693d9ad3dd24 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -24,7 +24,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
diff --git a/.github/workflows/find-inactive-collaborators.yml b/.github/workflows/find-inactive-collaborators.yml
index 5f780458a0f1..8c74fda22428 100644
--- a/.github/workflows/find-inactive-collaborators.yml
+++ b/.github/workflows/find-inactive-collaborators.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/find-inactive-tsc.yml b/.github/workflows/find-inactive-tsc.yml
index 52f4960c49ea..d59f26b73b2b 100644
--- a/.github/workflows/find-inactive-tsc.yml
+++ b/.github/workflows/find-inactive-tsc.yml
@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Clone nodejs/TSC repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           path: .tmp
diff --git a/.github/workflows/license-builder.yml b/.github/workflows/license-builder.yml
index a95ee13c45f4..3bdf3fc31dcc 100644
--- a/.github/workflows/license-builder.yml
+++ b/.github/workflows/license-builder.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - run: ./tools/license-builder.sh  # Run the license builder tool
diff --git a/.github/workflows/lint-release-proposal.yml b/.github/workflows/lint-release-proposal.yml
index e8ffab178458..027aee336ace 100644
--- a/.github/workflows/lint-release-proposal.yml
+++ b/.github/workflows/lint-release-proposal.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 2
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index fcb7b081fc5d..848fffc117a1 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -25,7 +25,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
@@ -38,7 +38,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -52,7 +52,7 @@ jobs:
     if: ${{ github.event.pull_request && github.event.pull_request.draft == false && github.base_ref == github.event.repository.default_branch }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -89,7 +89,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
@@ -137,7 +137,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -163,7 +163,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -186,7 +186,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -202,7 +202,7 @@ jobs:
     # cannot use ubuntu-24.04-arm here because the docker image is x86 only
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f
@@ -212,7 +212,7 @@ jobs:
     if: ${{ github.event.pull_request }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -227,7 +227,7 @@ jobs:
   lint-readme:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index 6c8d43a223ac..a56cea0936c4 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -45,7 +45,7 @@ jobs:
     name: '${{ matrix.system }}: dependencies diff'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -103,7 +103,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: '*.nix'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d0ebd5fc2f40..5042342ca70c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 6f1e75813915..1c93d4ba3dda 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -54,7 +54,7 @@ jobs:
       SCCACHE_GHA_ENABLED: 'true'
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index dee3fa98d0dd..497d5156fec9 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -55,7 +55,7 @@ jobs:
     if: (github.event_name == 'schedule' && github.repository == 'nodejs/node') || (github.event.pull_request && github.event.pull_request.draft == false)
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
index e1a05cf91859..70aa8d9b04d1 100644
--- a/.github/workflows/test-linux-quic.yml
+++ b/.github/workflows/test-linux-quic.yml
@@ -47,7 +47,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index 7681a176139d..408371f3313c 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -60,7 +60,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index c53bcde2851c..6954112115ef 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -85,7 +85,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index a3fad5319526..1f1afdd89dd2 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -117,7 +117,7 @@ jobs:
     name: ${{ github.event_name == 'workflow_dispatch' && 'Skipped job' || 'Build slim tarball' }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml
index 94961f8ae6ed..481c20da4e05 100644
--- a/.github/workflows/timezone-update.yml
+++ b/.github/workflows/timezone-update.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout nodejs/node
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout unicode-org/icu-data
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: icu-data
           persist-credentials: false
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 51231cd65a9c..097902102685 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -316,7 +316,7 @@ jobs:
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         with:
           persist-credentials: false
diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 49f0006526b0..10eb3289a1f7 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -15,7 +15,7 @@ jobs:
     # Cannot use ubuntu-slim here because the update script requires Docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Check and download new OpenSSL version
diff --git a/.github/workflows/update-v8.yml b/.github/workflows/update-v8.yml
index bd17757325f5..8e71e563896b 100644
--- a/.github/workflows/update-v8.yml
+++ b/.github/workflows/update-v8.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Cache node modules and update-v8
diff --git a/.github/workflows/update-wpt.yml b/.github/workflows/update-wpt.yml
index 1f46f442f204..7b59a2f137f3 100644
--- a/.github/workflows/update-wpt.yml
+++ b/.github/workflows/update-wpt.yml
@@ -27,7 +27,7 @@ jobs:
         subsystem: ${{ fromJSON(github.event.inputs.subsystems || '["url", "urlpattern", "WebCryptoAPI"]') }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 

From 6aa5c4d3b05616d40961e3d94ed264b70d29d25a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:56:15 +0000
Subject: [PATCH 057/202] meta: bump github/codeql-action/autobuild from 4.37.3
 to 4.37.9

Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938)

---
updated-dependencies:
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65717
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a2304fcb1c17..583931ad7d78 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9

From 5ca7a38a0f9e12e03b6890f1bd234da44376a03f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:56:30 +0000
Subject: [PATCH 058/202] tools: bump the eslint group in /tools/eslint with 4
 updates

Bumps the eslint group in /tools/eslint with 4 updates: [eslint](https://github.com/eslint/eslint), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc), [eslint-plugin-regexp](https://github.com/ota-meshi/eslint-plugin-regexp) and [globals](https://github.com/sindresorhus/globals).

Updates `eslint` from 10.8.0 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.8.0...v10.9.1)

Updates `eslint-plugin-jsdoc` from 63.3.1 to 64.2.1
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v63.3.1...v64.2.1)

Updates `eslint-plugin-regexp` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/ota-meshi/eslint-plugin-regexp/releases)
- [Changelog](https://github.com/ota-meshi/eslint-plugin-regexp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ota-meshi/eslint-plugin-regexp/compare/v3.1.1...v3.2.0)

Updates `globals` from 17.8.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.8.0...v17.11.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: eslint
- dependency-name: eslint-plugin-regexp
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: eslint
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65716
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 tools/eslint/package-lock.json | 129 ++++++++++++++++++++++-----------
 tools/eslint/package.json      |   8 +-
 2 files changed, 90 insertions(+), 47 deletions(-)

diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index fc7840daff98..21d2d96163c7 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -15,11 +15,11 @@
         "@eslint/js": "^10.0.1",
         "@eslint/markdown": "^8.0.3",
         "@stylistic/eslint-plugin": "^5.10.0",
-        "eslint": "^10.8.0",
+        "eslint": "^10.9.1",
         "eslint-formatter-tap": "^9.0.1",
-        "eslint-plugin-jsdoc": "^63.3.1",
-        "eslint-plugin-regexp": "^3.1.1",
-        "globals": "^17.8.0"
+        "eslint-plugin-jsdoc": "^64.2.1",
+        "eslint-plugin-regexp": "^3.2.0",
+        "globals": "^17.11.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -278,19 +278,31 @@
       }
     },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.90.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.90.0.tgz",
-      "integrity": "sha512-51x9KxyTAN6guZOCd+lmcDdkhgdMdP/6iMMtg9dyhCWDc3+iSUyoB7f/9WAM/yGHmGFq25Vd6bXRR7CZcB+tog==",
+      "version": "0.95.1",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.95.1.tgz",
+      "integrity": "sha512-LO/RI08Fo9bhXwB7Od9G+1j3eSNq63+ZS5CQO8YLXHbDg6kx6S/DhTeY0+Fc9uZrjK1zZSyTx8Sg5gv5DIoCnA==",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.65.0",
-        "comment-parser": "1.4.7",
+        "@typescript-eslint/types": "^8.67.0",
+        "comment-parser": "1.4.8",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~7.3.0"
+        "jsdoc-type-pratt-parser": "~9.1.2"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
+      }
+    },
+    "node_modules/@es-joy/jsdoccomment/node_modules/jsdoc-type-pratt-parser": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.1.2.tgz",
+      "integrity": "sha512-9EXymowgk1mb9RY1VxuwKc+AhaxfBk2CV0dWxgGM+l5RURTtiUoAx7MlKwcsiVcEXK5HEPa7FeH/tsRpqjEPRg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9"
+      },
+      "engines": {
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/@es-joy/resolve.exports": {
@@ -642,6 +654,15 @@
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
+    "node_modules/@types/node": {
+      "version": "26.4.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz",
+      "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -649,9 +670,9 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.65.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz",
-      "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+      "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -699,12 +720,12 @@
       }
     },
     "node_modules/are-docs-informative": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.0.2.tgz",
-      "integrity": "sha512-ixiS0nLNNG5jNQzgZJNoUpBKdo9yTYZMGJ+QgT2jmjR7G7+QHRCc4v6LQ3NgE7EBJq+o0ams3waJwkrlBom8Ig==",
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.1.1.tgz",
+      "integrity": "sha512-sqRsNQBwbKLRX0jV5Cu5uzmtflf892n4Vukz7T659ebL4pz3mpOqCMU7lxMoBTFwnp10E3YB5ZcyHM41W5bcDA==",
       "license": "MIT",
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
     "node_modules/argparse": {
@@ -829,9 +850,9 @@
       }
     },
     "node_modules/comment-parser": {
-      "version": "1.4.7",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.7.tgz",
-      "integrity": "sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==",
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.8.tgz",
+      "integrity": "sha512-rKZTGo4fzKYna8UcL0isTg5wkBNla7bxTypLwZQXjIdi++IdP1OJ41rI5Mti3/jltkPujbu4i9LIARYA+zpotQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12.0.0"
@@ -952,9 +973,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.8.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.0.tgz",
-      "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==",
+      "version": "10.9.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.1.tgz",
+      "integrity": "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A==",
       "license": "MIT",
       "workspaces": [
         "packages/*"
@@ -1022,17 +1043,17 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "63.3.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.3.1.tgz",
-      "integrity": "sha512-yVyTPtOY2tA8EjTwUtaM3pFxj9i/3m4/FSPMv5gMnDHSSleCpzIYQLyV8KnVmEIkkPpNhDlkDQ99mTfjxgqLxA==",
+      "version": "64.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.2.1.tgz",
+      "integrity": "sha512-6GpSYxLPcbMw38S94Cngrgs1Zv8yLinQS1O17OxJVZ6deLbrMRCERUYQKceweSqEuG2kx5Amn4l3aKPkCp4geQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/jsdoccomment": "~0.90.0",
+        "@es-joy/jsdoccomment": "~0.95.1",
         "@es-joy/resolve.exports": "1.2.0",
-        "are-docs-informative": "^0.0.2",
-        "comment-parser": "1.4.7",
+        "are-docs-informative": "^0.1.1",
+        "comment-parser": "1.4.8",
         "debug": "^4.4.3",
-        "escape-string-regexp": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
         "espree": "^11.2.0",
         "esquery": "^1.7.0",
         "html-entities": "^2.6.0",
@@ -1043,12 +1064,24 @@
         "to-valid-identifier": "^1.0.0"
       },
       "engines": {
-        "node": "^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
       },
       "peerDependencies": {
         "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
       }
     },
+    "node_modules/eslint-plugin-jsdoc/node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/eslint-plugin-jsdoc/node_modules/espree": {
       "version": "11.2.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
@@ -1067,15 +1100,15 @@
       }
     },
     "node_modules/eslint-plugin-regexp": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.1.1.tgz",
-      "integrity": "sha512-MxR5nqoQCtVWmJwia0D2+NlXX1xzdpkslsVOZLEYQ4PQWEaL65PCZXURxaBc3lPnkNFpNxzMIRmYVxdl8giXRA==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.2.0.tgz",
+      "integrity": "sha512-4yq47CnLxyfHFKJEo5kvNaiJ0aDtBxSJWk4M2LiamplUXdWxdlzDYqImb/ZVCp+2BqkQjBAmw4Xc07Q8SXVDZg==",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "comment-parser": "^1.4.0",
-        "jsdoc-type-pratt-parser": "^7.0.0",
+        "jsdoc-type-pratt-parser": "^9.0.0",
         "refa": "^0.12.1",
         "regexp-ast-analysis": "^0.7.1",
         "scslre": "^0.3.0"
@@ -1319,9 +1352,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.8.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz",
-      "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==",
+      "version": "17.11.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.11.0.tgz",
+      "integrity": "sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -1430,12 +1463,16 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.3.0.tgz",
-      "integrity": "sha512-DoyJXo7x/n48M3NsGOs9QnEws0ft0tV3YsSgvWMNxz2hZtz+Q6fpqUD96lVYX4a+jcEkzHeFNDJOn68TzXfbdA==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.1.tgz",
+      "integrity": "sha512-V4Ww4EHnTcTLSOMoB0FsF72JhQvcAsriCm/LWnxJeGWoxIjEL2l9na11abQok5SYShq8m0Gl02el/xAbTCulvQ==",
       "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9",
+        "@types/node": "^26.4.0"
+      },
       "engines": {
-        "node": ">=20.0.0"
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/jsesc": {
@@ -2715,6 +2752,12 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "license": "MIT"
+    },
     "node_modules/unist-util-is": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
diff --git a/tools/eslint/package.json b/tools/eslint/package.json
index 30b0aa50c84c..c91990303d39 100644
--- a/tools/eslint/package.json
+++ b/tools/eslint/package.json
@@ -10,10 +10,10 @@
     "@eslint/js": "^10.0.1",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.8.0",
+    "eslint": "^10.9.1",
     "eslint-formatter-tap": "^9.0.1",
-    "eslint-plugin-jsdoc": "^63.3.1",
-    "eslint-plugin-regexp": "^3.1.1",
-    "globals": "^17.8.0"
+    "eslint-plugin-jsdoc": "^64.2.1",
+    "eslint-plugin-regexp": "^3.2.0",
+    "globals": "^17.11.0"
   }
 }

From 53234233acb9a51180043b169e870048f3808d31 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:56:44 +0000
Subject: [PATCH 059/202] meta: bump github/codeql-action/init from 4.37.3 to
 4.37.9

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65714
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 583931ad7d78..0b83c888ecdc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,7 +28,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml

From 82fc59d4cb9e830c27e0b1f5d36977adc450cedd Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Thu, 3 Sep 2026 20:54:01 -0300
Subject: [PATCH 060/202] test: deflake test-runner-coverage

The subtests that set NODE_V8_COVERAGE leave a coverage-<pid>-*.json
file in the test tmpdir, and nothing removes it. The later subtests
spawn without NODE_V8_COVERAGE, so their coverage goes to a private
mkdtemp directory that is removed on cleanup rather than to the test
tmpdir. A match in findCoverageFileForPid(result.pid) can therefore only
come from a stale file whose pid has been reused, which is why the
failures are only reported on platforms that recycle pids quickly.

Refresh the tmpdir from an after() hook on each subtest that dumps into
it, so a failure in one of them cannot leave the file behind and turn
every later check into a second, misleading failure. Drop the flaky
designations.

Fixes: https://github.com/nodejs/node/issues/55154
Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65728
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 test/parallel/parallel.status         | 6 ------
 test/parallel/test-runner-coverage.js | 4 ++++
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
index bffe32296911..d8fba447e96e 100644
--- a/test/parallel/parallel.status
+++ b/test/parallel/parallel.status
@@ -20,8 +20,6 @@ test-fs-read-stream-concurrent-reads: PASS, FLAKY
 test-snapshot-incompatible: SKIP
 
 [$system==win32]
-# https://github.com/nodejs/node/issues/55154#issuecomment-5423571475
-test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/59090
 test-inspector-network-fetch: PASS, FLAKY
 # https://github.com/nodejs/node/issues/59636
@@ -38,8 +36,6 @@ test-performance-function: PASS, FLAKY
 test-esm-loader-hooks-inspect-wait: PASS, FLAKY
 
 [$system==linux && $arch==s390x]
-# https://github.com/nodejs/node/issues/55154#issuecomment-5423571475
-test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/58353
 test-http2-debug: PASS, FLAKY
 
@@ -101,8 +97,6 @@ test-fs-watch-ignore-mixed: SKIP
 test-fs-watch-ignore-regexp: SKIP
 
 [$system==aix]
-# https://github.com/nodejs/node/issues/55154#issuecomment-5423571475
-test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/54346
 test-esm-loader-hooks-inspect-wait: PASS, FLAKY
 
diff --git a/test/parallel/test-runner-coverage.js b/test/parallel/test-runner-coverage.js
index bc65221a45f8..fa56c5af3e80 100644
--- a/test/parallel/test-runner-coverage.js
+++ b/test/parallel/test-runner-coverage.js
@@ -116,6 +116,8 @@ test('test coverage report', async (t) => {
 
 test('test tap coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
@@ -154,6 +156,8 @@ test('test tap coverage reporter', skipIfNoInspector, async (t) => {
 
 test('test spec coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',

From f86053855de1e28e00b725acc7a34293e3b0e911 Mon Sep 17 00:00:00 2001
From: Jungwon Sohn <sjungwon03@gmail.com>
Date: Fri, 4 Sep 2026 09:02:19 +0900
Subject: [PATCH 061/202] typings: add types for performance binding

Signed-off-by: sjungwon03 <sjungwon03@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/65574
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 typings/globals.d.ts                     |   2 +
 typings/internalBinding/performance.d.ts | 134 +++++++++++++++++++++++
 2 files changed, 136 insertions(+)
 create mode 100644 typings/internalBinding/performance.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 66e27bfe9ab2..bcb33dce4f37 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -23,6 +23,7 @@ import { MessagingBinding } from './internalBinding/messaging';
 import { ModulesBinding } from './internalBinding/modules';
 import { OptionsBinding } from './internalBinding/options';
 import { OSBinding } from './internalBinding/os';
+import { PerformanceBinding } from './internalBinding/performance';
 import { PermissionBinding } from './internalBinding/permission';
 import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
@@ -68,6 +69,7 @@ interface InternalBindingMap {
   modules: ModulesBinding;
   options: OptionsBinding;
   os: OSBinding;
+  performance: PerformanceBinding;
   permission: PermissionBinding;
   process: ProcessBinding;
   process_wrap: ProcessWrapBinding;
diff --git a/typings/internalBinding/performance.d.ts b/typings/internalBinding/performance.d.ts
new file mode 100644
index 000000000000..fa9a3810fc7a
--- /dev/null
+++ b/typings/internalBinding/performance.d.ts
@@ -0,0 +1,134 @@
+declare namespace InternalPerformanceBinding {
+  interface HistogramBase {
+    count(): number;
+    countBigInt(): bigint;
+    min(): number;
+    minBigInt(): bigint;
+    max(): number;
+    maxBigInt(): bigint;
+    mean(): number;
+    exceeds(): number;
+    exceedsBigInt(): bigint;
+    stddev(): number;
+    percentile(percentile: number): number;
+    percentileBigInt(percentile: number): bigint;
+    percentiles(percentiles: Map<number, number>): void;
+    percentilesBigInt(percentiles: Map<number, bigint>): void;
+    reset(): void;
+    skewness(): number;
+    kurtosis(): number;
+    cdf(value: number): number;
+    countAt(value: number): number;
+    ksTest(other: HistogramBase): number;
+    percentilesAt(
+      percentiles: Map<number, number>,
+      values: Float64Array,
+    ): void;
+    linearBuckets(stepSize: number, buckets: Map<number, number>): void;
+    logBuckets(
+      firstBucket: number,
+      base: number,
+      buckets: Map<number, number>,
+    ): void;
+    welchTest(
+      other: HistogramBase,
+      confidence: number,
+    ): [number, number, number, number, number];
+    mannWhitneyTest(other: HistogramBase): [number, number, number];
+    cohensD(other: HistogramBase): number;
+    cliffsD(other: HistogramBase): number;
+    percentileCI(percentile: number, confidence: number): [number, number, number];
+    ewmaMean(): number;
+    ewmaStddev(): number;
+    ewmaErrorRate(): number;
+  }
+
+  interface ELDHistogram extends HistogramBase {
+    start(reset?: boolean): void;
+    stop(): void;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+    getAsyncId(): number;
+    asyncReset(resource: object, executionAsyncId?: number): void;
+    getAsyncContextFrameForDebuggingOnly(): unknown;
+    getProviderType(): number;
+  }
+
+  interface Histogram extends HistogramBase {}
+
+  class Histogram {
+    constructor(
+      lowest: number | bigint,
+      highest: number | bigint,
+      figures: number,
+      halfLife?: number,
+      threshold?: number,
+    );
+    record(value: number | bigint): void;
+    recordDelta(): void;
+    recordCorrected(
+      value: number | bigint,
+      expectedInterval: number | bigint,
+    ): void;
+    add(other: Histogram): number;
+    subtract(other: Histogram): number;
+  }
+
+  interface Constants {
+    NODE_PERFORMANCE_GC_MAJOR: number;
+    NODE_PERFORMANCE_GC_MINOR: number;
+    NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP: number;
+    NODE_PERFORMANCE_GC_INCREMENTAL: number;
+    NODE_PERFORMANCE_GC_WEAKCB: number;
+    NODE_PERFORMANCE_GC_FLAGS_NO: number;
+    NODE_PERFORMANCE_GC_FLAGS_CONSTRUCT_RETAINED: number;
+    NODE_PERFORMANCE_GC_FLAGS_FORCED: number;
+    NODE_PERFORMANCE_GC_FLAGS_SYNCHRONOUS_PHANTOM_PROCESSING: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_AVAILABLE_GARBAGE: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_EXTERNAL_MEMORY: number;
+    NODE_PERFORMANCE_GC_FLAGS_SCHEDULE_IDLE: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_GC: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP2: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_NET: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_DNS: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_QUIC: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN_TIMESTAMP: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN: number;
+    NODE_PERFORMANCE_MILESTONE_ENVIRONMENT: number;
+    NODE_PERFORMANCE_MILESTONE_NODE_START: number;
+    NODE_PERFORMANCE_MILESTONE_V8_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_EXIT: number;
+    NODE_PERFORMANCE_MILESTONE_BOOTSTRAP_COMPLETE: number;
+  }
+}
+
+type PerformanceObserverCallback =
+  | ((name: string,
+      type: string,
+      startTime: number,
+      duration: number,
+      details: unknown) => void)
+  | ((entry: unknown) => void);
+
+export interface PerformanceBinding {
+  Histogram: typeof InternalPerformanceBinding.Histogram;
+  constants: InternalPerformanceBinding.Constants;
+  observerCounts: Uint32Array;
+  milestones: Float64Array;
+  setupObservers(callback: PerformanceObserverCallback): void;
+  installGarbageCollectionTracking(): void;
+  removeGarbageCollectionTracking(): void;
+  notify(type: string, entry: unknown): void;
+  loopIdleTime(): number;
+  createELDHistogram(
+    interval: number,
+    samplePerIteration: boolean,
+  ): InternalPerformanceBinding.ELDHistogram;
+  markBootstrapComplete(): void;
+  uvMetricsInfo(): [number, number, number];
+  now(): number;
+}

From a1bfce980c386d22f7d3a77a2ab218c16b6e1c0b Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Fri, 4 Sep 2026 01:45:19 -0300
Subject: [PATCH 062/202] errors: validate constructor name

determineSpecificType() checks for a usable constructor name with
`'name' in value.constructor`. That accepts an empty name, and the `in`
operator requires its right-hand side to be an object.

Anonymous classes own a `name` that is the empty string, so they produce
messages ending in a dangling "Received an instance of ". A truthy
primitive `constructor` reaches the `in` operator and throws while the
message is being built, so ERR_INVALID_ARG_TYPE is replaced by a
TypeError carrying no `code`. The latter is reachable from untrusted
input, since `constructor` is an ordinary JSON key.

The check changed in #49696, while this function was rewritten as a
switch. That pull request updated test/common's invalidArgTypeHelper to
match its deliberate change to the `function` branch, but left the
helper's `object` branch on the original truthy check, so the two have
disagreed since.

Read `constructor` and its `name` once and use the name only when it is
a non-empty string. Requiring a string also stops meaningless names from
being interpolated: 42 currently yields "an instance of 42", and a
symbol name throws outright. The current check reads `constructor` three
times, which an accessor can observe.

Move the helper to the same check so the two cannot drift apart again.

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65607
Refs: https://github.com/nodejs/node/pull/49696
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/errors.js                        | 11 +++-
 test/common/index.js                          |  5 +-
 .../test-error-value-type-detection.mjs       | 55 +++++++++++++++++++
 3 files changed, 66 insertions(+), 5 deletions(-)

diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index 221a40ecdf86..5202737453b3 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1035,11 +1035,16 @@ function determineSpecificType(value) {
       return `type symbol (${String(value)})`;
     case 'function':
       return `function ${value.name}`;
-    case 'object':
-      if (value.constructor && 'name' in value.constructor) {
-        return `an instance of ${value.constructor.name}`;
+    case 'object': {
+      // `constructor` may be user-controlled: it need not be an object, and
+      // its `name` need not be a non-empty string. Reading either can invoke
+      // an accessor, so read each one once.
+      const name = value.constructor?.name;
+      if (typeof name === 'string' && name !== '') {
+        return `an instance of ${name}`;
       }
       return `${lazyInternalUtilInspect().inspect(value, { depth: -1 })}`;
+    }
     case 'string':
       value.length > 28 && (value = `${StringPrototypeSlice(value, 0, 25)}...`);
       if (StringPrototypeIndexOf(value, "'") === -1) {
diff --git a/test/common/index.js b/test/common/index.js
index e37b354f8259..3ec677e566d8 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -855,8 +855,9 @@ function invalidArgTypeHelper(input) {
     return ` Received function ${input.name}`;
   }
   if (typeof input === 'object') {
-    if (input.constructor?.name) {
-      return ` Received an instance of ${input.constructor.name}`;
+    const name = input.constructor?.name;
+    if (typeof name === 'string' && name !== '') {
+      return ` Received an instance of ${name}`;
     }
     return ` Received ${inspect(input, { depth: -1 })}`;
   }
diff --git a/test/parallel/test-error-value-type-detection.mjs b/test/parallel/test-error-value-type-detection.mjs
index e44b19297a96..cb794514ed39 100644
--- a/test/parallel/test-error-value-type-detection.mjs
+++ b/test/parallel/test-error-value-type-detection.mjs
@@ -209,3 +209,58 @@ assert.strictEqual(
   determineSpecificType(new WeakSet()),
   'an instance of WeakSet',
 );
+
+// Anonymous classes have an empty `name`, so the value is inspected instead.
+// `inspect(..., { depth: -1 })` prints this one as `{}` because it has no own
+// properties; the values below carry a `constructor` property of their own and
+// print as `[Object]`.
+assert.strictEqual(
+  determineSpecificType(new (class {})()),
+  '{}',
+);
+
+// `constructor` is an ordinary, user-controlled property that need not be a
+// function. Describing such a value must not throw.
+assert.strictEqual(
+  determineSpecificType(JSON.parse('{"constructor": 5}')),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: '' } }),
+  '[Object]',
+);
+
+// A `constructor.name` that is not a usable string must not be interpolated
+// into the message.
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: Symbol('x') } }),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: 42 } }),
+  '[Object]',
+);
+
+// `constructor` and its `name` are each read once. Both may be accessors, so
+// repeated reads are observable, and a `name` validated by one read and
+// interpolated from another need not be the same value twice.
+let constructorReads = 0;
+let nameReads = 0;
+const named = {
+  get constructor() {
+    constructorReads++;
+    return { get name() { nameReads++; return 'Foo'; } };
+  },
+};
+assert.strictEqual(determineSpecificType(named), 'an instance of Foo');
+assert.strictEqual(constructorReads, 1);
+assert.strictEqual(nameReads, 1);
+
+// Building the error must not fail when `constructor` is a truthy primitive.
+assert.strictEqual(
+  new errorsModule.codes.ERR_INVALID_ARG_TYPE(
+    'arg', 'string', JSON.parse('{"constructor": 5}')).code,
+  'ERR_INVALID_ARG_TYPE',
+);

From 7551e1d90631e8b61e7b34861129f7195482b87c Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Fri, 4 Sep 2026 08:48:17 +0200
Subject: [PATCH 063/202] stream: avoid per-chunk promises in webstream
 adapters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Readable.fromWeb() and the read side of Duplex.fromWeb() allocated a
promise, a read-result object, and two reaction closures for every
chunk through reader.read(); a single reused read request now delivers
chunks through readableStreamDefaultReaderRead() instead, forwarding
each chunk in a microtask to preserve the delivery order relative to
errors and destroy.

Writable.fromWeb() and the write side of Duplex.fromWeb() paid two
derived promises off writer.ready plus the writer.write() promise and a
fresh closure pair per chunk; a single shared write request now
dispatches chunks directly and settles the node callback, with failures
delivered in a microtask.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65548
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 benchmark/webstreams/adapters.js          | 106 ++++++++++
 lib/internal/webstreams/adapters.js       | 242 ++++++++++++++--------
 lib/internal/webstreams/readablestream.js |   3 +
 3 files changed, 266 insertions(+), 85 deletions(-)
 create mode 100644 benchmark/webstreams/adapters.js

diff --git a/benchmark/webstreams/adapters.js b/benchmark/webstreams/adapters.js
new file mode 100644
index 000000000000..ae97e4928f88
--- /dev/null
+++ b/benchmark/webstreams/adapters.js
@@ -0,0 +1,106 @@
+'use strict';
+const common = require('../common.js');
+const {
+  Readable,
+  Writable,
+} = require('node:stream');
+const {
+  ReadableStream,
+  WritableStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  kind: [
+    'readable-to-web',
+    'readable-from-web',
+    'writable-to-web',
+    'writable-from-web',
+  ],
+});
+
+async function readableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const streamReadable = new Readable({
+    read() {
+      if (i++ < n)
+        this.push(chunk);
+      else
+        this.push(null);
+    },
+  });
+  const reader = Readable.toWeb(streamReadable).getReader();
+  bench.start();
+  while (!(await reader.read()).done);
+  bench.end(n);
+}
+
+function readableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const readableStream = new ReadableStream({
+    pull(controller) {
+      if (i++ < n)
+        controller.enqueue(chunk);
+      else
+        controller.close();
+    },
+  });
+  const streamReadable = Readable.fromWeb(readableStream);
+  bench.start();
+  streamReadable.on('data', () => {});
+  streamReadable.on('end', () => bench.end(n));
+}
+
+async function writableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const streamWritable = new Writable({
+    write(chunk, encoding, callback) {
+      callback();
+    },
+  });
+  const writer = Writable.toWeb(streamWritable).getWriter();
+  bench.start();
+  for (let i = 0; i < n; i++)
+    await writer.write(chunk);
+  await writer.close();
+  bench.end(n);
+}
+
+function writableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const writableStream = new WritableStream({
+    write() {},
+  });
+  const streamWritable = Writable.fromWeb(writableStream);
+  bench.start();
+  let i = 0;
+  function writeLoop() {
+    while (i++ < n) {
+      if (!streamWritable.write(chunk)) {
+        streamWritable.once('drain', writeLoop);
+        return;
+      }
+    }
+    streamWritable.end(() => bench.end(n));
+  }
+  writeLoop();
+}
+
+function main({ n, kind }) {
+  switch (kind) {
+    case 'readable-to-web':
+      readableToWeb(n);
+      break;
+    case 'readable-from-web':
+      readableFromWeb(n);
+      break;
+    case 'writable-to-web':
+      writableToWeb(n);
+      break;
+    case 'writable-from-web':
+      writableFromWeb(n);
+      break;
+  }
+}
diff --git a/lib/internal/webstreams/adapters.js b/lib/internal/webstreams/adapters.js
index 42e1221bb307..c00cc38ceef8 100644
--- a/lib/internal/webstreams/adapters.js
+++ b/lib/internal/webstreams/adapters.js
@@ -23,11 +23,16 @@ const { TextEncoder } = require('internal/encoding');
 const {
   ReadableStream,
   isReadableStream,
+  readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
 } = require('internal/webstreams/readablestream');
 
 const {
   WritableStream,
   isWritableStream,
+  writableStreamDefaultWriterWriteWithRequest,
 } = require('internal/webstreams/writablestream');
 
 const {
@@ -53,6 +58,10 @@ const {
   Buffer,
 } = require('buffer');
 
+const {
+  kResolvedPromise,
+} = require('internal/webstreams/util');
+
 const {
   isAnyArrayBuffer,
 } = require('internal/util/types');
@@ -141,6 +150,96 @@ function handleKnownInternalErrors(cause) {
 
 const noop = () => {};
 
+// A single shared write request tracks every chunk written to the
+// destination WritableStream, replacing the per-write promise pair that
+// writer.ready + writer.write() would allocate. Only one write/writev
+// batch is in flight at a time, so one callback slot is enough.
+// `promise` is non-undefined so writable-stream queue entries are
+// discriminated from kNilRequest by `promise === undefined`;
+// `failed`/`failure` latch a write that could not proceed.
+function createWriteTracker(getDestination) {
+  return {
+    promise: null,
+    pending: 0,
+    failed: false,
+    failure: undefined,
+    callback: undefined,
+    error: undefined,
+    hasError: false,
+    dispatching: false,
+    resolve() {
+      this.pending--;
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    reject(error) {
+      this.pending--;
+      if (!this.hasError) {
+        this.hasError = true;
+        this.error = error;
+      }
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    settle() {
+      const callback = this.callback;
+      this.callback = undefined;
+      let error;
+      if (this.hasError) {
+        error = this.error;
+        this.hasError = false;
+        this.error = undefined;
+      } else if (this.failed) {
+        error = this.failure;
+      }
+      this.failed = false;
+      this.failure = undefined;
+      if (error !== undefined) {
+        // Deliver failures in a microtask: this can run while the
+        // writable-stream machinery is mid-transition (e.g. inside
+        // writableStreamFinishErroring), and the callback typically
+        // destroys the stream, which re-enters the machinery.
+        PromisePrototypeThen(kResolvedPromise, () => {
+          try {
+            callback(error);
+          } catch (err) {
+            process.nextTick(() => destroy(getDestination(), err));
+          }
+        });
+        return;
+      }
+      try {
+        callback(error);
+      } catch (err) {
+        // In a next tick because this can run within a promise context,
+        // and any error thrown must not become an unhandled rejection.
+        process.nextTick(() => destroy(getDestination(), err));
+      }
+    },
+  };
+}
+
+function dispatchWrite(writer, chunk, tracker) {
+  tracker.dispatching = true;
+  writableStreamDefaultWriterWriteWithRequest(writer, chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
+function dispatchWritev(writer, chunks, tracker) {
+  tracker.dispatching = true;
+  for (let i = 0; i < chunks.length; i++)
+    writableStreamDefaultWriterWriteWithRequest(writer, chunks[i].chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
 /**
  * @typedef {import('../../stream').Writable} Writable
  * @typedef {import('../../stream').Readable} Readable
@@ -313,6 +412,7 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
 
   const writer = writableStream.getWriter();
   let closed = false;
+  const writeTracker = createWriteTracker(() => writable);
 
   const writable = new Writable({
     highWaterMark,
@@ -321,27 +421,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(writable, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -360,18 +441,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(writable, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     destroy(error, callback) {
@@ -585,6 +656,14 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
 
   const reader = readableStream.getReader();
   let closed = false;
+  let readRequest;
+  let pendingChunk;
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    readable.push(chunk);
+  }
 
   const readable = new Readable({
     objectMode,
@@ -593,17 +672,25 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
     signal,
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            // Value should always be undefined here.
-            readable.push(null);
-          } else {
-            readable.push(chunk.value);
-          }
+      // At most one read is in flight (Readable does not call read()
+      // again before push()), so a single reused read request replaces
+      // the promise, read-result object, and reaction closures that
+      // reader.read() would allocate per chunk. The chunk is forwarded
+      // in a microtask to keep the old reaction position: a sync push
+      // could deliver a chunk that an error or destroy should beat.
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
+        },
+        [kClose]() {
+          readable.push(null);
         },
-        (error) => destroy(readable, error));
+        [kError](error) {
+          destroy(readable, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -769,6 +856,15 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
   const reader = readableStream.getReader();
   let writableClosed = false;
   let readableClosed = false;
+  let readRequest;
+  let pendingChunk;
+  const writeTracker = createWriteTracker(() => duplex);
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    duplex.push(chunk);
+  }
 
   const duplex = new Duplex({
     allowHalfOpen,
@@ -779,27 +875,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(duplex, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -818,18 +895,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(duplex, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     final(callback) {
@@ -855,16 +922,21 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     },
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            duplex.push(null);
-          } else {
-            duplex.push(chunk.value);
-          }
+      // Same single-in-flight reused read request as
+      // newStreamReadableFromReadableStream().
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
         },
-        (error) => destroy(duplex, error));
+        [kClose]() {
+          duplex.push(null);
+        },
+        [kError](error) {
+          destroy(duplex, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index 78313bd03c1a..5402bb487be5 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -3870,6 +3870,9 @@ module.exports = {
   readableStreamReaderGenericRelease,
   readableStreamBYOBReaderRead,
   readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
   setupReadableStreamBYOBReader,
   setupReadableStreamDefaultReader,
   readableStreamDefaultControllerClose,

From 7177c14789a7376866dfe6c04f5cd4da489cfbe6 Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Fri, 4 Sep 2026 17:59:30 +0900
Subject: [PATCH 064/202] typings: add ffi internal binding types

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65734
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 typings/globals.d.ts             |   2 +
 typings/internalBinding/ffi.d.ts | 101 +++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 typings/internalBinding/ffi.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index bcb33dce4f37..e112e3ecd2bd 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -10,6 +10,7 @@ import { CryptoBinding } from './internalBinding/crypto';
 import { DebugBinding } from './internalBinding/debug';
 import { DiagnosticsChannelBinding } from './internalBinding/diagnostics_channel';
 import { EncodingBinding } from './internalBinding/encoding_binding';
+import { FFIBinding } from './internalBinding/ffi';
 import { FsBinding } from './internalBinding/fs';
 import { FsDirBinding } from './internalBinding/fs_dir';
 import { HeapUtilsBinding } from './internalBinding/heap_utils';
@@ -56,6 +57,7 @@ interface InternalBindingMap {
   debug: DebugBinding;
   diagnostics_channel: DiagnosticsChannelBinding;
   encoding_binding: EncodingBinding;
+  ffi: FFIBinding;
   fs: FsBinding;
   fs_dir: FsDirBinding;
   heap_utils: HeapUtilsBinding;
diff --git a/typings/internalBinding/ffi.d.ts b/typings/internalBinding/ffi.d.ts
new file mode 100644
index 000000000000..0294d1987b03
--- /dev/null
+++ b/typings/internalBinding/ffi.d.ts
@@ -0,0 +1,101 @@
+declare namespace InternalFFIBinding {
+  type Buffer = Uint8Array;
+  type BufferSource = Buffer | ArrayBuffer | ArrayBufferView | SharedArrayBuffer;
+  type VoidType = 'void';
+  type NumberType =
+    | 'char'
+    | 'int8' | 'i8'
+    | 'uint8' | 'u8' | 'bool'
+    | 'int16' | 'i16'
+    | 'uint16' | 'u16'
+    | 'int32' | 'i32'
+    | 'uint32' | 'u32'
+    | 'float32' | 'f32' | 'float'
+    | 'float64' | 'f64' | 'double';
+  type BigIntType = 'int64' | 'i64' | 'uint64' | 'u64';
+  type PointerType =
+    | 'pointer' | 'ptr'
+    | 'string' | 'str'
+    | 'buffer' | 'arraybuffer'
+    | 'function';
+  type ValueType = NumberType | BigIntType | PointerType;
+  type ReturnType = VoidType | ValueType;
+  type FFICallback = (...args: any[]) => unknown;
+
+  interface FFIFunction {
+    (...args: unknown[]): unknown;
+    pointer: bigint;
+  }
+  interface FunctionSignature {
+    arguments?: readonly ValueType[];
+    return?: ReturnType;
+  }
+
+  class DynamicLibrary {
+    constructor(path: string | null);
+
+    readonly path: string;
+    readonly symbols: Record<string, bigint>;
+    readonly functions: Record<string, FFIFunction>;
+
+    close(): void;
+    getFunction(name: string, signature: FunctionSignature): FFIFunction;
+    getFunctions(): Record<string, FFIFunction>;
+    getFunctions(
+      definitions: Record<string, FunctionSignature>,
+    ): Record<string, FFIFunction>;
+    getSymbol(name: string): bigint;
+    getSymbols(): Record<string, bigint>;
+    registerCallback(callback: FFICallback): bigint;
+    registerCallback(
+      signature: FunctionSignature,
+      callback: FFICallback
+    ): bigint;
+    unregisterCallback(pointer: bigint): void;
+    refCallback(pointer: bigint): void;
+    unrefCallback(pointer: bigint): void;
+    [Symbol.dispose](): void;
+  }
+}
+export interface FFIBinding {
+  DynamicLibrary: typeof InternalFFIBinding.DynamicLibrary;
+  toString(pointer: bigint): string | null;
+  toBuffer(pointer: bigint, length: number, copy?: boolean): InternalFFIBinding.Buffer;
+  toArrayBuffer(pointer: bigint, length: number, copy?: boolean): ArrayBuffer;
+
+  exportBytes(source: InternalFFIBinding.BufferSource, pointer: bigint, length: number): void;
+  getRawPointer(source: InternalFFIBinding.BufferSource): bigint;
+  getCurrentEventLoop(): bigint;
+
+  getInt8(pointer: bigint, offset?: number): number;
+  getUint8(pointer: bigint, offset?: number): number;
+  getInt16(pointer: bigint, offset?: number): number;
+  getUint16(pointer: bigint, offset?: number): number;
+  getInt32(pointer: bigint, offset?: number): number;
+  getUint32(pointer: bigint, offset?: number): number;
+  getInt64(pointer: bigint, offset?: number): bigint;
+  getUint64(pointer: bigint, offset?: number): bigint;
+  getFloat32(pointer: bigint, offset?: number): number;
+  getFloat64(pointer: bigint, offset?: number): number;
+
+  setInt8(pointer: bigint, offset: number, value: number): void;
+  setUint8(pointer: bigint, offset: number, value: number): void;
+  setInt16(pointer: bigint, offset: number, value: number): void;
+  setUint16(pointer: bigint, offset: number, value: number): void;
+  setInt32(pointer: bigint, offset: number, value: number): void;
+  setUint32(pointer: bigint, offset: number, value: number): void;
+  setInt64(pointer: bigint, offset: number, value: number | bigint): void;
+  setUint64(pointer: bigint, offset: number, value: number | bigint): void;
+  setFloat32(pointer: bigint, offset: number, value: number): void;
+  setFloat64(pointer: bigint, offset: number, value: number): void;
+
+  charIsSigned: boolean;
+  uintptrMax: bigint;
+
+  kSbSharedBuffer: symbol;
+  kSbInvokeSlow: symbol;
+  kSbArguments: symbol;
+  kSbReturn: symbol;
+  kFastArguments: symbol;
+  kFastBufferInvoke: symbol;
+}

From f8d6d759dbfc6adc34457b5b7993000d7b430e35 Mon Sep 17 00:00:00 2001
From: Donghoon Kang <d159123@naver.com>
Date: Fri, 4 Sep 2026 18:38:12 +0900
Subject: [PATCH 065/202] ffi: include SharedArrayBuffer in error message

ExportBytes accepts SharedArrayBuffer inputs, but its invalid argument
messages do not list SharedArrayBuffer as a supported input type.

Signed-off-by: HoonDongKang <d159123@naver.com>
PR-URL: https://github.com/nodejs/node/pull/65735
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/ffi/data.cc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 308bde60cae2..8bd2c0d9f352 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -671,7 +671,8 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() < 1) {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
@@ -689,7 +690,8 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   } else {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 

From 9e168a3739d92e677334ff5e6fe837a31e1c023f Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 4 Sep 2026 12:22:09 +0200
Subject: [PATCH 066/202] meta: cleanup targos emeritus changes

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65738
Refs: https://github.com/nodejs/node/pull/65393
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
---
 README.md                                 | 1 -
 doc/contributing/strategic-initiatives.md | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3827556a44fb..0376c0e9814c 100644
--- a/README.md
+++ b/README.md
@@ -800,7 +800,6 @@ that server.
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
 gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
 gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
 gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index a7ee78f42aae..1b275178f9ee 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -11,6 +11,7 @@ agenda to ensure they are active and have the support they need.
 | QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Unified HTTP API       | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Shadow Realm           | [Chengzhong Wu][legendecas]      | <https://github.com/nodejs/node/issues/42528> |
+| V8 Currency            |                                  |                                               |
 | Next-10                | [Jacob Smith][JakobJingleheimer] | <https://github.com/nodejs/next-10>           |
 | Single executable apps | [Darshan Sen][RaisinTen]         | <https://github.com/nodejs/single-executable> |
 | Performance            | [Rafael Gonzaga][RafaelGSS]      | <https://github.com/nodejs/performance>       |

From 2384897f39144e50e840363bfcf22a6b79331d9f Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Fri, 4 Sep 2026 12:36:50 +0200
Subject: [PATCH 067/202] crypto: cache valid ECDH key pairs

Avoid repeating EC key-pair validation after a pair has already been
established or validated. Invalidate the positive-only cache whenever
public-key mutation can make the pair inconsistent.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65615
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 benchmark/crypto/ecdh-compute-secret.js | 117 ++++++++++++++++++++++++
 src/crypto/crypto_ec.cc                 |  20 +++-
 src/crypto/crypto_ec.h                  |   3 +
 test/parallel/test-crypto-dh-curves.js  |  36 ++++++++
 4 files changed, 175 insertions(+), 1 deletion(-)
 create mode 100644 benchmark/crypto/ecdh-compute-secret.js

diff --git a/benchmark/crypto/ecdh-compute-secret.js b/benchmark/crypto/ecdh-compute-secret.js
new file mode 100644
index 000000000000..3061c5b2cc36
--- /dev/null
+++ b/benchmark/crypto/ecdh-compute-secret.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const kCurve = 'prime256v1';
+const kPeerPoolSize = 32;
+const scenarios = [
+  'first-after-generate',
+  'full-lifecycle',
+  'reused-local-same-peer',
+  'reused-local-peer-pool',
+];
+
+const bench = common.createBenchmark(main, {
+  scenario: scenarios,
+  n: [5_000],
+}, {
+  test: { scenario: 'first-after-generate', n: 1 },
+});
+
+function generateContext() {
+  const context = crypto.createECDH(kCurve);
+  context.generateKeys();
+  return context;
+}
+
+function verifySecret(secret, local, peer) {
+  assert.deepStrictEqual(secret, peer.computeSecret(local.getPublicKey()));
+}
+
+function firstAfterGenerate(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = Array.from({ length: n }, generateContext);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = locals[i].computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function fullLifecycle(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = new Array(n);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const local = locals[i] = generateContext();
+    secrets[i] = local.computeSecret(peerPublicKey);
+  }
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function reusedLocalSamePeer(n) {
+  const local = generateContext();
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  local.computeSecret(peerPublicKey);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], local, peer);
+}
+
+function reusedLocalPeerPool(n) {
+  const local = generateContext();
+  const peers = Array.from(
+    { length: Math.min(n, kPeerPoolSize) },
+    generateContext);
+  const peerPublicKeys = peers.map((peer) => peer.getPublicKey());
+  local.computeSecret(peerPublicKeys[0]);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKeys[i % peers.length]);
+  bench.end(n);
+
+  const lastPeer = peers[(n - 1) % peers.length];
+  verifySecret(secrets[n - 1], local, lastPeer);
+}
+
+function main({ scenario, n }) {
+  switch (scenario) {
+    case 'first-after-generate':
+      return firstAfterGenerate(n);
+    case 'full-lifecycle':
+      return fullLifecycle(n);
+    case 'reused-local-same-peer':
+      return reusedLocalSamePeer(n);
+    case 'reused-local-peer-pool':
+      return reusedLocalPeerPool(n);
+    default:
+      throw new Error(`Unsupported scenario: ${scenario}`);
+  }
+}
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index b08d4b7a9106..d6920c8b30e2 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -134,9 +134,12 @@ void ECDH::GenerateKeys(const FunctionCallbackInfo<Value>& args) {
   ECDH* ecdh;
   ASSIGN_OR_RETURN_UNWRAP(&ecdh, args.This());
 
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.generate()) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to generate key");
   }
+  ecdh->MaybeCacheValidKeyPair(generation);
 }
 
 ECPointPointer ECDH::BufferToPoint(Environment* env,
@@ -307,6 +310,7 @@ void ECDH::SetPrivateKey(const FunctionCallbackInfo<Value>& args) {
 
   ecdh->key_ = std::move(new_key);
   ecdh->group_ = ecdh->key_.getGroup();
+  ecdh->has_valid_key_pair_ = false;
 }
 
 void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
@@ -325,6 +329,7 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
         "Failed to convert Buffer to EC_POINT");
   }
 
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.setPublicKey(pub)) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
         "Failed to set EC_POINT as the public key");
@@ -345,9 +350,22 @@ bool ECDH::IsKeyValidForCurve(const BignumPointer& private_key) {
          private_key < order;
 }
 
+void ECDH::MaybeCacheValidKeyPair(uint64_t generation) {
+  has_valid_key_pair_ = generation == ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_) valid_key_pair_generation_ = generation;
+}
+
 bool ECDH::IsKeyPairValid() {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_ && valid_key_pair_generation_ == generation) {
+    return true;
+  }
+  has_valid_key_pair_ = false;
+
   MarkPopErrorOnReturn mark_pop_error_on_return;
-  return key_.checkKey();
+  const bool is_valid = key_.checkKey();
+  if (is_valid) MaybeCacheValidKeyPair(generation);
+  return is_valid;
 }
 
 // Convert the input public key to compressed, uncompressed, or hybrid formats.
diff --git a/src/crypto/crypto_ec.h b/src/crypto/crypto_ec.h
index 9bc817f3d7f5..3e83d541d7ae 100644
--- a/src/crypto/crypto_ec.h
+++ b/src/crypto/crypto_ec.h
@@ -48,11 +48,14 @@ class ECDH final : public BaseObject {
   static void GetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  void MaybeCacheValidKeyPair(uint64_t generation);
   bool IsKeyPairValid();
   bool IsKeyValidForCurve(const ncrypto::BignumPointer& private_key);
 
   ncrypto::ECKeyPointer key_;
   const EC_GROUP* group_;
+  bool has_valid_key_pair_ = false;
+  uint64_t valid_key_pair_generation_ = 0;
 };
 
 struct EcKeyPairParams final : public MemoryRetainer {
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index ee8849163ae8..f7530aecfc5d 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -144,9 +144,15 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
     ecdh4.setPrivateKey(ecdh1.getPrivateKey());
     ecdh4.setPublicKey(ecdh1.getPublicKey());
 
+    const ecdh4Secret = ecdh4.computeSecret(ecdh2.getPublicKey());
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
+
     assert.throws(() => {
       ecdh4.setPublicKey(ecdh3.getPublicKey());
     }, { message: 'Failed to convert Buffer to EC_POINT' });
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
 
     // Verify that we can use ECDH without having to use newly generated keys.
     const ecdh5 = crypto.createECDH('secp256k1');
@@ -190,6 +196,8 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
                        sharedSecret);
     assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
                        sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
 
     // Verify that we still have the same key pair as before the computation.
     assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
@@ -260,3 +268,31 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
     '-----END EC PRIVATE KEY-----';
   crypto.createSign('SHA256').sign(ecPrivateKey);
 }
+
+if (hasFIPS(3) && availableCurves.has('secp256k1')) {
+  const originalFips = crypto.getFips();
+
+  try {
+    crypto.setFips(0);
+    const local = crypto.createECDH('secp256k1');
+    const peer = crypto.createECDH('secp256k1');
+    local.generateKeys();
+    const peerPublicKey = peer.generateKeys();
+
+    local.computeSecret(peerPublicKey);
+    crypto.setFips(1);
+    assert.throws(() => local.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+
+    const installed = crypto.createECDH('secp256k1');
+    installed.setPrivateKey(Buffer.from('cafebabe'.repeat(8), 'hex'));
+    assert.throws(() => installed.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+  } finally {
+    crypto.setFips(originalFips);
+  }
+}

From 5ceeb6e31c6373f76bef0b3612bea8ac1b65a7e1 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Fri, 4 Sep 2026 14:36:43 +0200
Subject: [PATCH 068/202] tools: refine contributor guidance workflow

Use the Node.js GitHub bot token for association checks and route the
welcome and caution messages independently.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65745
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
---
 ...ntributor.yml => contributor-guidance.yml} | 118 +++++++++---------
 1 file changed, 59 insertions(+), 59 deletions(-)
 rename .github/workflows/{first-time-contributor.yml => contributor-guidance.yml} (57%)

diff --git a/.github/workflows/first-time-contributor.yml b/.github/workflows/contributor-guidance.yml
similarity index 57%
rename from .github/workflows/first-time-contributor.yml
rename to .github/workflows/contributor-guidance.yml
index f825cd77dc05..e9a99bcb6277 100644
--- a/.github/workflows/first-time-contributor.yml
+++ b/.github/workflows/contributor-guidance.yml
@@ -1,4 +1,4 @@
-name: Welcome first-time contributors
+name: Contributor guidance
 
 on:
   pull_request_target:
@@ -7,34 +7,33 @@ on:
 permissions: {}
 
 jobs:
-  first_time_contributor:
-    name: Is first-time contributor
-    # GitHub can report first-time contributors as NONE in the event payload.
+  contributor:
+    name: Resolve contributor status
+    # Use the event only to exclude trusted associations, mannequins, and bots.
+    # Resolve every potentially external contributor with a privileged API request.
     if: >-
       github.run_attempt == 1 &&
       github.repository == 'nodejs/node' &&
-      (github.event.pull_request.author_association == 'FIRST_TIMER' ||
+      github.event.pull_request.user.type != 'Bot' &&
+      (github.event.pull_request.author_association == 'CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'FIRST_TIMER' ||
       github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
       github.event.pull_request.author_association == 'NONE')
     runs-on: ubuntu-slim
-    permissions:
-      pull-requests: read
     outputs:
-      eligible: >-
-        ${{
-          github.event.pull_request.author_association != 'NONE' ||
-          steps.recheck.outputs.eligible == 'true'
-        }}
+      is_first_time: ${{ steps.resolve.outputs.is_first_time }}
+      should_scan: ${{ steps.resolve.outputs.should_scan }}
     steps:
-      - name: Recheck contributor eligibility
-        id: recheck
-        if: github.event.pull_request.author_association == 'NONE'
+      - name: Check author association
+        id: resolve
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           NUMBER: ${{ github.event.pull_request.number }}
         run: |
           started_at=$SECONDS
-          for delay in 15 30 60 120; do
+          # TODO: Remove the retries once privileged API requests are confirmed
+          # to return the association immediately.
+          for delay in 0 15 30 60; do
             sleep "$delay"
             association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
               --jq '.author_association')
@@ -43,60 +42,66 @@ jobs:
 
             case "$association" in
               FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
-                echo 'eligible=true' >> "$GITHUB_OUTPUT"
+                echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              CONTRIBUTOR)
+                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
                 exit 0
                 ;;
               NONE)
                 ;;
-              *)
-                echo 'eligible=false' >> "$GITHUB_OUTPUT"
+              COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
+                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=false' >> "$GITHUB_OUTPUT"
                 exit 0
                 ;;
+              *)
+                echo "Unexpected author association: $association" >&2
+                exit 1
+                ;;
             esac
           done
 
-          echo 'eligible=false' >> "$GITHUB_OUTPUT"
+          # NONE is unresolved, not trusted. Scan without posting the welcome.
+          echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+          echo 'should_scan=true' >> "$GITHUB_OUTPUT"
 
-  agentscan:
-    needs: first_time_contributor
-    if: needs.first_time_contributor.outputs.eligible == 'true'
+  guidance:
+    name: Apply contributor guidance
+    needs: contributor
+    if: needs.contributor.outputs.should_scan == 'true'
     runs-on: ubuntu-slim
     permissions:
       contents: read
-    outputs:
-      scan_outcome: ${{ steps.scan.outcome }}
-      classification: ${{ steps.scan.outputs.classification }}
-      community_flagged: ${{ steps.scan.outputs['community-flagged'] }}
+      pull-requests: write
     steps:
       - name: Scan contributor activity
-        id: scan
+        id: agentscan
         # The welcome should still be posted if this advisory scan fails.
         continue-on-error: true
-        uses: MatteoGabriele/agentscan-action@98202262c925c508d4c1424b1dfbe17ee35b0c02  # v2.4.0
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
         with:
           github-token: ${{ github.token }}
-          mode: silent
+          mode: labels
           scan-pull-requests: true
           scan-issues: false
           auto-close: false
           honeypot: false
 
-  comment:
-    needs:
-      - first_time_contributor
-      - agentscan
-    if: needs.first_time_contributor.outputs.eligible == 'true'
-    runs-on: ubuntu-slim
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Welcome first-time contributor
+      - name: Comment with contributor guidance
         env:
+          ADD_CAUTION: >-
+            ${{
+              steps.agentscan.outputs.classification == 'mixed' ||
+              steps.agentscan.outputs.classification == 'automation' ||
+              steps.agentscan.outputs['community-flagged'] == 'true'
+            }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IS_FIRST_TIME: ${{ needs.contributor.outputs.is_first_time }}
           NUMBER: ${{ github.event.pull_request.number }}
-          AGENTSCAN_OUTCOME: ${{ needs.agentscan.outputs.scan_outcome }}
-          AGENTSCAN_CLASSIFICATION: ${{ needs.agentscan.outputs.classification }}
-          AGENTSCAN_COMMUNITY_FLAGGED: ${{ needs.agentscan.outputs.community_flagged }}
           WELCOME_MESSAGE: >2-
               Welcome to Node.js, and thank you for your first contribution!
 
@@ -128,20 +133,15 @@ jobs:
             [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
             for additional context.
         run: |
-          add_caution=false
-          if [[ "$AGENTSCAN_OUTCOME" == "success" ]]; then
-            case "$AGENTSCAN_CLASSIFICATION" in
-              mixed|automation)
-                add_caution=true
-                ;;
-            esac
-            if [[ "$AGENTSCAN_COMMUNITY_FLAGGED" == "true" ]]; then
-              add_caution=true
-            fi
+          if [[ "$IS_FIRST_TIME" == "true" && "$ADD_CAUTION" == "true" ]]; then
+            body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE"
+          elif [[ "$IS_FIRST_TIME" == "true" ]]; then
+            body="$WELCOME_MESSAGE"
+          elif [[ "$ADD_CAUTION" == "true" ]]; then
+            body="$CAUTION_MESSAGE"
+          else
+            exit 0
           fi
 
-          if [[ "$add_caution" == "true" ]]; then
-            printf '%s\n\n%s\n' "$WELCOME_MESSAGE" "$CAUTION_MESSAGE"
-          else
-            printf '%s\n' "$WELCOME_MESSAGE"
-          fi | gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
+          printf '%s\n' "$body" |
+            gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -

From ddc0a0aa2848d19da7a893b17d5c424bf335c021 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sun, 16 Aug 2026 17:24:50 +0000
Subject: [PATCH 069/202] worker: start worker threads from the built-in
 snapshot

Every `new Worker()` runs the whole internal bootstrap (realm, node, web
exposure, thread and process-state switches) in its fresh isolate,
compiling ~80 builtins with the code cache; only the main thread
deserializes its principal context from the built-in snapshot. That
bootstrap is about half of a worker's cold start.

The bootstrapped principal context in the snapshot is nearly
thread-neutral: the worker-side switch scripts (is_not_main_thread,
does_not_own_process_state) are written as overrides of the main-thread
ones, and the per-thread values of the `worker` binding were the only
thread-specific data baked into the context. Let a worker deserialize
that same context and EnvSerializeInfo and apply the two worker-side
switches on top:

- worker binding: threadId, threadName, isMainThread, isInternalThread,
  ownsProcessState and resourceLimits become lazy properties of the
  per-isolate template, computed from the Environment on first read.
- CreateEnvironment(): when a worker (its IsolateData has a Worker)
  passes an empty context, deserialize kNodeMainContextIndex and run
  internal/bootstrap/switches/is_not_main_thread and, unless the worker
  owns process state, does_not_own_process_state after
  InitializeMainContext().
- Worker::Run(): take that path when the embedded built-in snapshot is
  in use (not an embedder's or a --snapshot-blob one, which has run
  application code), browser globals are not disabled and
  --no-worker-snapshot was not given; otherwise bootstrap as before.
- is_not_main_thread.js: also delete _debugPause and the profiler idle
  notifier helpers that is_main_thread.js installs.
- pre_execution: run the snapshot's deserialize callbacks (Buffer pool,
  default resolver, cached cwd) on worker threads too, now that a worker
  can come from a snapshot.
- --[no-]worker-snapshot per-isolate option, documented.

Sequential new Worker() -> 'online' -> terminate goes from ~20.9 ms to
~10.3 ms per worker on x64 Linux; --no-worker-snapshot restores the old
number.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65336
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
---
 doc/api/cli.md                                |  12 ++
 doc/node.1                                    |   6 +
 .../bootstrap/switches/is_not_main_thread.js  |   6 +
 lib/internal/process/pre_execution.js         |   4 +-
 src/api/environment.cc                        |  24 +++
 src/node_options.cc                           |   6 +
 src/node_options.h                            |   1 +
 src/node_worker.cc                            | 150 +++++++++++-------
 src/node_worker.h                             |   1 +
 test/parallel/test-bootstrap-modules.js       |  13 +-
 10 files changed, 162 insertions(+), 61 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 804cc1472007..220af9fcf226 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -2402,6 +2402,17 @@ added: v6.0.0
 
 Silence all process warnings (including deprecations).
 
+### `--no-worker-snapshot`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+
 ### `--node-memory-debug`
 
 <!-- YAML
@@ -4102,6 +4113,7 @@ one is included in the list below.
 * `--no-strip-types`
 * `--no-warnings`
 * `--no-webstorage`
+* `--no-worker-snapshot`
 * `--node-memory-debug`
 * `--openssl-config`
 * `--openssl-legacy-provider`
diff --git a/doc/node.1 b/doc/node.1
index 7307ebf4abf3..07d8767727dc 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -1209,6 +1209,10 @@ For more information, see the TypeScript type-stripping documentation.
 .It Fl -no-warnings
 Silence all process warnings (including deprecations).
 .
+.It Fl -no-worker-snapshot
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+.
 .It Fl -node-memory-debug
 Enable extra debug checks for memory leaks in Node.js internals. This is
 usually only useful for developers debugging Node.js itself.
@@ -2198,6 +2202,8 @@ one is included in the list below.
 .It
 \fB--no-webstorage\fR
 .It
+\fB--no-worker-snapshot\fR
+.It
 \fB--node-memory-debug\fR
 .It
 \fB--openssl-config\fR
diff --git a/lib/internal/bootstrap/switches/is_not_main_thread.js b/lib/internal/bootstrap/switches/is_not_main_thread.js
index 6fa30aec748a..1716bea20149 100644
--- a/lib/internal/bootstrap/switches/is_not_main_thread.js
+++ b/lib/internal/bootstrap/switches/is_not_main_thread.js
@@ -6,6 +6,12 @@ const {
 
 delete process._debugProcess;
 delete process._debugEnd;
+// Also drop the other main-thread-only helpers is_main_thread.js installs, so
+// that this switch can be applied on top of a context bootstrapped for the
+// main thread (as when a worker starts from the built-in snapshot).
+delete process._debugPause;
+delete process._startProfilerIdleNotifier;
+delete process._stopProfilerIdleNotifier;
 
 function defineStream(name, getter) {
   ObjectDefineProperty(process, name, {
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index 1c9d903f0c9c..817b76cfc74b 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -163,14 +163,12 @@ function prepareExecution(options) {
     // channel. This needs to be done before any user code gets executed
     // (including preload modules).
     initializeClusterIPC();
-
-    // TODO(joyeecheung): do this for worker threads as well.
-    runDeserializeCallbacks();
   } else {
     assert(!internalBinding('worker').isMainThread);
     // The setup should be called in LOAD_SCRIPT message handler.
     assert(!initializeModules);
   }
+  runDeserializeCallbacks();
 
   const { initializeExtensionFormatMap } = require('internal/modules/esm/get_format');
   initializeExtensionFormatMap();
diff --git a/src/api/environment.cc b/src/api/environment.cc
index 459830a2af80..40aef133596e 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -425,6 +425,11 @@ Environment* CreateEnvironment(
 
   const bool use_snapshot = context.IsEmpty();
   const EnvSerializeInfo* env_snapshot_info = nullptr;
+  // A worker thread (its IsolateData knows its Worker) deserializes the same
+  // bootstrapped principal context the main thread uses and then has the
+  // worker-side bootstrap switches applied on top of it (they are written as
+  // overrides of the main-thread setup).
+  const bool for_worker = isolate_data->worker_context() != nullptr;
   if (use_snapshot) {
     CHECK_NOT_NULL(isolate_data->snapshot_data());
     env_snapshot_info = &isolate_data->snapshot_data()->env_info;
@@ -466,6 +471,25 @@ Environment* CreateEnvironment(
   Context::Scope context_scope(context);
   env->InitializeMainContext(context, env_snapshot_info);
 
+  if (use_snapshot && for_worker) {
+    // The deserialized context went through is_main_thread /
+    // does_own_process_state when the snapshot was built; the worker-side
+    // switches redefine exactly those pieces (stdio getters, signal wiring,
+    // process.abort/chdir/umask/..., debug helpers).
+    if (env->principal_realm()
+            ->ExecuteBootstrapper(
+                "internal/bootstrap/switches/is_not_main_thread")
+            .IsEmpty() ||
+        (!env->owns_process_state() &&
+         env->principal_realm()
+             ->ExecuteBootstrapper(
+                 "internal/bootstrap/switches/does_not_own_process_state")
+             .IsEmpty())) {
+      FreeEnvironment(env);
+      return nullptr;
+    }
+  }
+
 #if HAVE_INSPECTOR
   if (env->should_create_inspector()) {
     if (inspector_parent_handle) {
diff --git a/src/node_options.cc b/src/node_options.cc
index d9c0b70fbd56..219790c7e816 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -1366,6 +1366,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
 PerIsolateOptionsParser::PerIsolateOptionsParser(
   const EnvironmentOptionsParser& eop) {
+  AddOption("--worker-snapshot",
+            "start worker threads from the bootstrapped context in the "
+            "built-in startup snapshot",
+            BOOL_FIELD(worker_snapshot),
+            kAllowedInEnvvar,
+            true);
   AddOption("--track-heap-objects",
             "track heap object allocations for heap snapshots",
             BOOL_FIELD(track_heap_objects),
diff --git a/src/node_options.h b/src/node_options.h
index 4ee8a575cb3e..ddeb2cf9b08c 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -319,6 +319,7 @@ class EnvironmentOptions : public Options {
 
 class PerIsolateOptions : public Options {
  public:
+  bool worker_snapshot = true;  // --[no-]worker-snapshot
   PerIsolateOptions() = default;
   PerIsolateOptions(PerIsolateOptions&&) = default;
 
diff --git a/src/node_worker.cc b/src/node_worker.cc
index 10386498e7df..1a12946593ab 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -16,6 +16,7 @@
 #include "v8-profiler.h"
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <vector>
 
@@ -292,6 +293,18 @@ size_t Worker::NearHeapLimit(void* data, size_t current_heap_limit,
   return new_limit;
 }
 
+// Can this worker start by deserializing the bootstrapped principal context
+// from the embedded snapshot (plus the worker-side switches) instead of
+// bootstrapping from scratch? Only that snapshot qualifies: an embedder's own
+// or a --snapshot-blob one has run application code in its main context.
+// --no-worker-snapshot opts out; kNoBrowserGlobals changes the bootstrap.
+bool Worker::UseWorkerContextSnapshot() const {
+  return snapshot_data_ != nullptr &&
+         snapshot_data_ == SnapshotBuilder::GetEmbeddedSnapshotData() &&
+         !(environment_flags_ & EnvironmentFlags::kNoBrowserGlobals) &&
+         per_process::cli_options->per_isolate->worker_snapshot;
+}
+
 void Worker::Run() {
   std::string trace_name = "[worker " + std::to_string(thread_id_.id) + "]" +
                            (name_ == "" ? "" : " " + name_);
@@ -340,7 +353,15 @@ void Worker::Run() {
         // resource constraints, we need something in place to handle it,
         // though.
         TryCatch try_catch(isolate_);
-        if (snapshot_data_ != nullptr) {
+        if (UseWorkerContextSnapshot()) {
+          // Leave `context` empty: CreateEnvironment() deserializes the
+          // bootstrapped principal context (kNodeMainContextIndex) and the
+          // Environment state that goes with it, applies the worker-side
+          // switches, and skips RunBootstrapping().
+          Debug(this,
+                "Worker %llu deserializes the bootstrapped context\n",
+                thread_id_.id);
+        } else if (snapshot_data_ != nullptr) {
           Debug(this,
                 "Worker %llu uses context from snapshot %d\n",
                 thread_id_.id,
@@ -357,7 +378,7 @@ void Worker::Run() {
               this, "Worker %llu builds context from scratch\n", thread_id_.id);
           context = NewContext(isolate_);
         }
-        if (context.IsEmpty()) {
+        if (context.IsEmpty() && !UseWorkerContextSnapshot()) {
           // TODO(joyeecheung): maybe this should be kBootstrapFailure instead?
           Exit(ExitCode::kGenericUserError,
                "ERR_WORKER_INIT_FAILED",
@@ -367,8 +388,8 @@ void Worker::Run() {
       }
 
       if (is_stopped()) return;
-      CHECK(!context.IsEmpty());
-      Context::Scope context_scope(context);
+      std::optional<Context::Scope> context_scope;
+      if (!context.IsEmpty()) context_scope.emplace(context);
       {
 #if HAVE_INSPECTOR
         environment_flags_ |= EnvironmentFlags::kNoWaitForInspectorFrontend;
@@ -384,6 +405,7 @@ void Worker::Run() {
             name_));
         if (is_stopped()) return;
         CHECK_NOT_NULL(env_);
+        if (!context_scope) context_scope.emplace(env_->context());
         env_->set_env_vars(std::move(env_vars_));
         SetProcessExitHandler(env_.get(), [this](Environment*, int exit_code) {
           Exit(static_cast<ExitCode>(exit_code));
@@ -1416,8 +1438,70 @@ void GetEnvMessagePort(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// Per-thread values of the `worker` binding are lazy properties of the
+// per-isolate template, so that a bootstrapped context carries none of them
+// and can be deserialized by any thread.
+void ThreadIdGetter(Local<v8::Name>,
+                    const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  info.GetReturnValue().Set(static_cast<double>(env->thread_id()));
+}
+
+void ThreadNameGetter(Local<v8::Name>,
+                      const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  Local<String> name;
+  if (String::NewFromUtf8(info.GetIsolate(),
+                          env->thread_name().data(),
+                          NewStringType::kNormal,
+                          env->thread_name().size())
+          .ToLocal(&name)) {
+    info.GetReturnValue().Set(name);
+  }
+}
+
+void IsMainThreadGetter(Local<v8::Name>,
+                        const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(Environment::GetCurrent(info)->is_main_thread());
+}
+
+void IsInternalThreadGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  Worker* worker =
+      Environment::GetCurrent(info)->isolate_data()->worker_context();
+  info.GetReturnValue().Set(worker != nullptr && worker->is_internal());
+}
+
+void OwnsProcessStateGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(
+      Environment::GetCurrent(info)->owns_process_state());
+}
+
+void ResourceLimitsGetter(Local<v8::Name>,
+                          const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  if (env->worker_context() != nullptr) {
+    info.GetReturnValue().Set(
+        env->worker_context()->GetResourceLimits(info.GetIsolate()));
+  }
+}
+
 void CreateWorkerPerIsolateProperties(IsolateData* isolate_data,
                                       Local<ObjectTemplate> target) {
+  {
+    Isolate* isolate = isolate_data->isolate();
+    auto lazy = [&](const char* name, v8::AccessorNameGetterCallback getter) {
+      target->SetLazyDataProperty(OneByteString(isolate, name), getter);
+    };
+    lazy("threadId", ThreadIdGetter);
+    lazy("threadName", ThreadNameGetter);
+    lazy("isMainThread", IsMainThreadGetter);
+    lazy("isInternalThread", IsInternalThreadGetter);
+    lazy("ownsProcessState", OwnsProcessStateGetter);
+    lazy("resourceLimits", ResourceLimitsGetter);
+  }
+
   Isolate* isolate = isolate_data->isolate();
 
   {
@@ -1522,55 +1606,9 @@ void CreateWorkerPerContextProperties(Local<Object> target,
                                       Local<Value> unused,
                                       Local<Context> context,
                                       void* priv) {
-  Environment* env = Environment::GetCurrent(context);
-  Isolate* isolate = env->isolate();
-
-  target
-      ->Set(env->context(),
-            env->thread_id_string(),
-            Number::New(isolate, static_cast<double>(env->thread_id())))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            env->thread_name_string(),
-            String::NewFromUtf8(isolate,
-                                env->thread_name().data(),
-                                NewStringType::kNormal,
-                                env->thread_name().size())
-                .ToLocalChecked())
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isMainThread"),
-            Boolean::New(isolate, env->is_main_thread()))
-      .Check();
-
-  Worker* worker = env->isolate_data()->worker_context();
-  bool is_internal = worker != nullptr && worker->is_internal();
-
-  // Set the is_internal property
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isInternalThread"),
-            Boolean::New(isolate, is_internal))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "ownsProcessState"),
-            Boolean::New(isolate, env->owns_process_state()))
-      .Check();
-
-  if (!env->is_main_thread()) {
-    target
-        ->Set(env->context(),
-              FIXED_ONE_BYTE_STRING(isolate, "resourceLimits"),
-              env->worker_context()->GetResourceLimits(isolate))
-        .Check();
-  }
-
+  // threadId, threadName, isMainThread, isInternalThread, ownsProcessState
+  // and resourceLimits are lazy properties of the per-isolate template (see
+  // CreateWorkerPerIsolateProperties).
   NODE_DEFINE_CONSTANT(target, kMaxYoungGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kMaxOldGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kCodeRangeSizeMb);
@@ -1580,6 +1618,12 @@ void CreateWorkerPerContextProperties(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetEnvMessagePort);
+  registry->Register(ThreadIdGetter);
+  registry->Register(ThreadNameGetter);
+  registry->Register(IsMainThreadGetter);
+  registry->Register(IsInternalThreadGetter);
+  registry->Register(OwnsProcessStateGetter);
+  registry->Register(ResourceLimitsGetter);
   registry->Register(Worker::New);
   registry->Register(Worker::StartThread);
   registry->Register(Worker::StopThread);
diff --git a/src/node_worker.h b/src/node_worker.h
index fd02b1d381ed..894256053dc0 100644
--- a/src/node_worker.h
+++ b/src/node_worker.h
@@ -42,6 +42,7 @@ class Worker : public AsyncWrap {
 
   // Run the worker. This is only called from the worker thread.
   void Run();
+  bool UseWorkerContextSnapshot() const;
 
   // Forcibly exit the thread with a specified exit code. This may be called
   // from any thread. `error_code` and `error_message` can be used to create
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index b4827a13fcea..e6a40d45e26f 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -118,12 +118,14 @@ expected.atRunTime = new Set([
 
 const { isMainThread } = require('worker_threads');
 // Binaries built without the snapshot (e.g. cross-compiled) and
-// --no-node-snapshot bootstrap the main context from scratch, like a worker.
-const mainContextFromSnapshot = isMainThread &&
+// --no-node-snapshot bootstrap the context from scratch; so do workers under
+// --no-worker-snapshot.
+const contextFromSnapshot =
   process.config.variables.node_use_node_snapshot &&
-  !process.execArgv.includes('--no-node-snapshot');
+  !process.execArgv.includes('--no-node-snapshot') &&
+  (isMainThread || !process.execArgv.includes('--no-worker-snapshot'));
 
-if (mainContextFromSnapshot) {
+if (contextFromSnapshot) {
   [
     'Internal Binding cjs_lexer',
     'NativeModule internal/modules/esm/assert',
@@ -148,7 +150,8 @@ if (mainContextFromSnapshot) {
 } else if (isMainThread) {
   expected.beforePreExec.delete(getFormatNativeModule);
   expected.atRunTime.add(getFormatNativeModule);
-} else {  // Worker.
+}
+if (!isMainThread) {
   [
     'NativeModule diagnostics_channel',
     'NativeModule internal/abort_controller',

From 0df3c02e8b306a41fdc942351d87bfb5dbad7413 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 28 Aug 2026 23:04:31 +0200
Subject: [PATCH 070/202] build: add `--shared-abseil` configure flag

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65682
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .github/workflows/test-shared.yml |  2 +
 Makefile                          |  1 +
 configure.py                      | 87 +++++++++++++++++++++++++++++++
 node.gyp                          |  5 +-
 shell.nix                         |  3 ++
 tools/nix/sharedLibDeps.nix       |  1 +
 tools/nix/v8.nix                  | 26 +++++----
 tools/v8_gypfiles/d8.gyp          |  4 +-
 tools/v8_gypfiles/v8.gyp          | 55 ++++++++++++++-----
 tools/v8_gypfiles/v8windbg.gyp    | 13 ++++-
 10 files changed, 168 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 1f1afdd89dd2..92f5d4f5d480 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -33,6 +33,7 @@ on:
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -86,6 +87,7 @@ on:
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
diff --git a/Makefile b/Makefile
index 62a9bc34e93e..b35b1ff4eeaa 100644
--- a/Makefile
+++ b/Makefile
@@ -1322,6 +1322,7 @@ ifeq ($(SKIP_SHARED_DEPS), 1)
 	$(RM) -r $(TARNAME)/deps/sqlite
 	$(RM) -r $(TARNAME)/deps/uv
 	$(RM) -r $(TARNAME)/deps/uvwasi
+	$(RM) -r $(TARNAME)/deps/v8/third_party/abseil-cpp
 	$(RM) -r $(TARNAME)/deps/zlib
 	$(RM) -r $(TARNAME)/deps/zstd
 else
diff --git a/configure.py b/configure.py
index b11c4e3284d0..5c2a398989af 100755
--- a/configure.py
+++ b/configure.py
@@ -282,6 +282,28 @@
     help='Use the specified path to system CA (PEM format) in addition to '
          'the OpenSSL supplied CA store or compiled-in Mozilla CA copy.')
 
+shared_optgroup.add_argument('--shared-abseil',
+    action='store_true',
+    dest='shared_abseil',
+    default=None,
+    help='link to a shared Abseil DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-abseil-includes',
+    action='store',
+    dest='shared_abseil_includes',
+    help='directory containing Abseil header files')
+
+shared_optgroup.add_argument('--shared-abseil-libname',
+    action='store',
+    dest='shared_abseil_libname',
+    default=None,
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-abseil-libpath',
+    action='store',
+    dest='shared_abseil_libpath',
+    help='a directory to search for the shared Abseil DLL')
+
 shared_optgroup.add_argument('--shared-gtest',
     action='store_true',
     dest='shared_gtest',
@@ -2814,6 +2836,71 @@ def make_bin_override():
 configure_library('zlib', output)
 configure_library('http_parser', output, pkgname='libllhttp')
 configure_library('libuv', output)
+configure_library('abseil', output, pkgname=[
+  'absl_absl_check',
+  'absl_absl_log',
+  'absl_absl_vlog_is_on',
+  'absl_algorithm_container',
+  'absl_algorithm',
+  'absl_any_invocable',
+  'absl_base',
+  'absl_bind_front',
+  'absl_bits',
+  'absl_btree',
+  'absl_charset',
+  'absl_cleanup',
+  'absl_config',
+  'absl_cord',
+  'absl_core_headers',
+  'absl_die_if_null',
+  'absl_dynamic_annotations',
+  'absl_failure_signal_handler',
+  'absl_fast_type_id',
+  'absl_fixed_array',
+  'absl_flat_hash_map',
+  'absl_flat_hash_set',
+  'absl_function_ref',
+  'absl_has_ostream_operator',
+  'absl_hash_container_defaults',
+  'absl_hash',
+  'absl_inlined_vector',
+  'absl_int128',
+  'absl_layout',
+  'absl_leak_check',
+  'absl_linked_hash_map',
+  'absl_linked_hash_set',
+  'absl_log_entry',
+  'absl_log_globals',
+  'absl_log_initialize',
+  'absl_log_severity',
+  'absl_log_sink_registry',
+  'absl_log_sink',
+  'absl_memory',
+  'absl_no_destructor',
+  'absl_node_hash_map',
+  'absl_node_hash_set',
+  'absl_nullability',
+  'absl_optional',
+  'absl_overload',
+  'absl_prefetch',
+  'absl_random_bit_gen_ref',
+  'absl_random_distributions',
+  'absl_random_random',
+  'absl_raw_logging_internal',
+  'absl_span',
+  'absl_stacktrace',
+  'absl_status',
+  'absl_statusor',
+  'absl_str_format',
+  'absl_string_view',
+  'absl_strings',
+  'absl_symbolize',
+  'absl_synchronization',
+  'absl_time',
+  'absl_type_traits',
+  'absl_utility',
+  'absl_variant',
+])
 configure_library('ada', output)
 configure_library('simdjson', output)
 configure_library('simdutf', output)
diff --git a/node.gyp b/node.gyp
index 942bea024498..8777cdc17d0e 100644
--- a/node.gyp
+++ b/node.gyp
@@ -15,6 +15,7 @@
     'node_lib_target_name%': 'libnode',
     'node_module_version%': '',
     'node_no_browser_globals%': 'false',
+    'node_shared_abseil%': 'false',
     'node_shared_brotli%': 'false',
     'node_shared_cares%': 'false',
     'node_shared_gtest%': 'false',
@@ -901,7 +902,7 @@
         [ 'node_builtin_modules_path!=""', {
           'defines': [ 'NODE_BUILTIN_MODULES_PATH="<(node_builtin_modules_path)"' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_gtest=="false"', {
@@ -1369,7 +1370,7 @@
         [ 'node_shared_gtest=="true"', {
           'libraries': [ '-lgtest_main' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_hdr_histogram=="false"', {
diff --git a/shell.nix b/shell.nix
index 9b4d9da55855..365c3540915b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -63,6 +63,7 @@ let
     ];
   buildInputs =
     pkgs.lib.optional useSharedICU icu
+    ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) sharedLibDeps.abseil
     ++ pkgs.lib.optional (withTemporal && useSharedTemporal) sharedLibDeps.temporal_capi;
 
   # Put here only the configure flags that affect the V8 build
@@ -75,6 +76,7 @@ let
     )
     "--v8-${if withTemporal then "enable" else "disable"}-temporal-support"
   ]
+  ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) "--shared-abseil"
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
@@ -132,6 +134,7 @@ pkgs.mkShell {
             builtins.attrNames (
               if (useSeparateDerivationForV8 != false) then
                 builtins.removeAttrs sharedLibDeps [
+                  "abseil"
                   "simdutf"
                   "temporal_capi"
                 ]
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 14494bbe1648..7e789e1f034f 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -22,6 +22,7 @@
     zlib
     zstd
     ;
+  abseil = pkgs.abseil-cpp;
   cares = pkgs.c-ares;
   hdr-histogram = pkgs.hdrhistogram_c;
   http-parser = pkgs.llhttp;
diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix
index 90dadd336c8d..0338bff5ddb5 100644
--- a/tools/nix/v8.nix
+++ b/tools/nix/v8.nix
@@ -23,6 +23,7 @@
 }:
 
 let
+  useSharedAbseil = builtins.elem "--shared-abseil" configureFlags;
   src =
     let
       inherit (lib) fileset;
@@ -35,7 +36,6 @@ let
         ../../node.gypi
         ../../tools/gyp/pylib
         ../../tools/gyp_node.py
-        ../../tools/v8_gypfiles/abseil.gyp
         ../../tools/v8_gypfiles/features.gypi
         ../../tools/v8_gypfiles/ForEachFormat.py
         ../../tools/v8_gypfiles/ForEachReplace.py
@@ -44,6 +44,7 @@ let
         ../../tools/v8_gypfiles/toolchain.gypi
         ../../tools/v8_gypfiles/v8.gyp
       ]
+      ++ lib.optional (!useSharedAbseil) ../../tools/v8_gypfiles/abseil.gyp
       ++ lib.optionals (builtins.elem "--with-perfetto" configureFlags) [
         ../../deps/perfetto
       ]
@@ -63,12 +64,15 @@ let
       potentiallyAlreadyRemovedFiles =
         # Files that are removed in the release tarball (see Makefile $(TARBALL) target)
         [ (fileset.difference ../../deps/v8/test ../../deps/v8/test/torque) ]
-        ++ (builtins.filter builtins.pathExists [
-          ../../deps/v8/samples
-          ../../deps/v8/tools/profviz
-          ../../deps/v8/tools/run-tests.py
-          ../../deps/v8/third_party/ittapi
-        ]);
+        ++ (builtins.filter builtins.pathExists (
+          [
+            ../../deps/v8/samples
+            ../../deps/v8/tools/profviz
+            ../../deps/v8/tools/run-tests.py
+            ../../deps/v8/third_party/ittapi
+          ]
+          ++ lib.optional useSharedAbseil ../../deps/v8/third_party/abseil-cpp
+        ));
       trackedFiles =
         ({
           # This line is being modified by Makefile $(TARBALL) target, any change to it should be sync
@@ -197,9 +201,11 @@ stdenv.mkDerivation (finalAttrs: {
     find deps/v8/include -name '*.h' -print0 | while read -r -d "" file; do
       install -Dm644 "$file" -T "$out/include/''${file#deps/v8/include/}"
     done
-    find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
-      install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
-    done
+    ${lib.optionalString (!useSharedAbseil) ''
+      find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
+        install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
+      done
+    ''}
 
     mkdir -p $out/lib/pkgconfig
     cat -> $out/lib/pkgconfig/v8.pc << EOF
diff --git a/tools/v8_gypfiles/d8.gyp b/tools/v8_gypfiles/d8.gyp
index 5b47ebf180dd..f59a155b169c 100644
--- a/tools/v8_gypfiles/d8.gyp
+++ b/tools/v8_gypfiles/d8.gyp
@@ -16,7 +16,6 @@
       'target_name': 'd8',
       'type': 'executable',
       'dependencies': [
-        'abseil.gyp:abseil',
         'v8.gyp:v8',
         'v8.gyp:v8_libbase',
         'v8.gyp:v8_libplatform',
@@ -77,6 +76,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },
   ],
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 7c7ebc8af42a..bd9c548becb0 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -288,7 +288,6 @@
         'v8_base_without_compiler',
         'v8_initializers',
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<(V8_ROOT)/src/init/setup-isolate-full.cc',
@@ -299,6 +298,9 @@
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_init
     {
@@ -310,7 +312,6 @@
         'v8_base_without_compiler',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'include_dirs': [
         '<(SHARED_INTERMEDIATE_DIR)',
@@ -390,6 +391,9 @@
              '<(V8_ROOT)/src/builtins/builtins-intl-gen.cc',
            ],
          }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_initializers
     {
@@ -508,7 +512,6 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }, {
           'dependencies': [
@@ -521,9 +524,11 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
         ['OS=="win" and clang==1', {
           'actions': [
             {
@@ -637,7 +642,6 @@
         'v8_libbase',
         'fp16',
         'highway',
-        'abseil.gyp:abseil',
       ],
       'direct_dependent_settings': {
         'sources': [
@@ -882,6 +886,11 @@
           }],
         ],
       },
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
     },  # v8_internal_headers
     {
       'target_name': 'v8_compiler_sources',
@@ -983,7 +992,6 @@
         'v8_libbase',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
         ['v8_use_perfetto==1', {
@@ -1001,6 +1009,9 @@
         }, {
           'sources': ['<(V8_ROOT)/src/compiler/turbofan-disabled.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_compiler
     {
@@ -1104,7 +1115,6 @@
         'v8_zlib',
         'v8_pch',
         'simdutf',
-        'abseil.gyp:abseil',
       ],
       'includes': ['inspector.gypi'],
       'direct_dependent_settings': {
@@ -1391,6 +1401,9 @@
             'libraries': ['-latomic', ],
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_base_without_compiler
     {
@@ -1412,7 +1425,6 @@
       'dependencies': [
         'v8_shared_internal_headers',
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1438,6 +1450,9 @@
           'cflags!': ['-O3'],
           'sources': ['<(V8_ROOT)/src/torque/implementation-visitor.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # torque_base
     {
@@ -1477,7 +1492,6 @@
 
       'dependencies': [
         'v8_headers',
-        'abseil.gyp:abseil',
       ],
 
       'conditions': [
@@ -1718,6 +1732,9 @@
           ],
         }
          ],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_libbase
     {
@@ -1726,7 +1743,6 @@
       'toolsets': ['host', 'target'],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?sources = ")',
@@ -1761,6 +1777,9 @@
             '<(V8_ROOT)/src/libplatform/tracing/recorder-mac.cc',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'direct_dependent_settings': {
         'include_dirs': [
@@ -1801,6 +1820,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         'BUILDING_V8_SHARED=1',
@@ -1808,7 +1830,6 @@
       ],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1831,7 +1852,6 @@
         'v8_libplatform',
         'v8_maybe_icu',
         'v8_pch',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1878,6 +1898,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # mksnapshot
     {
@@ -1885,7 +1908,6 @@
       'type': 'executable',
       'dependencies': [
         'torque_base',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'conditions': [
@@ -1906,6 +1928,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1983,7 +2008,6 @@
         'v8_libbase',
         # "build/win:default_exe_manifest",
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
         ['want_separate_host_toolset', {
@@ -2003,6 +2027,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'sources': [
         "<(V8_ROOT)/src/regexp/gen-regexp-special-case.cc",
diff --git a/tools/v8_gypfiles/v8windbg.gyp b/tools/v8_gypfiles/v8windbg.gyp
index 13d4306f224e..8ea9fd0169f7 100644
--- a/tools/v8_gypfiles/v8windbg.gyp
+++ b/tools/v8_gypfiles/v8windbg.gyp
@@ -50,7 +50,6 @@
       'dependencies': [
         'gen_heap_constants',
 
-        'abseil.gyp:abseil',
         'v8.gyp:generate_bytecode_builtins_list',
         'v8.gyp:run_torque',
         'v8.gyp:v8_maybe_icu',
@@ -86,6 +85,12 @@
           },
         },
       },
+
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
     },  # v8_debug_helper
     {
       'target_name': 'gen_heap_constants',
@@ -151,7 +156,6 @@
         '<(V8_ROOT)/include',
       ],
       'dependencies': [
-        'abseil.gyp:abseil',
         'v8.gyp:v8_snapshot',
         'v8.gyp:v8_libbase',
         'v8.gyp:v8_libplatform',
@@ -160,6 +164,11 @@
         'v8.gyp:generate_bytecode_builtins_list',
         'v8.gyp:run_torque',
       ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
       ]

From 1e9fd9544ef38e6e36ca1d5ab7af3bab5b20496d Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 29 Aug 2026 13:03:38 +0200
Subject: [PATCH 071/202] build: add `--shared-highway` configure flag

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65686
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .github/workflows/test-shared.yml |  2 +
 Makefile                          |  1 +
 configure.py                      | 23 +++++++++++
 node.gyp                          |  1 +
 shell.nix                         |  3 ++
 tools/nix/sharedLibDeps.nix       |  1 +
 tools/nix/v8.nix                  |  3 ++
 tools/v8_gypfiles/highway.gyp     | 58 ++++++++++++++++++++++++++
 tools/v8_gypfiles/v8.gyp          | 67 ++++---------------------------
 9 files changed, 100 insertions(+), 59 deletions(-)
 create mode 100644 tools/v8_gypfiles/highway.gyp

diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 92f5d4f5d480..96e862c35916 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -34,6 +34,7 @@ on:
       - deps/uv/**
       - deps/uvwasi/**
       - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -88,6 +89,7 @@ on:
       - deps/uv/**
       - deps/uvwasi/**
       - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
diff --git a/Makefile b/Makefile
index b35b1ff4eeaa..f0d453cf6213 100644
--- a/Makefile
+++ b/Makefile
@@ -1323,6 +1323,7 @@ ifeq ($(SKIP_SHARED_DEPS), 1)
 	$(RM) -r $(TARNAME)/deps/uv
 	$(RM) -r $(TARNAME)/deps/uvwasi
 	$(RM) -r $(TARNAME)/deps/v8/third_party/abseil-cpp
+	$(RM) -r $(TARNAME)/deps/v8/third_party/highway
 	$(RM) -r $(TARNAME)/deps/zlib
 	$(RM) -r $(TARNAME)/deps/zstd
 else
diff --git a/configure.py b/configure.py
index 5c2a398989af..99ce9326dc93 100755
--- a/configure.py
+++ b/configure.py
@@ -348,6 +348,28 @@
     dest='shared_hdr_histogram_libpath',
     help='a directory to search for the shared HdrHistogram DLL')
 
+shared_optgroup.add_argument('--shared-highway',
+    action='store_true',
+    dest='shared_highway',
+    default=None,
+    help='link to a shared Highway (hwy) DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-highway-includes',
+    action='store',
+    dest='shared_highway_includes',
+    help='directory containing Highway header files')
+
+shared_optgroup.add_argument('--shared-highway-libname',
+    action='store',
+    dest='shared_highway_libname',
+    default='hwy',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-highway-libpath',
+    action='store',
+    dest='shared_highway_libpath',
+    help='a directory to search for the shared Highway DLL')
+
 shared_optgroup.add_argument('--shared-http-parser',
     action='store_true',
     dest='shared_http_parser',
@@ -2908,6 +2930,7 @@ def make_bin_override():
 configure_library('cares', output, pkgname='libcares')
 configure_library('gtest', output)
 configure_library('hdr_histogram', output)
+configure_library('highway', output, pkgname='libhwy')
 configure_library('merve', output)
 configure_library('nbytes', output)
 configure_library('nghttp2', output, pkgname='libnghttp2')
diff --git a/node.gyp b/node.gyp
index 8777cdc17d0e..7e1e4f212cad 100644
--- a/node.gyp
+++ b/node.gyp
@@ -20,6 +20,7 @@
     'node_shared_cares%': 'false',
     'node_shared_gtest%': 'false',
     'node_shared_hdr_histogram%': 'false',
+    'node_shared_highway%': 'false',
     'node_shared_http_parser%': 'false',
     'node_shared_libuv%': 'false',
     'node_shared_lief%': 'false',
diff --git a/shell.nix b/shell.nix
index 365c3540915b..0bc13ec5c2f1 100644
--- a/shell.nix
+++ b/shell.nix
@@ -64,6 +64,7 @@ let
   buildInputs =
     pkgs.lib.optional useSharedICU icu
     ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) sharedLibDeps.abseil
+    ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) sharedLibDeps.highway
     ++ pkgs.lib.optional (withTemporal && useSharedTemporal) sharedLibDeps.temporal_capi;
 
   # Put here only the configure flags that affect the V8 build
@@ -77,6 +78,7 @@ let
     "--v8-${if withTemporal then "enable" else "disable"}-temporal-support"
   ]
   ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) "--shared-abseil"
+  ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) "--shared-highway"
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
@@ -135,6 +137,7 @@ pkgs.mkShell {
               if (useSeparateDerivationForV8 != false) then
                 builtins.removeAttrs sharedLibDeps [
                   "abseil"
+                  "highway"
                   "simdutf"
                   "temporal_capi"
                 ]
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 7e789e1f034f..c28c56acc6b5 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -25,6 +25,7 @@
   abseil = pkgs.abseil-cpp;
   cares = pkgs.c-ares;
   hdr-histogram = pkgs.hdrhistogram_c;
+  highway = pkgs.libhwy;
   http-parser = pkgs.llhttp;
 }
 // (pkgs.lib.optionalAttrs withLief {
diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix
index 0338bff5ddb5..98df8b769c2a 100644
--- a/tools/nix/v8.nix
+++ b/tools/nix/v8.nix
@@ -24,6 +24,7 @@
 
 let
   useSharedAbseil = builtins.elem "--shared-abseil" configureFlags;
+  useSharedHighway = builtins.elem "--shared-highway" configureFlags;
   src =
     let
       inherit (lib) fileset;
@@ -45,6 +46,7 @@ let
         ../../tools/v8_gypfiles/v8.gyp
       ]
       ++ lib.optional (!useSharedAbseil) ../../tools/v8_gypfiles/abseil.gyp
+      ++ lib.optional (!useSharedHighway) ../../tools/v8_gypfiles/highway.gyp
       ++ lib.optionals (builtins.elem "--with-perfetto" configureFlags) [
         ../../deps/perfetto
       ]
@@ -72,6 +74,7 @@ let
             ../../deps/v8/third_party/ittapi
           ]
           ++ lib.optional useSharedAbseil ../../deps/v8/third_party/abseil-cpp
+          ++ lib.optional useSharedHighway ../../deps/v8/third_party/highway
         ));
       trackedFiles =
         ({
diff --git a/tools/v8_gypfiles/highway.gyp b/tools/v8_gypfiles/highway.gyp
new file mode 100644
index 000000000000..c7f915b76e2f
--- /dev/null
+++ b/tools/v8_gypfiles/highway.gyp
@@ -0,0 +1,58 @@
+{
+  'includes': ['toolchain.gypi'],
+  'targets': [
+    {
+      'target_name': 'highway',
+      'type': 'static_library',
+      'toolsets': ['host', 'target'],
+      'variables': {
+        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
+      },
+      'all_dependent_settings': {
+        'include_dirs': [
+          '<(HIGHWAY_ROOT)/src',
+        ],
+        'conditions': [
+          ['v8_target_arch=="ia32"', {
+            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+          }],
+          ['v8_target_arch=="arm64"', {
+            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+          }],
+          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+          }],
+          ['v8_target_arch=="s390x"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['OS in "aix os400"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['v8_target_arch=="arm" and arm_version==7', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+        ],
+      },
+      'include_dirs': [
+        '<(HIGHWAY_ROOT)/src',
+      ],
+      'conditions': [
+        ['v8_target_arch=="ia32"', {
+          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+        }],
+        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+        }],
+        ['v8_target_arch=="riscv64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
+      ],
+    },  # highway
+  ],
+}
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index bd9c548becb0..a976148ddab0 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -641,7 +641,14 @@
         'run_torque',
         'v8_libbase',
         'fp16',
-        'highway',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        ['node_shared_highway=="false"', {
+          'dependencies': ['highway.gyp:highway'],
+        }]
       ],
       'direct_dependent_settings': {
         'sources': [
@@ -886,11 +893,6 @@
           }],
         ],
       },
-      'conditions': [
-        ['node_shared_abseil=="false"', {
-          'dependencies': ['abseil.gyp:abseil'],
-        }],
-      ],
     },  # v8_internal_headers
     {
       'target_name': 'v8_compiler_sources',
@@ -2467,59 +2469,6 @@
         ],
       },
     },  # fp16
-    {
-      'target_name': 'highway',
-      'type': 'static_library',
-      'toolsets': ['host', 'target'],
-      'variables': {
-        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
-      },
-      'all_dependent_settings': {
-        'include_dirs': [
-          '<(HIGHWAY_ROOT)/src',
-        ],
-        'conditions': [
-          ['v8_target_arch=="ia32"', {
-            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-          }],
-          ['v8_target_arch=="arm64"', {
-            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-          }],
-          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-          }],
-          ['v8_target_arch=="s390x"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['OS in "aix os400"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['v8_target_arch=="arm" and arm_version==7', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-        ],
-      },
-      'include_dirs': [
-        '<(HIGHWAY_ROOT)/src',
-      ],
-      'conditions': [
-        ['v8_target_arch=="ia32"', {
-          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-        }],
-        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-        }],
-        ['v8_target_arch=="riscv64"', {
-          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
-        }],
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
-      ],
-    },  # highway
     {
       'target_name': 'simdutf',
       'type': 'static_library',

From 791e2d2015c95ad7e70e7264482615ae52a86239 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 4 Sep 2026 16:26:28 +0200
Subject: [PATCH 072/202] doc: clarify return type of `fs.mkdtemp*`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: Hamid Reza Ghavami <hamidr.ghavami@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65743
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 doc/api/fs.md | 41 ++++++++++++++++++++++++-----------------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 1ad902ad5fb6..9be67ded1f50 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1652,8 +1652,10 @@ changes:
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
-* Returns: {Promise}  Fulfills with a string containing the file system path
-  of the newly created temporary directory.
+* Returns: {Promise} Fulfills with the created directory path.
+  If `encoding` is `'buffer'`, then the resulting directory
+  path is returned as a {Buffer}. Otherwise, the path is returned as a
+  {string} using the specified encoding.
 
 Creates a unique temporary directory. A unique directory name is generated by
 appending six random characters to the end of the provided `prefix`. Due to
@@ -1692,14 +1694,15 @@ added: v24.4.0
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
 * Returns: {Promise} Fulfills with a Promise for an async-disposable Object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {AsyncFunction} A function which removes the created directory.
   * `[Symbol.asyncDispose]` {AsyncFunction} The same as `remove`.
 
 The resulting Promise holds an async-disposable object whose `path` property
-holds the created directory path. When the object is disposed, the directory
-and its contents will be removed asynchronously if it still exists. If the
-directory cannot be deleted, disposal will throw an error. The object has an
+holds the created directory path. If `encoding` is `'buffer'`, the `path` will
+also be a {Buffer}, otherwise a {string}. When the object is disposed, the
+directory and its contents will be removed asynchronously if it still exists. If
+the directory cannot be deleted, disposal will throw an error. The object has an
 async `remove()` method which will perform the same task.
 
 Both this function and the disposal function on the resulting object are
@@ -4008,7 +4011,7 @@ changes:
   * `encoding` {string} **Default:** `'utf8'`
 * `callback` {Function}
   * `err` {Error}
-  * `directory` {string}
+  * `directory` {string|Buffer}
 
 Creates a unique temporary directory.
 
@@ -4018,12 +4021,14 @@ inconsistencies, avoid trailing `X` characters in `prefix`. Some platforms,
 notably the BSDs, can return more than six random characters, and replace
 trailing `X` characters in `prefix` with random characters.
 
-The created directory path is passed as a string to the callback's second
-parameter.
-
 The optional `options` argument can be a string specifying an encoding, or an
 object with an `encoding` property specifying the character encoding to use.
 
+The created directory path is passed to the callback's second parameter. If
+`encoding` is `'buffer'`, then the resulting directory path is passed as a
+{Buffer}. Otherwise, the path is passed as a {string} using the specified
+encoding.
+
 ```mjs
 import { mkdtemp } from 'node:fs';
 import { join } from 'node:path';
@@ -6500,9 +6505,11 @@ changes:
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
-* Returns: {string}
+* Returns: {string|Buffer}
 
-Returns the created directory path.
+Returns the created directory path. If `encoding` is `'buffer'`, then the
+resulting directory path is returned as a {Buffer}. Otherwise, the path
+is returned as a {string} using the specified encoding.
 
 For detailed information, see the documentation of the asynchronous version of
 this API: [`fs.mkdtemp()`][].
@@ -6520,15 +6527,15 @@ added: v24.4.0
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
 * Returns: {Object} A disposable object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {Function} A function which removes the created directory.
   * `[Symbol.dispose]` {Function} The same as `remove`.
 
 Returns a disposable object whose `path` property holds the created directory
-path. When the object is disposed, the directory and its contents will be
-removed if it still exists. If the directory cannot be deleted, disposal will
-throw an error. The object has a `remove()` method which will perform the same
-task.
+path. If `encoding` is `'buffer'`, the `path` will be a {Buffer}. When the
+object is disposed, the directory and its contents will be removed if it still
+exists. If the directory cannot be deleted, disposal will throw an error. The
+object has a `remove()` method which will perform the same task.
 
 See the [MDN documentation on `using` statements][`using`] for more information about
 explicit resource management.

From dd0f2032e67d89223b84001b7e15243f63852af9 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sat, 29 Aug 2026 08:24:10 +0200
Subject: [PATCH 073/202] http: fast-forward teardown of unread messages

When a response finishes and the incoming message was fully received
but never read, _dump() no longer goes through resume(): read(0) at
EOF schedules the 'end' emission directly, skipping the resume_ tick,
the 'resume' emit and the flow() machinery.

Reduces the per-request nextTick count of a hello-world HTTP server
from 7 to 6 and CPU per request by ~4%.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65732
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 lib/_http_incoming.js | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index 067a4cda3e39..ecd0d5e95179 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -299,6 +299,13 @@ IncomingMessage.prototype._destroy = function _destroy(err, cb) {
       cleanup();
       process.nextTick(onError, this, e || err, cb);
     });
+  } else if (err == null && !this.aborted) {
+    // The message was received completely and is being destroyed cleanly:
+    // complete the destroy synchronously. 'close' is still emitted on a
+    // later tick by the stream machinery. The deferral below only exists
+    // so that 'error' listeners attached right after destroy(err) still
+    // receive the error, which cannot matter when there is no error.
+    cb();
   } else {
     process.nextTick(onError, this, err, cb);
   }
@@ -512,7 +519,14 @@ IncomingMessage.prototype._dump = function _dump() {
     // If there is buffered data, it may trigger 'data' events.
     // Remove 'data' event listeners explicitly.
     this.removeAllListeners('data');
-    this.resume();
+    if (this.complete && !this.destroyed && this.readableLength === 0) {
+      // The message was fully received and never read: there is nothing to
+      // pull off the wire. Go straight to the 'end' emission instead of
+      // paying for the resume() and flow() scheduling machinery.
+      this.read(0);
+    } else {
+      this.resume();
+    }
   }
 };
 

From ee363534285292be50dcbffdeb9b85b6d4e2d6bb Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pipobscure@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:48:33 +0200
Subject: [PATCH 074/202] vfs: load native addons from a mounted file system

A native addon inside a virtual file system could not be require()d:
dlopen() and LoadLibrary() open a shared object by path, and a VFS path
has no inode for them to open.

Read the addon's bytes from the VFS and load them from a private,
self-cleaning image instead, using the smallest on-disk footprint each
platform allows: on Linux an anonymous memfd loaded through
/proc/self/fd, so the bytes never reach the file system; on other POSIX
platforms a file in a 0700 mkdtemp() directory, unlinked right after
loading, with the mapping keeping it alive; on Windows a temp file
opened FILE_FLAG_DELETE_ON_CLOSE whose handle is held until exit.

This is internal. process.dlopen() keeps its documented
(module, filename[, flags]) signature and ignores anything further; the
bytes are passed to a dlopenBinary() reachable only through the
process_methods binding, which the VFS hook calls for VFS paths. Addons
on the real file system are untouched and load directly.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65680
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/cli.md                                |  23 ++
 doc/api/vfs.md                                |   6 +
 doc/node.1                                    |  13 +
 lib/internal/vfs/setup.js                     |  22 ++
 src/node_binding.cc                           | 358 +++++++++++++++++-
 src/node_binding.h                            |   1 +
 src/node_options.cc                           |   6 +
 src/node_options.h                            |   1 +
 src/node_process_methods.cc                   |   2 +
 test/parallel/test-dlopen-binary.js           |  51 +++
 .../parallel/test-permission-dlopen-binary.js | 113 ++++++
 test/parallel/test-vfs-addon.js               |  37 ++
 12 files changed, 627 insertions(+), 6 deletions(-)
 create mode 100644 test/parallel/test-dlopen-binary.js
 create mode 100644 test/parallel/test-permission-dlopen-binary.js
 create mode 100644 test/parallel/test-vfs-addon.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 220af9fcf226..32c91c26974d 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -268,6 +268,26 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 ```
 
+### `--allow-fs-vfs`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.1 - Active development
+
+When using the [Permission Model][], a [virtual file system][] cannot be
+mounted by default: [`vfs.mount()`][] throws `ERR_INVALID_STATE` unless the
+user explicitly passes the `--allow-fs-vfs` flag when starting Node.js.
+
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on `--allow-fs-read` or
+`--allow-fs-write`.
+
+```console
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+```
+
 ### `--allow-fs-write`
 
 <!-- YAML
@@ -4021,6 +4041,7 @@ one is included in the list below.
 * `--allow-child-process`
 * `--allow-ffi`
 * `--allow-fs-read`
+* `--allow-fs-vfs`
 * `--allow-fs-write`
 * `--allow-inspector`
 * `--allow-net`
@@ -4741,6 +4762,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`v8.startupSnapshot.addDeserializeCallback()`]: v8.md#v8startupsnapshotadddeserializecallbackcallback-data
 [`v8.startupSnapshot.setDeserializeMainFunction()`]: v8.md#v8startupsnapshotsetdeserializemainfunctioncallback-data
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
+[`vfs.mount()`]: vfs.md#vfsmount
 [asynchronous module customization hooks]: module.md#asynchronous-customization-hooks
 [benchmark runner]: bench.md#command-line-runner
 [captured by the built-in snapshot of Node.js]: https://github.com/nodejs/node/blob/b19525a33cc84033af4addd0f80acd4dc33ce0cf/test/parallel/test-bootstrap-modules.js#L24
@@ -4773,4 +4795,5 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [test runner execution model]: test.md#test-runner-execution-model
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [tracking issue for user-land snapshots]: https://github.com/nodejs/node/issues/44014
+[virtual file system]: vfs.md
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
diff --git a/doc/api/vfs.md b/doc/api/vfs.md
index 333154417dc2..6f67a85ad8a8 100644
--- a/doc/api/vfs.md
+++ b/doc/api/vfs.md
@@ -419,6 +419,12 @@ system, the callers are responsible for avoiding removal or
 invalidation of modules in the virtual file system while they are
 being loaded.
 
+Native addons (`.node` files) stored in a mounted VFS can be `require()`d as
+well. The operating system's dynamic loader cannot open a virtual path, so the
+addon's bytes are read from the VFS and loaded from a private, self-cleaning
+temporary image instead. Addons on the real file system are unaffected and
+load directly.
+
 ## Use with Single Executable Applications
 
 When running as a [Single Executable Application][] built with
diff --git a/doc/node.1 b/doc/node.1
index 07d8767727dc..736df88c01be 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -166,6 +166,17 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 .Ed
 .
+.It Fl -allow-fs-vfs
+When using the Permission Model, a virtual file system cannot be
+mounted by default: \fBvfs.mount()\fR throws \fBERR_INVALID_STATE\fR unless the
+user explicitly passes the \fB--allow-fs-vfs\fR flag when starting Node.js.
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on \fB--allow-fs-read\fR or
+\fB--allow-fs-write\fR.
+.Bd -literal
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+.Ed
+.
 .It Fl -allow-fs-write
 This flag configures file system write permissions using
 the Permission Model.
@@ -2018,6 +2029,8 @@ one is included in the list below.
 .It
 \fB--allow-fs-read\fR
 .It
+\fB--allow-fs-vfs\fR
+.It
 \fB--allow-fs-write\fR
 .It
 \fB--allow-inspector\fR
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index 979990d1a855..a45cd47a9bf4 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -914,6 +914,26 @@ function installModuleLoaderOverrides() {
   });
 }
 
+let originalDlopen;
+
+function installAddonLoader() {
+  originalDlopen = process.dlopen;
+  process.dlopen = function(module, filename, flags) {
+    // dlopen(2) cannot open a native addon that lives in a VFS by path (it has
+    // no real inode). Read its bytes and hand them to the internal
+    // dlopenBinary(), which writes them to a private, self-cleaning temporary
+    // image - an in-memory memfd on Linux - and loads that. Only VFS paths take
+    // this route; everything else loads straight from disk through the
+    // unchanged process.dlopen().
+    if (StringPrototypeStartsWith(filename, normalizedVfsRootPrefix)) {
+      const { readFileSync } = require('fs');
+      const { dlopenBinary } = internalBinding('process_methods');
+      return dlopenBinary(module, filename, flags, readFileSync(filename));
+    }
+    return originalDlopen(module, filename, flags);
+  };
+}
+
 /**
  * Install all VFS hooks: module loader overrides and fs handlers.
  */
@@ -922,6 +942,7 @@ function installHooks() {
   debug('install hooks');
   normalizedVfsRootPrefix = getNormalizedVfsRoot() + sep;
   installModuleLoaderOverrides();
+  installAddonLoader();
   vfsHandlerObj = createVfsHandlers();
   setVfsHandlers(vfsHandlerObj);
   hooksInstalled = true;
@@ -939,6 +960,7 @@ function uninstallHooks() {
   setLoaderOverrides();
   setVfsHandlers(null);
   vfsHandlerObj = undefined;
+  process.dlopen = originalDlopen;
   hooksInstalled = false;
 }
 
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 26f8d046f6da..0437f59ca60e 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -9,6 +9,20 @@
 #include "util.h"
 
 #include <string>
+#include <vector>
+
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <unistd.h>
+#include <cerrno>
+#include <cstdlib>
+#if defined(__linux__)
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#endif
+#endif
 
 #if HAVE_OPENSSL
 #define NODE_BUILTIN_OPENSSL_BINDINGS(V) V(crypto) V(tls_wrap)
@@ -438,13 +452,295 @@ inline node_api_addon_get_api_version_func GetNapiAddonGetApiVersionCallback(
       dlib->GetSymbolAddress(STRINGIFY(NODE_API_MODULE_GET_API_VERSION)));
 }
 
-// DLOpen is process.dlopen(module, filename, flags).
-// Used to load 'module.node' dynamically shared objects.
+namespace {
+
+#ifndef _WIN32
+// Write the whole buffer to `fd`, retrying partial writes and EINTR.
+bool WriteAllToFd(int fd, const char* data, size_t len) {
+  size_t off = 0;
+  while (off < len) {
+    ssize_t n = write(fd, data + off, len - off);
+    if (n < 0) {
+      if (errno == EINTR) continue;
+      return false;
+    }
+    off += static_cast<size_t>(n);
+  }
+  return true;
+}
+
+#if defined(__linux__)
+int NodeMemfdCreate(const char* name, unsigned int flags) {
+  return static_cast<int>(syscall(SYS_memfd_create, name, flags));
+}
+#endif  // __linux__
+#endif  // !_WIN32
+
+// Materializes native-addon bytes into a form dlopen()/LoadLibrary() can load,
+// with the smallest, most private on-disk footprint each platform allows:
+//   Linux:        an anonymous in-memory memfd, loaded via /proc/self/fd/N -
+//                 the bytes never touch the filesystem.
+//   other POSIX:  a 0700 mkdtemp() directory plus an O_EXCL|O_NOFOLLOW file,
+//                 unlink()ed right after the load (the mapping keeps it alive).
+//   Windows:      a temp file opened FILE_FLAG_DELETE_ON_CLOSE; its handle is
+//                 retained for the process lifetime so the file is removed
+//                 automatically once the process (and the loaded DLL) exit.
+// Used for an addon that lives somewhere dlopen() cannot open by path, such as
+// a virtual file system.
+class AddonImage {
+ public:
+  AddonImage() = default;
+  ~AddonImage();
+  AddonImage(const AddonImage&) = delete;
+  AddonImage& operator=(const AddonImage&) = delete;
+
+  // The directory a temporary image would be written to, with a trailing
+  // separator; empty when it cannot be determined. Names the resource for the
+  // file-system permission check.
+  static std::string TempDir();
+
+  // On success sets path() to a real, loadable path for `data`.
+  bool Materialize(const char* data, size_t len);
+  const std::string& path() const { return path_; }
+  const std::string& errmsg() const { return errmsg_; }
+
+  // Call exactly once, right after DLib::Open(); `opened` says whether the load
+  // succeeded. Releases the transient resources that are no longer needed (a
+  // successful load holds its own mapping): on POSIX closes the memfd or
+  // unlinks the temp file; on Windows retains the delete-on-close handle for
+  // the process lifetime when opened, or closes it (deleting the file) on
+  // failure.
+  void AfterOpen(bool opened);
+
+ private:
+  std::string path_;
+  std::string errmsg_;
+  bool consumed_ = false;
+#ifdef _WIN32
+  HANDLE handle_ = INVALID_HANDLE_VALUE;
+#else
+  bool MaterializeTempFile(const char* data, size_t len);
+  int fd_ = -1;
+  std::string temp_dir_;  // non-empty only for the temp-file (non-memfd) path
+#endif
+};
+
+#ifdef _WIN32
+
+// Delete-on-close handles kept alive until process exit so their temp files
+// outlive the loaded DLLs and are removed once the process ends.
+Mutex g_retained_addon_handles_mutex;
+std::vector<HANDLE>* g_retained_addon_handles = nullptr;
+
+// static
+std::string AddonImage::TempDir() {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) return std::string();
+  int size = WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, nullptr, 0, nullptr, nullptr);
+  if (size <= 0) return std::string();
+  std::string out(size, '\0');
+  WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, out.data(), size, nullptr, nullptr);
+  return out;
+}
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) {
+    errmsg_ = "could not locate the temporary directory";
+    return false;
+  }
+  wchar_t file[MAX_PATH + 1];
+  if (GetTempFileNameW(dir, L"nod", 0, file) == 0) {
+    errmsg_ = "could not create a temporary file name";
+    return false;
+  }
+  // Reopen the just-created file delete-on-close, sharing delete so the loader
+  // can map it while it is delete-pending; the file is removed when this handle
+  // and the loader's section are both released (i.e. at process exit).
+  handle_ = CreateFileW(file,
+                        GENERIC_READ | GENERIC_WRITE,
+                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                        nullptr,
+                        CREATE_ALWAYS,
+                        FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE,
+                        nullptr);
+  if (handle_ == INVALID_HANDLE_VALUE) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    return false;
+  }
+  size_t off = 0;
+  while (off < len) {
+    DWORD chunk =
+        len - off > MAXDWORD ? MAXDWORD : static_cast<DWORD>(len - off);
+    DWORD written = 0;
+    if (!WriteFile(handle_, data + off, chunk, &written, nullptr)) {
+      errmsg_ = "could not write the native addon to a temporary file";
+      CloseHandle(handle_);
+      handle_ = INVALID_HANDLE_VALUE;
+      return false;
+    }
+    off += written;
+  }
+  int utf8_len =
+      WideCharToMultiByte(CP_UTF8, 0, file, -1, nullptr, 0, nullptr, nullptr);
+  if (utf8_len <= 0) {
+    errmsg_ = "could not encode the temporary file path";
+    CloseHandle(handle_);
+    handle_ = INVALID_HANDLE_VALUE;
+    return false;
+  }
+  path_.resize(utf8_len - 1);
+  WideCharToMultiByte(
+      CP_UTF8, 0, file, -1, path_.data(), utf8_len, nullptr, nullptr);
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  if (handle_ == INVALID_HANDLE_VALUE) return;
+  if (!opened) {
+    CloseHandle(handle_);  // delete-on-close removes the file
+    handle_ = INVALID_HANDLE_VALUE;
+    return;
+  }
+  Mutex::ScopedLock lock(g_retained_addon_handles_mutex);
+  if (g_retained_addon_handles == nullptr) {
+    g_retained_addon_handles = new std::vector<HANDLE>();
+  }
+  g_retained_addon_handles->push_back(handle_);
+  handle_ = INVALID_HANDLE_VALUE;
+}
+
+AddonImage::~AddonImage() {
+  // Materialized but Open() was never reached (e.g. an exception in between):
+  // closing the delete-on-close handle removes the file.
+  if (!consumed_ && handle_ != INVALID_HANDLE_VALUE) CloseHandle(handle_);
+}
+
+#else  // !_WIN32
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+#if defined(__linux__)
+  // Prefer an anonymous in-memory fd, loaded through /proc/self/fd: nothing
+  // reaches the filesystem, so there is no temp file to secure, unlink, or
+  // leak, and no noexec-mount problem. Request an executable memfd (MFD_EXEC,
+  // Linux 6.3+); retry without it on older kernels that reject the flag, then
+  // fall back to a temp file if memfd is unavailable entirely.
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
+#endif
+#ifndef MFD_EXEC
+#define MFD_EXEC 0x0010U
+#endif
+  fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC | MFD_EXEC);
+  if (fd_ == -1 && errno == EINVAL) {
+    fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC);
+  }
+  if (fd_ != -1) {
+    if (!WriteAllToFd(fd_, data, len)) {
+      errmsg_ = "could not write the native addon to an in-memory file";
+      close(fd_);
+      fd_ = -1;
+      return false;
+    }
+    path_ = "/proc/self/fd/" + std::to_string(fd_);
+    return true;
+  }
+#endif  // __linux__
+  return MaterializeTempFile(data, len);
+}
+
+// static
+std::string AddonImage::TempDir() {
+  const char* env_tmp = getenv("TMPDIR");
+  std::string tmpdir =
+      (env_tmp != nullptr && *env_tmp != '\0') ? env_tmp : "/tmp";
+  if (tmpdir.back() != '/') tmpdir.push_back('/');
+  return tmpdir;
+}
+
+bool AddonImage::MaterializeTempFile(const char* data, size_t len) {
+  // A private 0700 directory (mkdtemp) so no other user can pre-create the path
+  // as a symlink or swap the file between the write and the load; O_EXCL and
+  // O_NOFOLLOW harden the create against a race inside it.
+  std::string tmpl = TempDir() + "node-addon-XXXXXX";
+  std::vector<char> buf(tmpl.begin(), tmpl.end());
+  buf.push_back('\0');
+  if (mkdtemp(buf.data()) == nullptr) {
+    errmsg_ = "could not create a temporary directory for the native addon";
+    return false;
+  }
+  temp_dir_ = buf.data();
+  std::string file = temp_dir_ + "/addon.node";
+  fd_ = open(
+      file.c_str(), O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0600);
+  if (fd_ == -1) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  if (!WriteAllToFd(fd_, data, len)) {
+    errmsg_ = "could not write the native addon to a temporary file";
+    close(fd_);
+    fd_ = -1;
+    unlink(file.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  // dlopen() reopens by path; the post-open mapping keeps the inode alive.
+  close(fd_);
+  fd_ = -1;
+  path_ = file;
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  // The right cleanup is the same whether or not the load worked.
+  (void)opened;
+  // memfd: the load's mapping (or nothing, on failure) owns it from here.
+  if (fd_ != -1) {
+    close(fd_);
+    fd_ = -1;
+    return;
+  }
+  if (!temp_dir_.empty()) {
+    // On success the mapping keeps the inode alive, so unlinking now leaves no
+    // on-disk trace; on failure this just cleans up.
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+  }
+}
+
+AddonImage::~AddonImage() {
+  if (consumed_) return;
+  if (fd_ != -1) close(fd_);
+  if (!temp_dir_.empty()) {
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+  }
+}
+
+#endif  // _WIN32
+
+}  // namespace
+
+// Shared by process.dlopen() and the internal dlopenBinary(). `allow_binary`
+// says whether args[3] may carry the addon's bytes; it is false for
+// process.dlopen(), whose signature stays (module, filename[, flags]).
 //
 // FIXME(bnoordhuis) Not multi-context ready. TBD how to resolve the conflict
 // when two contexts try to load the same shared object. Maybe have a shadow
 // cache that's a plain C list or hash table that's shared across contexts?
-void DLOpen(const FunctionCallbackInfo<Value>& args) {
+static void DLOpenImpl(const FunctionCallbackInfo<Value>& args,
+                       bool allow_binary) {
   Environment* env = Environment::GetCurrent(args);
 
   if (env->no_native_addons()) {
@@ -464,7 +760,11 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   }
 
   int32_t flags = DLib::kDefaultFlags;
-  if (args.Length() > 2 && !args[2]->Int32Value(context).To(&flags)) {
+  // On the internal path an undefined flags argument keeps the default, so a
+  // caller can pass the bytes without choosing flags. process.dlopen() keeps
+  // its original behaviour of rejecting any non-integer that is present.
+  if (args.Length() > 2 && !(allow_binary && args[2]->IsUndefined()) &&
+      !args[2]->Int32Value(context).To(&flags)) {
     return THROW_ERR_INVALID_ARG_TYPE(env, "flag argument must be an integer.");
   }
 
@@ -477,12 +777,44 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
     return;  // Exception pending.
   }
 
-  node::Utf8Value filename(env->isolate(), args[1]);  // Cast
-  env->TryLoadAddon(*filename, flags, [&](DLib* dlib) {
+  node::Utf8Value filename(env->isolate(), args[1]);  // The addon's path,
+                                                      // used for diagnostics.
+
+  // On the internal path args[3] carries the addon's bytes, for an addon that
+  // lives somewhere dlopen() cannot open by path (e.g. a virtual file system).
+  // Materialize them into a private, self-cleaning image and load that, while
+  // still reporting `filename` in any error.
+  AddonImage image;
+  const char* load_path = *filename;
+  if (allow_binary && args.Length() > 3 && !args[3]->IsUndefined()) {
+    if (!args[3]->IsArrayBufferView()) {
+      return THROW_ERR_INVALID_ARG_TYPE(
+          env, "binary must be a Buffer, TypedArray, or DataView");
+    }
+    // Loading from bytes materializes them into an image in the temporary
+    // directory, so this needs write access there on top of the addon
+    // permission checked above. The check does not depend on whether the image
+    // actually reaches the file system on this platform (Linux uses an
+    // anonymous memfd): what a program must be granted should not vary by
+    // platform.
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        env,
+        permission::PermissionScope::kFileSystemWrite,
+        AddonImage::TempDir());
+    ArrayBufferViewContents<char> binary(args[3]);
+    if (!image.Materialize(binary.data(), binary.length())) {
+      return THROW_ERR_DLOPEN_FAILED(
+          env, "%s: %s", image.errmsg().c_str(), *filename);
+    }
+    load_path = image.path().c_str();
+  }
+
+  env->TryLoadAddon(load_path, flags, [&](DLib* dlib) {
     static Mutex dlib_load_mutex;
     Mutex::ScopedLock lock(dlib_load_mutex);
 
     const bool is_opened = dlib->Open();
+    image.AfterOpen(is_opened);
 
     // Objects containing v14 or later modules will have registered themselves
     // on the pending list.  Activate all of them now.  At present, only one
@@ -582,6 +914,20 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   // coverity[leaked_storage]
 }
 
+// process.dlopen(module, filename[, flags]). Used to load 'module.node'
+// dynamically shared objects.
+void DLOpen(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, false);
+}
+
+// Internal only, reached through the process_methods binding rather than the
+// process object: dlopenBinary(module, filename, flags, binary) loads an addon
+// from bytes already in memory. Used for addons served by a virtual file
+// system, which the dynamic loader cannot open by path.
+void DLOpenBinary(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, true);
+}
+
 inline struct node_module* FindModule(struct node_module* list,
                                       const char* name,
                                       int flag) {
diff --git a/src/node_binding.h b/src/node_binding.h
index b05c68ad0726..c200cc0d0c8a 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -168,6 +168,7 @@ void CreateInternalBindingTemplates(IsolateData* isolate_data);
 void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
+void DLOpenBinary(const v8::FunctionCallbackInfo<v8::Value>& args);
 
 }  // namespace binding
 
diff --git a/src/node_options.cc b/src/node_options.cc
index 219790c7e816..9077325e393d 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -738,6 +738,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::allow_fs_write,
             kAllowedInEnvvar,
             OptionNamespaces::kPermissionNamespace);
+  AddOption("--allow-fs-vfs",
+            "allow mounting a virtual file system when any permissions are set",
+            BOOL_FIELD(allow_fs_vfs),
+            kAllowedInEnvvar,
+            false,
+            OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-addons",
             "allow use of addons when any permissions are set",
             BOOL_FIELD(allow_addons),
diff --git a/src/node_options.h b/src/node_options.h
index ddeb2cf9b08c..ffd76d70526c 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -225,6 +225,7 @@ class EnvironmentOptions : public Options {
   DEFINE_BOOL_FIELD(permission) = false;
   DEFINE_BOOL_FIELD(permission_audit) = false;
   DEFINE_BOOL_FIELD(allow_addons) = false;
+  DEFINE_BOOL_FIELD(allow_fs_vfs) = false;
   DEFINE_BOOL_FIELD(allow_inspector) = false;
   DEFINE_BOOL_FIELD(allow_child_process) = false;
   DEFINE_BOOL_FIELD(allow_net) = false;
diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index 8f800be35431..6a35e5c5e4c4 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -807,6 +807,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
 
   SetMethodNoSideEffect(isolate, target, "cwd", Cwd);
   SetMethod(isolate, target, "dlopen", binding::DLOpen);
+  SetMethod(isolate, target, "dlopenBinary", binding::DLOpenBinary);
   SetMethod(isolate, target, "reallyExit", ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
@@ -854,6 +855,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 
   registry->Register(Cwd);
   registry->Register(binding::DLOpen);
+  registry->Register(binding::DLOpenBinary);
   registry->Register(ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
diff --git a/test/parallel/test-dlopen-binary.js b/test/parallel/test-dlopen-binary.js
new file mode 100644
index 000000000000..8a575a52c975
--- /dev/null
+++ b/test/parallel/test-dlopen-binary.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { internalBinding } = require('internal/test/binding');
+
+// dlopenBinary() loads a native addon from bytes already in memory, for an
+// addon that the dynamic loader cannot open by path (e.g. one served by a
+// virtual file system). It is internal: process.dlopen() keeps its documented
+// (module, filename[, flags]) signature and never takes the bytes.
+const { dlopenBinary } = internalBinding('process_methods');
+assert.strictEqual(typeof dlopenBinary, 'function');
+assert.strictEqual(process.dlopen.length, 0);
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+const bytes = fs.readFileSync(addonPath);
+const flags = (os.constants.dlopen?.RTLD_LAZY) || 0;
+
+// A path that does not exist on disk, as a VFS-resident addon would be.
+const fakePath = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+assert.ok(!fs.existsSync(fakePath));
+
+const m = { exports: {} };
+dlopenBinary(m, fakePath, flags, bytes);
+assert.strictEqual(typeof m.exports.hello, 'function');
+assert.strictEqual(m.exports.hello(), 'world');
+
+// The flags argument may be left undefined when passing bytes.
+const m2 = { exports: {} };
+dlopenBinary(m2, fakePath, undefined, bytes);
+assert.strictEqual(m2.exports.hello(), 'world');
+
+// Without the bytes, that nonexistent path cannot be loaded.
+assert.throws(() => dlopenBinary({ exports: {} }, fakePath, flags),
+              { code: 'ERR_DLOPEN_FAILED' });
+
+// A non-buffer binary is rejected.
+assert.throws(
+  () => dlopenBinary({ exports: {} }, fakePath, flags, 'nope'),
+  { code: 'ERR_INVALID_ARG_TYPE' });
+
+// process.dlopen() ignores a fourth argument rather than loading from it: the
+// public signature is unchanged, so this still fails on the missing path.
+assert.throws(
+  () => process.dlopen({ exports: {} }, fakePath, flags, bytes),
+  { code: 'ERR_DLOPEN_FAILED' });
diff --git a/test/parallel/test-permission-dlopen-binary.js b/test/parallel/test-permission-dlopen-binary.js
new file mode 100644
index 000000000000..3bf2321564fc
--- /dev/null
+++ b/test/parallel/test-permission-dlopen-binary.js
@@ -0,0 +1,113 @@
+// Flags: --expose-internals
+'use strict';
+
+// Loading an addon from bytes materializes them into an image in the temporary
+// directory, so dlopenBinary() requires file-system write access on top of the
+// addon permission every dlopen already needs. Granting only one of the two is
+// not enough.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+
+// Loads the addon from bytes at a path that does not exist on disk, as an
+// addon served by a virtual file system would be, and reports what happened.
+const child = `
+  const { internalBinding } = require('internal/test/binding');
+  const fs = require('fs');
+  const os = require('os');
+  const path = require('path');
+  const { dlopenBinary } = internalBinding('process_methods');
+  const bytes = fs.readFileSync(${JSON.stringify(addonPath)});
+  const target = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+  const m = { exports: {} };
+  try {
+    dlopenBinary(m, target, undefined, bytes);
+    console.log('LOADED', m.exports.hello());
+  } catch (err) {
+    console.log('DENIED', err.code, err.permission ?? '');
+  }
+`;
+
+function run(...permissions) {
+  return spawnSync(
+    process.execPath,
+    ['--expose-internals', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', child],
+    { encoding: 'utf8' });
+}
+
+// Both permissions granted: the addon loads.
+{
+  const res = run('--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// Addons allowed but no write access: refused by the file-system check, so the
+// bytes are never materialized.
+{
+  const res = run('--allow-addons');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
+
+// Write access but addons disallowed: refused before the bytes are looked at,
+// the same as any other dlopen under the permission model.
+{
+  const res = run('--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_DLOPEN_DISABLED/);
+}
+
+// Without the permission model neither check applies.
+{
+  const res = spawnSync(process.execPath, ['--expose-internals', '-e', child],
+                        { encoding: 'utf8' });
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// The same, reached the way a program actually gets here: an addon inside a
+// mounted VFS. Mounting one under the permission model needs --allow-fs-vfs.
+{
+  const mounted = `
+    const fs = require('fs');
+    const vfs = require('node:vfs');
+    const myVfs = vfs.create();
+    myVfs.writeFileSync('/binding.node',
+                        fs.readFileSync(${JSON.stringify(addonPath)}));
+    const mountPoint = myVfs.mount();
+    try {
+      console.log('LOADED', require(mountPoint + '/binding.node').hello());
+    } catch (err) {
+      console.log('DENIED', err.code, err.permission ?? '');
+    }
+  `;
+  const vfsRun = (...permissions) => spawnSync(
+    process.execPath,
+    ['--experimental-vfs', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', mounted],
+    { encoding: 'utf8' });
+
+  const ok = vfsRun('--allow-fs-vfs', '--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(ok.status, 0, ok.stderr);
+  assert.match(ok.stdout, /LOADED world/);
+
+  // Mounting itself is refused without --allow-fs-vfs.
+  const noVfs = vfsRun('--allow-addons', '--allow-fs-write=*');
+  assert.notStrictEqual(noVfs.status, 0);
+  assert.match(noVfs.stderr, /ERR_INVALID_STATE/);
+  assert.match(noVfs.stderr, /--allow-fs-vfs/);
+
+  // Mounted, addons allowed, but no write access: the addon is refused.
+  const noWrite = vfsRun('--allow-fs-vfs', '--allow-addons');
+  assert.strictEqual(noWrite.status, 0, noWrite.stderr);
+  assert.match(noWrite.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
diff --git a/test/parallel/test-vfs-addon.js b/test/parallel/test-vfs-addon.js
new file mode 100644
index 000000000000..1c138a187d0a
--- /dev/null
+++ b/test/parallel/test-vfs-addon.js
@@ -0,0 +1,37 @@
+// Flags: --experimental-vfs
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vfs = require('node:vfs');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) {
+  common.skip('the hello-world addon is not built');
+}
+
+// A native addon inside a mounted VFS can be require()d: dlopen() cannot open
+// the reserved mount path, so the loader hands the addon's bytes to
+// process.dlopen's `binary` option, which loads them from a private temporary
+// image (an in-memory memfd on Linux).
+const myVfs = vfs.create();
+myVfs.writeFileSync('/binding.node', fs.readFileSync(addonPath));
+const mountPoint = myVfs.mount();
+
+const before = new Set(fs.readdirSync(os.tmpdir()));
+const addon = require(path.join(mountPoint, 'binding.node'));
+assert.strictEqual(addon.hello(), 'world');
+
+// On Linux the memfd path never touches the filesystem; on other POSIX the
+// temp image is unlinked right after loading, so no addon temp file lingers.
+// (Windows keeps a delete-on-close file until exit, so skip the check there.)
+if (process.platform !== 'win32') {
+  const leaked = fs.readdirSync(os.tmpdir())
+    .filter((f) => f.startsWith('node-addon') && !before.has(f));
+  assert.deepStrictEqual(leaked, [], `addon temp not cleaned up: ${leaked}`);
+}
+
+myVfs.unmount();

From 03e2b9bc42ae9c7ed4fbab5509d70fa934863c44 Mon Sep 17 00:00:00 2001
From: Caleb Everett <everett.caleb@gmail.com>
Date: Fri, 4 Sep 2026 09:56:42 -0700
Subject: [PATCH 075/202] src: fix use-after-free in CleanupHookThunkRun

CleanupHookThunkRun() read thunk->isolate/fun/arg from the
CleanupHookThunk after invoking thunk->fun(). For every
node::ObjectWrap alive at teardown, thunk->fun is
ObjectWrap::CleanupHook, which deletes the wrap; ~ObjectWrap() calls
RemoveEnvironmentCleanupHook() itself, erasing the CleanupHookThunk
from the registry and freeing the node it lives in. The subsequent
read of thunk->isolate/fun/arg to make the (now redundant) second
RemoveEnvironmentCleanupHook() call was therefore a use-after-free.

Cache the fields before running the hook so nothing is read from
`thunk` once it may have been freed.

Taken over from #65196, which has been inactive; the original change is
unmodified apart from the added comment.

This also unblocks #65042, the backport of the cleanup hook registry to
v24.x. Without that registry ~ObjectWrap() asserts during garbage
collection, so every 24.x runtime aborts for ObjectWrap addons
(#65446), as do 26.x runtimes before 26.4.0 when used with newer
headers (#65262).

Fixes: https://github.com/nodejs/node/issues/65195
Refs: https://github.com/nodejs/node/pull/65196
Refs: https://github.com/nodejs/node/pull/65042
Refs: https://github.com/nodejs/node/issues/65446
Refs: https://github.com/nodejs/node/issues/65262
Assisted-by: a closed-source coding agent
Co-authored-by: Sreehari Annam <sreehari.annam@gmail.com>
Signed-off-by: Caleb Everett <everett.caleb@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65630
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
---
 src/api/hooks.cc                | 11 +++++++--
 test/cctest/test_environment.cc | 40 +++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/src/api/hooks.cc b/src/api/hooks.cc
index 09a79fb9da81..b46073b6b7cf 100644
--- a/src/api/hooks.cc
+++ b/src/api/hooks.cc
@@ -145,8 +145,15 @@ static ExclusiveAccess<CleanupHookRegistry> cleanup_hook_registry;
 
 static void CleanupHookThunkRun(void* arg) {
   const CleanupHookThunk* thunk = static_cast<CleanupHookThunk*>(arg);
-  thunk->fun(thunk->arg);
-  RemoveEnvironmentCleanupHook(thunk->isolate, thunk->fun, thunk->arg);
+  // `thunk->fun` may itself remove and free this CleanupHookThunk (e.g. via
+  // ~ObjectWrap(), which calls RemoveEnvironmentCleanupHook()), so cache the
+  // fields we still need before invoking it rather than reading them from
+  // `thunk` afterwards.
+  Isolate* isolate = thunk->isolate;
+  CleanupHook fun = thunk->fun;
+  void* fun_arg = thunk->arg;
+  fun(fun_arg);
+  RemoveEnvironmentCleanupHook(isolate, fun, fun_arg);
 }
 
 void AddEnvironmentCleanupHook(Isolate* isolate,
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 36fbc0e79d46..449d7d38750b 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -29,6 +29,12 @@ static void at_exit_callback_ordered2(void* arg);
 static void at_exit_js(void* arg);
 static std::string cb_1_arg;  // NOLINT(runtime/string)
 
+struct SelfRemovingCleanupHookState {
+  v8::Isolate* isolate;
+  bool ran = false;
+};
+static void self_removing_cleanup_hook(void* arg);
+
 class EnvironmentTest : public EnvironmentTestFixture {
  private:
   void TearDown() override {
@@ -311,6 +317,27 @@ TEST_F(EnvironmentTest, AtExitRunsJS) {
   EXPECT_TRUE(called_at_exit_js);
 }
 
+// A cleanup hook that removes itself while the environment cleanup queue is
+// being drained must not cause a use-after-free. This registers such a hook
+// directly rather than through node::ObjectWrap, whose destructor removes
+// its own hook and is what makes this reachable for addons since #63642.
+// The use-after-free is silent in ordinary builds; it is caught by the
+// ASan/Valgrind CI, which is also how the original assertion (#63923)
+// surfaced. Regression test for https://github.com/nodejs/node/issues/65195.
+TEST_F(EnvironmentTest, RemoveEnvironmentCleanupHookDuringCleanup) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  SelfRemovingCleanupHookState state{isolate_};
+  {
+    Env env{handle_scope, argv};
+    node::AddEnvironmentCleanupHook(
+        isolate_, self_removing_cleanup_hook, &state);
+    // Destroying `env` runs FreeEnvironment() -> RunCleanup(), which drains
+    // the cleanup queue and invokes CleanupHookThunkRun() for the hook above.
+  }
+  EXPECT_TRUE(state.ran);
+}
+
 TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   const v8::HandleScope handle_scope(isolate_);
   const Argv argv;
@@ -394,6 +421,19 @@ static void at_exit_js(void* arg) {
   called_at_exit_js = true;
 }
 
+// Reproduces the sequence node::ObjectWrap performs since
+// https://github.com/nodejs/node/pull/63642, without using ObjectWrap
+// itself: the hook removes its own environment cleanup hook. When that runs
+// while the cleanup queue is being drained, CleanupHookThunkRun() must not
+// read the CleanupHookThunk after invoking the hook -- the hook has already
+// erased and freed it. See https://github.com/nodejs/node/issues/65195.
+static void self_removing_cleanup_hook(void* arg) {
+  auto* state = static_cast<SelfRemovingCleanupHookState*>(arg);
+  state->ran = true;
+  node::RemoveEnvironmentCleanupHook(
+      state->isolate, self_removing_cleanup_hook, state);
+}
+
 TEST_F(EnvironmentTest, SetImmediateCleanup) {
   int called = 0;
   int called_unref = 0;

From 30f4990224486be3502f94202e6c0e706163b315 Mon Sep 17 00:00:00 2001
From: deepak1556 <hop2deep@gmail.com>
Date: Wed, 19 Aug 2026 14:16:35 +0900
Subject: [PATCH 076/202] inspector: defer JS execution from V8 interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Inspector messages for a main thread connection are dispatched
from a V8 interrupt handler. Defer frontend messages in this
case using a microtask. This preserves the existing timing
contract for main thread inspector connections, where
notifications are observable after a microtask checkpoint.

Starting the inspector I/O thread and toggling network tracking
can also call into JS from an interrupt.

Signed-off-by: deepak1556 <hop2deep@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65397
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
---
 src/inspector_agent.cc  | 183 ++++++++++++++++++++++------------------
 src/inspector_agent.h   |  18 ++--
 src/inspector_js_api.cc |  46 +++++++---
 3 files changed, 145 insertions(+), 102 deletions(-)

diff --git a/src/inspector_agent.cc b/src/inspector_agent.cc
index 4bb34e56bcbf..fbafc55f1b74 100644
--- a/src/inspector_agent.cc
+++ b/src/inspector_agent.cc
@@ -79,6 +79,52 @@ static std::atomic_bool start_io_thread_async_initialized { false };
 // Protects the Agent* stored in start_io_thread_async.data.
 static Mutex start_io_thread_async_mutex;
 
+template <typename Defer, typename OnFailure>
+void SyncJavaScriptHookState(Environment* env,
+                             JavaScriptHookState* state,
+                             Local<Function> enable_function,
+                             Local<Function> disable_function,
+                             bool require_bootstrapping,
+                             Defer defer,
+                             OnFailure on_failure) {
+  // The debugger can request an interrupt from within a hook's JS toggle
+  // function. A nested sync only records the new requested state; the
+  // outermost sync sees it when re-checking the loop after each toggle.
+  if (state->syncing) return;
+  state->syncing = true;
+  auto on_exit = OnScopeLeave([state]() { state->syncing = false; });
+
+  Isolate* isolate = env->isolate();
+  while (state->wanted != state->enabled) {
+    // No hook events will be emitted during cleanup, and calling into JS is no
+    // longer possible.
+    // Refs: https://github.com/nodejs/node/pull/34362#discussion_r456006039
+    if (!env->can_call_into_js()) return;
+
+    bool enable = state->wanted;
+    Local<Function> function = enable ? enable_function : disable_function;
+    if (function.IsEmpty()) return;
+
+    if (env->is_processing_v8_interrupt()) {
+      defer();
+      return;
+    }
+
+    if (require_bootstrapping) CHECK(env->has_run_bootstrapping_code());
+    Local<Context> context = env->context();
+    v8::TryCatch try_catch(isolate);
+    USE(function->Call(context, Undefined(isolate), 0, nullptr));
+    if (try_catch.HasCaught()) {
+      // Termination may abort the toggle invocation. Do not record a state that
+      // may not have taken effect, so a later sync can retry it.
+      if (try_catch.HasTerminated()) return;
+      PrintCaughtException(isolate, context, try_catch);
+      on_failure();
+    }
+    state->enabled = enable;
+  }
+}
+
 // Called on the main thread.
 void StartIoThreadAsyncCallback(uv_async_t* handle) {
   static_cast<Agent*>(handle->data)->StartIoThread();
@@ -475,6 +521,16 @@ class SameThreadInspectorSession : public InspectorSession {
 
 void NotifyClusterWorkersDebugEnabled(Environment* env) {
   Isolate* isolate = env->isolate();
+
+  // Starting the inspector from an interrupt is safe, but emitting the cluster
+  // notification calls into JS.
+  if (env->is_processing_v8_interrupt()) {
+    env->SetImmediate(
+        [](Environment* env) { NotifyClusterWorkersDebugEnabled(env); },
+        CallbackFlags::kUnrefed);
+    return;
+  }
+
   HandleScope handle_scope(isolate);
 
   // Send message to enable debug in cluster workers
@@ -979,54 +1035,40 @@ void Agent::SetupNetworkTracking(Local<Function> enable_function,
                                  Local<Function> disable_function) {
   parent_env_->set_inspector_enable_network_tracking(enable_function);
   parent_env_->set_inspector_disable_network_tracking(disable_function);
-  if (pending_enable_network_tracking) {
-    pending_enable_network_tracking = false;
-    EnableNetworkTracking();
-  } else if (pending_disable_network_tracking) {
-    pending_disable_network_tracking = false;
-    DisableNetworkTracking();
-  }
+  SyncNetworkTrackingState();
 }
 
 void Agent::EnableNetworkTracking() {
-  if (network_tracking_enabled_) {
-    return;
-  }
-  HandleScope scope(parent_env_->isolate());
-  Local<Function> enable = parent_env_->inspector_enable_network_tracking();
-  if (enable.IsEmpty()) {
-    pending_enable_network_tracking = true;
-  } else {
-    ToggleNetworkTracking(parent_env_->isolate(), enable);
-    network_tracking_enabled_ = true;
-  }
+  network_tracking_state_.wanted = true;
+  SyncNetworkTrackingState();
 }
 
 void Agent::DisableNetworkTracking() {
-  if (!network_tracking_enabled_) {
-    return;
-  }
-  HandleScope scope(parent_env_->isolate());
-  Local<Function> disable = parent_env_->inspector_disable_network_tracking();
-  if (disable.IsEmpty()) {
-    pending_disable_network_tracking = true;
-  } else if (!client_->hasConnectedSessions()) {
-    ToggleNetworkTracking(parent_env_->isolate(), disable);
-    network_tracking_enabled_ = false;
-  }
+  if (client_->hasConnectedSessions()) return;
+  network_tracking_state_.wanted = false;
+  SyncNetworkTrackingState();
 }
 
-void Agent::ToggleNetworkTracking(Isolate* isolate, Local<Function> fn) {
-  if (!parent_env_->can_call_into_js()) return;
-  auto context = parent_env_->context();
+void Agent::SyncNetworkTrackingState() {
+  Isolate* isolate = parent_env_->isolate();
   HandleScope scope(isolate);
-  CHECK(!fn.IsEmpty());
-  v8::TryCatch try_catch(isolate);
-  USE(fn->Call(context, Undefined(isolate), 0, nullptr));
-  if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
-    PrintCaughtException(isolate, context, try_catch);
-    UNREACHABLE("Cannot toggle network tracking, please report this.");
-  }
+  SyncJavaScriptHookState(
+      parent_env_,
+      &network_tracking_state_,
+      parent_env_->inspector_enable_network_tracking(),
+      parent_env_->inspector_disable_network_tracking(),
+      false,
+      [this]() {
+        parent_env_->SetImmediate(
+            [](Environment* env) {
+              Agent* agent = env->inspector_agent();
+              if (agent != nullptr) agent->SyncNetworkTrackingState();
+            },
+            CallbackFlags::kUnrefed);
+      },
+      []() {
+        UNREACHABLE("Cannot toggle network tracking, please report this.");
+      });
 }
 
 void Agent::WaitForDisconnect() {
@@ -1077,7 +1119,7 @@ void Agent::RegisterAsyncHook(Isolate* isolate,
 }
 
 void Agent::SetAsyncHookTrackingEnabled(bool enabled) {
-  async_hook_wanted_ = enabled;
+  async_hook_state_.wanted = enabled;
   SyncAsyncHookState();
 }
 
@@ -1091,52 +1133,25 @@ void Agent::SetAsyncHookTrackingEnabled(bool enabled) {
 // When it's not safe to call into JS, this is a no-op and we'll try again in
 // RegisterAsyncHook() (for 1) or from a scheduled immediate (for 2).
 void Agent::SyncAsyncHookState() {
-  // The debugger can request an interrupt within the toggle JS function itself,
-  // A nested call only records the new requested state, the outermost call sees
-  // it when re-checking the loop condition after each toggle.
-  if (syncing_async_hook_state_) return;
-  syncing_async_hook_state_ = true;
-  auto on_exit = OnScopeLeave([this]() { syncing_async_hook_state_ = false; });
-
   Isolate* isolate = parent_env_->isolate();
   HandleScope scope(isolate);
-  while (async_hook_wanted_ != async_hook_enabled_) {
-    // Guard against running this during cleanup -- no async events will be
-    // emitted anyway at that point anymore, and calling into JS is not
-    // possible. This should probably not be something we're attempting in the
-    // first place,
-    // Refs: https://github.com/nodejs/node/pull/34362#discussion_r456006039
-    if (!parent_env_->can_call_into_js()) return;
-
-    bool enable = async_hook_wanted_;
-    Local<Function> fn = enable ? parent_env_->inspector_enable_async_hooks()
-                                : parent_env_->inspector_disable_async_hooks();
-    if (fn.IsEmpty()) return;
-
-    if (parent_env_->is_processing_v8_interrupt()) {
-      parent_env_->SetImmediate(
-          [](Environment* env) {
-            Agent* agent = env->inspector_agent();
-            if (agent != nullptr) agent->SyncAsyncHookState();
-          },
-          CallbackFlags::kUnrefed);
-      return;
-    }
-
-    CHECK(parent_env_->has_run_bootstrapping_code());
-    Local<Context> context = parent_env_->context();
-    v8::TryCatch try_catch(isolate);
-    USE(fn->Call(context, Undefined(isolate), 0, nullptr));
-    if (try_catch.HasCaught()) {
-      // Termination may abort the toggle invocation, retrying now would just
-      // be terminated again. Instead of recording the toggle that may not have
-      // taken effect, leave the states as-is so that a later sync retries.
-      if (try_catch.HasTerminated()) return;
-      PrintCaughtException(isolate, context, try_catch);
-      UNREACHABLE("Cannot toggle Inspector's AsyncHook, please report this.");
-    }
-    async_hook_enabled_ = enable;
-  }
+  SyncJavaScriptHookState(
+      parent_env_,
+      &async_hook_state_,
+      parent_env_->inspector_enable_async_hooks(),
+      parent_env_->inspector_disable_async_hooks(),
+      true,
+      [this]() {
+        parent_env_->SetImmediate(
+            [](Environment* env) {
+              Agent* agent = env->inspector_agent();
+              if (agent != nullptr) agent->SyncAsyncHookState();
+            },
+            CallbackFlags::kUnrefed);
+      },
+      []() {
+        UNREACHABLE("Cannot toggle Inspector's AsyncHook, please report this.");
+      });
 }
 
 void Agent::AsyncTaskScheduled(const StringView& task_name, void* task,
diff --git a/src/inspector_agent.h b/src/inspector_agent.h
index 932e4e8dce89..73835d2a4d1d 100644
--- a/src/inspector_agent.h
+++ b/src/inspector_agent.h
@@ -28,6 +28,12 @@ class ParentInspectorHandle;
 class NodeInspectorClient;
 class WorkerManager;
 
+struct JavaScriptHookState {
+  bool wanted = false;
+  bool enabled = false;
+  bool syncing = false;
+};
+
 class InspectorSession {
  public:
   virtual ~InspectorSession() = default;
@@ -132,7 +138,7 @@ class Agent {
 
  private:
   void SyncAsyncHookState();
-  void ToggleNetworkTracking(v8::Isolate* isolate, v8::Local<v8::Function> fn);
+  void SyncNetworkTrackingState();
 
   node::Environment* parent_env_;
   // Encapsulates majority of the Inspector functionality
@@ -152,13 +158,11 @@ class Agent {
   // The state of the async hook used for async stack traces that the protocol
   // last requested, and the state JS currently has. SyncAsyncHookState()
   // reconciles the two when it is possible and safe to call into JS.
-  bool async_hook_wanted_ = false;
-  bool async_hook_enabled_ = false;
-  bool syncing_async_hook_state_ = false;
+  JavaScriptHookState async_hook_state_;
 
-  bool network_tracking_enabled_ = false;
-  bool pending_enable_network_tracking = false;
-  bool pending_disable_network_tracking = false;
+  // Network tracking uses JS hooks. Reconcile the protocol requested and
+  // applied states after leaving a V8 interrupt.
+  JavaScriptHookState network_tracking_state_;
   std::shared_ptr<NetworkResourceManager> network_resource_manager_;
 };
 
diff --git a/src/inspector_js_api.cc b/src/inspector_js_api.cc
index ef1f99d7f38a..09f0d7e84ce6 100644
--- a/src/inspector_js_api.cc
+++ b/src/inspector_js_api.cc
@@ -60,13 +60,31 @@ struct MainThreadConnection {
 template <typename ConnectionType>
 class JSBindingsConnection : public BaseObject {
  public:
+  struct PendingMicrotask {
+    explicit PendingMicrotask(JSBindingsConnection* connection)
+        : env(connection->env()), connection(connection) {
+      env->AddCleanupHook(Delete, this);
+    }
+
+    static void Delete(void* data) {
+      delete static_cast<PendingMicrotask*>(data);
+    }
+
+    static void Run(void* data) {
+      std::unique_ptr<PendingMicrotask> pending(
+          static_cast<PendingMicrotask*>(data));
+      pending->env->RemoveCleanupHook(Delete, pending.get());
+      pending->connection->FlushPendingMessages();
+    }
+
+    Environment* env;
+    BaseObjectPtr<JSBindingsConnection> connection;
+  };
+
   class JSBindingsSessionDelegate : public InspectorSessionDelegate {
    public:
-    JSBindingsSessionDelegate(Environment* env,
-                              JSBindingsConnection* connection)
-                              : env_(env),
-                                connection_(connection) {
-    }
+    explicit JSBindingsSessionDelegate(JSBindingsConnection* connection)
+        : connection_(connection) {}
 
     void SendMessageToFrontend(const v8_inspector::StringView& message)
         override {
@@ -74,7 +92,6 @@ class JSBindingsConnection : public BaseObject {
     }
 
    private:
-    Environment* env_;
     BaseObjectPtr<JSBindingsConnection> connection_;
   };
 
@@ -84,10 +101,10 @@ class JSBindingsConnection : public BaseObject {
       : BaseObject(env, wrap), callback_(env->isolate(), callback) {
     Agent* inspector = env->inspector_agent();
     session_ = ConnectionType::Connect(
-        inspector, std::make_unique<JSBindingsSessionDelegate>(env, this));
-    // Inspector responses may be produced from a GC weak callback, where
-    // invoking the JavaScript session callback is forbidden. Defer delivery
-    // until the GC has completed.
+        inspector, std::make_unique<JSBindingsSessionDelegate>(this));
+    // Inspector responses may be produced from a GC weak callback or a V8
+    // interrupt, where invoking the JavaScript session callback is forbidden.
+    // Defer delivery until it is safe to call into JavaScript.
     env->isolate()->AddGCPrologueCallback(GCPrologueCallback, this);
     env->isolate()->AddGCEpilogueCallback(GCEpilogueCallback, this);
   }
@@ -98,7 +115,8 @@ class JSBindingsConnection : public BaseObject {
   }
 
   void SendMessageToFrontend(const v8_inspector::StringView& message) {
-    if (in_gc_ || delivering_ || !pending_messages_.empty()) {
+    if (in_gc_ || env()->is_processing_v8_interrupt() || delivering_ ||
+        !pending_messages_.empty()) {
       pending_messages_.emplace_back(
           message.is8Bit()
               ? std::u16string(message.characters8(),
@@ -126,6 +144,12 @@ class JSBindingsConnection : public BaseObject {
   void ScheduleFlush() {
     if (flush_scheduled_ || delivering_) return;
     flush_scheduled_ = true;
+    if (!in_gc_ && env()->is_processing_v8_interrupt()) {
+      auto* pending = new PendingMicrotask(this);
+      env()->context()->GetMicrotaskQueue()->EnqueueMicrotask(
+          env()->isolate(), PendingMicrotask::Run, pending);
+      return;
+    }
     BaseObjectPtr<JSBindingsConnection> strong_ref{this};
     env()->SetImmediate(
         [strong_ref](Environment*) { strong_ref->FlushPendingMessages(); },

From 49e26084925d3e177000cc1bcb74b76f8b108f7b Mon Sep 17 00:00:00 2001
From: deepak1556 <hop2deep@gmail.com>
Date: Wed, 19 Aug 2026 15:22:06 +0900
Subject: [PATCH 077/202] deps: enable V8 API interrupt JS check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: deepak1556 <hop2deep@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65397
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
---
 common.gypi                     | 5 +++++
 tools/v8_gypfiles/features.gypi | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/common.gypi b/common.gypi
index 5aef7768323c..47c1d0c0e831 100644
--- a/common.gypi
+++ b/common.gypi
@@ -54,6 +54,8 @@
     # Refs: https://github.com/nodejs/node/issues/23167
     # Enable compiler warnings when using V8_DEPRECATED apis from V8 code.
     'v8_deprecation_warnings': 0,
+    # Check that JavaScript execution is disallowed in V8 API interrupts.
+    'v8_disallow_js_in_api_interrupts_is_checked': 1,
     # Enable compiler warnings when using V8_DEPRECATE_SOON apis from V8 code.
     'v8_imminent_deprecation_warnings': 0,
 
@@ -534,6 +536,9 @@
       ['v8_deprecation_warnings == 1', {
         'defines': ['V8_DEPRECATION_WARNINGS',],
       }],
+      ['v8_disallow_js_in_api_interrupts_is_checked == 1', {
+        'defines': ['V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED',],
+      }],
       ['v8_imminent_deprecation_warnings == 1', {
         'defines': ['V8_IMMINENT_DEPRECATION_WARNINGS',],
       }],
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index d656c7492dec..9c8c94a17082 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -107,6 +107,9 @@
     # Enable compiler warnings when using V8_DEPRECATED apis.
     'v8_deprecation_warnings%': 0,
 
+    # Check that JavaScript execution is disallowed in V8 API interrupts.
+    'v8_disallow_js_in_api_interrupts_is_checked%': 0,
+
     # Enable compiler warnings when using V8_DEPRECATE_SOON apis.
     'v8_imminent_deprecation_warnings%': 0,
 
@@ -417,6 +420,9 @@
       ['v8_deprecation_warnings==1', {
         'defines': ['V8_DEPRECATION_WARNINGS',],
       }],
+      ['v8_disallow_js_in_api_interrupts_is_checked==1', {
+        'defines': ['V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED',],
+      }],
       ['v8_imminent_deprecation_warnings==1', {
         'defines': ['V8_IMMINENT_DEPRECATION_WARNINGS',],
       }],

From ccd648eb0cf0bbf1fee0ffa9a6fc91f9101ce508 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Olivier=20Fl=C3=BCckiger?= <olivf@chromium.org>
Date: Thu, 6 Aug 2026 07:57:24 +0000
Subject: [PATCH 078/202] deps: V8: backport b36cf9f6ccd2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original commit message:

    [api] Prepare DisallowJavascriptExecution scope around api callbacks

    In `v8::Isolate::RequestInterrupt` the API contract says:

         API interrupt callbacks are forbidden from executing JavaScript
         on the interrupted Isolate.

    This CL prepares the infrastructure to enforce this contract.

    Bug: 540137721, 40067940

    TAG=agy
    CONV=78573798-a951-4bd3-9c6f-3e3b6775da4b

    Change-Id: I43cc83c3cc3ebd34052a927dde55bbf4d49d2d29
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8173727
    Auto-Submit: Olivier Flückiger <olivf@chromium.org>
    Reviewed-by: Simon Zünd <szuend@chromium.org>
    Commit-Queue: Olivier Flückiger <olivf@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#109086}

Refs: https://github.com/v8/v8/commit/b36cf9f6ccd2931d1d0bde6a9f366d30667e4b75
Signed-off-by: deepak1556 <hop2deep@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65397
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
---
 deps/v8/BUILD.bazel                           |  6 ++++
 deps/v8/BUILD.gn                              | 11 ++++++
 deps/v8/src/common/assert-scope.h             |  2 +-
 deps/v8/src/execution/isolate.cc              |  7 ++++
 deps/v8/src/inspector/v8-debugger.cc          |  1 +
 deps/v8/src/inspector/v8-inspector-impl.cc    |  1 +
 .../inspector/v8-inspector-session-impl.cc    |  2 ++
 deps/v8/src/inspector/v8-regex.cc             |  2 ++
 deps/v8/test/cctest/test-api.cc               | 20 +++++++++++
 deps/v8/test/cctest/test-regexp.cc            |  8 ++++-
 .../debugger/debug/futex-reentrant-wait.js    | 35 +++++++++++++++++++
 11 files changed, 93 insertions(+), 2 deletions(-)
 create mode 100644 deps/v8/test/debugger/debug/futex-reentrant-wait.js

diff --git a/deps/v8/BUILD.bazel b/deps/v8/BUILD.bazel
index f28fea4e8aa1..53c06e3ceccf 100644
--- a/deps/v8/BUILD.bazel
+++ b/deps/v8/BUILD.bazel
@@ -148,6 +148,11 @@ v8_flag(name = "v8_enable_trace_maps")
 
 v8_flag(name = "v8_enable_v8_checks")
 
+v8_flag(
+    name = "v8_disallow_js_in_api_interrupts_is_checked",
+    default = True,
+)
+
 v8_flag(name = "v8_enable_verify_csa")
 
 v8_flag(name = "v8_enable_verify_heap")
@@ -496,6 +501,7 @@ v8_config(
         "v8_android_log_stdout": "V8_ANDROID_LOG_STDOUT",
         "v8_code_comments": "V8_CODE_COMMENTS",
         "v8_deprecation_warnings": "V8_DEPRECATION_WARNINGS",
+        "v8_disallow_js_in_api_interrupts_is_checked": "V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED",
         "v8_imminent_deprecation_warnings": "V8_IMMINENT_DEPRECATION_WARNINGS",
         "v8_enable_debug_code": "V8_ENABLE_DEBUG_CODE",
         "v8_enable_disassembler": "ENABLE_DISASSEMBLER",
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index e81430fbc393..ea335df90341 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -59,6 +59,10 @@ declare_args() {
   # Enable compiler warnings when using V8_DEPRECATED apis.
   v8_deprecation_warnings = true
 
+  # Check that executing JavaScript inside API interrupt callbacks is
+  # disallowed.
+  v8_disallow_js_in_api_interrupts_is_checked = true
+
   # Enable compiler warnings when using V8_DEPRECATE_SOON apis.
   v8_imminent_deprecation_warnings = true
 
@@ -999,6 +1003,7 @@ external_v8_defines = [
   "V8_COMPRESS_ZONES",
   "V8_ENABLE_SANDBOX",
   "V8_DEPRECATION_WARNINGS",
+  "V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED",
   "V8_IMMINENT_DEPRECATION_WARNINGS",
   "V8_USE_PERFETTO",
   "V8_USE_PERFETTO_JSON_EXPORT",
@@ -1047,6 +1052,10 @@ if (v8_enable_sandbox) {
 if (v8_deprecation_warnings) {
   enabled_external_v8_defines += [ "V8_DEPRECATION_WARNINGS" ]
 }
+if (v8_disallow_js_in_api_interrupts_is_checked) {
+  enabled_external_v8_defines +=
+      [ "V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED" ]
+}
 if (v8_imminent_deprecation_warnings) {
   enabled_external_v8_defines += [ "V8_IMMINENT_DEPRECATION_WARNINGS" ]
 }
@@ -3093,6 +3102,8 @@ generated_file("v8_generate_features_json") {
   output_conversion = "json"
   contents = {
     v8_deprecation_warnings = v8_deprecation_warnings
+    v8_disallow_js_in_api_interrupts_is_checked =
+        v8_disallow_js_in_api_interrupts_is_checked
     v8_enable_31bit_smis_on_64bit_arch = v8_enable_31bit_smis_on_64bit_arch
     v8_enable_direct_handle = v8_enable_direct_handle
     v8_enable_extensible_ro_snapshot = v8_enable_extensible_ro_snapshot
diff --git a/deps/v8/src/common/assert-scope.h b/deps/v8/src/common/assert-scope.h
index cf82be0bc8ee..494d330b3332 100644
--- a/deps/v8/src/common/assert-scope.h
+++ b/deps/v8/src/common/assert-scope.h
@@ -110,7 +110,7 @@ class V8_NODISCARD PerThreadAssertScope
     ScopeType& operator=(const ScopeType&) = delete;                 \
     V8_EXPORT_PRIVATE ~ScopeType();                                  \
                                                                      \
-    static bool IsAllowed(Isolate* isolate);                         \
+    V8_EXPORT_PRIVATE static bool IsAllowed(Isolate* isolate);       \
                                                                      \
     V8_EXPORT_PRIVATE static void Open(Isolate* isolate,             \
                                        bool* was_execution_allowed); \
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 06fa14bf6b10..e86eabdbf07d 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -2245,6 +2245,13 @@ void Isolate::InvokeApiInterruptCallbacks() {
     }
     VMState<EXTERNAL> state(this);
     HandleScope handle_scope(this);
+    // API interrupt callbacks are forbidden from executing JavaScript on the
+    // interrupted Isolate (see v8::Isolate::RequestInterrupt contract in
+    // v8-isolate.h: "Registered |callback| must not reenter interrupted
+    // Isolate.").
+#ifdef V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
+    DisallowJavascriptExecution no_js(this);
+#endif  // V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
     entry.first(reinterpret_cast<v8::Isolate*>(this), entry.second);
   }
 }
diff --git a/deps/v8/src/inspector/v8-debugger.cc b/deps/v8/src/inspector/v8-debugger.cc
index 69fb293610bc..747abefcedd5 100644
--- a/deps/v8/src/inspector/v8-debugger.cc
+++ b/deps/v8/src/inspector/v8-debugger.cc
@@ -532,6 +532,7 @@ void V8Debugger::handleProgramBreak(
         }
       });
   {
+    v8::Isolate::AllowJavascriptExecutionScope allow_script(m_isolate);
     v8::Context::Scope scope(pausedContext);
 
     m_inspector->forEachSession(
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index a4610e0d9b33..f085f7f72ec7 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -96,6 +96,7 @@ int V8InspectorImpl::resolveUniqueContextId(
 
 v8::MaybeLocal<v8::Value> V8InspectorImpl::compileAndRunInternalScript(
     v8::Local<v8::Context> context, v8::Local<v8::String> source) {
+  v8::Isolate::AllowJavascriptExecutionScope allow_script(m_isolate);
   v8::Local<v8::UnboundScript> unboundScript;
   if (!v8::debug::CompileInspectorScript(m_isolate, source)
            .ToLocal(&unboundScript))
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.cc b/deps/v8/src/inspector/v8-inspector-session-impl.cc
index 95ae57032b32..38d8dd93ea41 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.cc
@@ -355,6 +355,8 @@ void V8InspectorSessionImpl::reportAllContexts(V8RuntimeAgentImpl* agent) {
 }
 
 void V8InspectorSessionImpl::dispatchProtocolMessage(StringView message) {
+  v8::Isolate::AllowJavascriptExecutionScope allow_script(
+      m_inspector->isolate());
   KeepSessionAliveScope keepAlive(*this);
 
   using v8_crdtp::span;
diff --git a/deps/v8/src/inspector/v8-regex.cc b/deps/v8/src/inspector/v8-regex.cc
index 4adf347843ff..09c308f84d38 100644
--- a/deps/v8/src/inspector/v8-regex.cc
+++ b/deps/v8/src/inspector/v8-regex.cc
@@ -38,6 +38,7 @@ V8Regex::V8Regex(V8InspectorImpl* inspector, const String16& pattern,
   v8::Local<v8::RegExp> regex;
   // Protect against reentrant debugger calls via interrupts.
   v8::debug::PostponeInterruptsScope no_interrupts(m_inspector->isolate());
+  v8::Isolate::AllowJavascriptExecutionScope allow_js(m_inspector->isolate());
   if (v8::RegExp::New(context, toV8String(isolate, pattern),
                       static_cast<v8::RegExp::Flags>(flags))
           .ToLocal(&regex))
@@ -69,6 +70,7 @@ int V8Regex::match(const String16& string, int startFrom,
                                  v8::MicrotasksScope::kDoNotRunMicrotasks);
   // Protect against reentrant debugger calls via interrupts.
   v8::debug::PostponeInterruptsScope no_interrupts(m_inspector->isolate());
+  v8::Isolate::AllowJavascriptExecutionScope allow_js(m_inspector->isolate());
   v8::TryCatch tryCatch(isolate);
 
   v8::Local<v8::RegExp> regex = m_regex.Get(isolate);
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index ba7e079f411c..9b5fdd3cfd96 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -22306,6 +22306,26 @@ TEST(RequestInterruptSmallScripts) {
   CHECK(interrupt_was_called);
 }
 
+#ifdef V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
+static bool interrupt_check_no_js = false;
+void DisallowJsInterruptCallback(v8::Isolate* isolate, void* data) {
+  CHECK(!i::AllowJavascriptExecution::IsAllowed(
+      reinterpret_cast<i::Isolate*>(isolate)));
+  interrupt_check_no_js = true;
+}
+
+TEST(RequestInterruptDisallowsJavascript) {
+  LocalContext env;
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+
+  interrupt_check_no_js = false;
+  isolate->RequestInterrupt(&DisallowJsInterruptCallback, nullptr);
+  CompileRun("(function(x){return x;})(1);");
+  CHECK(interrupt_check_no_js);
+}
+#endif  // V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
+
 static v8::Global<Value> function_new_expected_env_global;
 static void FunctionNewCallback(const v8::FunctionCallbackInfo<Value>& info) {
   v8::Isolate* isolate = info.GetIsolate();
diff --git a/deps/v8/test/cctest/test-regexp.cc b/deps/v8/test/cctest/test-regexp.cc
index 946695833c64..08be47b221a8 100644
--- a/deps/v8/test/cctest/test-regexp.cc
+++ b/deps/v8/test/cctest/test-regexp.cc
@@ -124,7 +124,13 @@ class InterruptTest {
     CHECK(string->ContainsOnlyOneByte());
     // Internalize the subject by using it as a computed property name in an
     // object.
-    CompileRun("o = { [subject_string]: 'foo' }");
+    {
+      // This test is technically wrong for running JS in a C++ interrupt.
+      // However we know that the interuptee here is the regexp engine, which
+      // does not care.
+      Isolate::AllowJavascriptExecutionScope allow_script(isolate);
+      CompileRun("o = { [subject_string]: 'foo' }");
+    }
     CHECK(string->IsOneByte());
   }
 
diff --git a/deps/v8/test/debugger/debug/futex-reentrant-wait.js b/deps/v8/test/debugger/debug/futex-reentrant-wait.js
new file mode 100644
index 000000000000..fc82beac534e
--- /dev/null
+++ b/deps/v8/test/debugger/debug/futex-reentrant-wait.js
@@ -0,0 +1,35 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var Debug = debug.Debug;
+var exception = null;
+
+Debug.setListener(function (event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.Break) {
+    try {
+      var sab2 = new SharedArrayBuffer(4);
+      var i32a2 = new Int32Array(sab2);
+      Atomics.wait(i32a2, 0, 0, 10);
+    } catch (e) {
+      exception = e;
+    }
+  }
+});
+
+let sab = new SharedArrayBuffer(4);
+let i32a = new Int32Array(sab);
+
+let timeout = {
+  valueOf: function() {
+    %ScheduleBreak();
+    return 10;
+  }
+};
+
+Atomics.wait(i32a, 0, 0, timeout);
+
+assertNotNull(exception);
+assertTrue(exception.message.includes("cannot be called in this context"));

From 68e0ce0bde96fe3d4943250f853ff652342f8080 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Fri, 4 Sep 2026 21:57:57 +0200
Subject: [PATCH 079/202] stream: skip unobserved 'readable' emission at EOF

When a stream reaches its end via push(null) while nobody is observing
it (no 'readable' listener, not flowing, no pending readable need), do
not schedule the deferred 'readable' emission: it fires into the void
and costs a tick. Record that the end-of-stream notification is owed
instead; attaching a 'readable' listener later emits it, and read()
and resume() reach the end of the stream on their own.

As a side effect, a 'readable' listener attached more than a tick
after an unobserved end now receives the owed 'readable' before 'end',
where it previously received only 'end'.

For an HTTP server this removes one nextTick and one dead emit per
request whose body the handler never reads.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65749
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/streams/readable.js              | 27 ++++++-
 ...stream-readable-unobserved-eof-readable.js | 76 +++++++++++++++++++
 2 files changed, 99 insertions(+), 4 deletions(-)
 create mode 100644 test/parallel/test-stream-readable-unobserved-eof-readable.js

diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 56b819abac4f..847b3837af4c 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -138,6 +138,7 @@ const kHasPaused = 1 << 25;
 const kPaused = 1 << 26;
 const kDataListening = 1 << 27;
 const kEndScheduled = 1 << 28;
+const kEofReadablePending = 1 << 29;
 
 // TODO(benjamingr) it is likely slower to do it this way than with free functions
 function makeBitMapDescriptor(bit) {
@@ -682,7 +683,7 @@ Readable.prototype.read = function(n) {
     state.highWaterMark = computeNewHighWaterMark(n);
 
   if (n !== 0)
-    state[kState] &= ~kEmittedReadable;
+    state[kState] &= ~(kEmittedReadable | kEofReadablePending);
 
   // If we're doing read(0) to trigger a readable event, but we
   // already have a bunch of data in the buffer, then just trigger
@@ -825,7 +826,16 @@ function onEofChunk(stream, state) {
     // If we are sync, wait until next tick to emit the data.
     // Otherwise we risk emitting data in the flow()
     // the readable code triggers during a read() call.
-    emitReadable(stream);
+    if ((state[kState] & (kFlowing | kNeedReadable)) !== 0 ||
+        stream.listenerCount('readable') > 0) {
+      emitReadable(stream);
+    } else {
+      // Nobody is observing the stream: do not schedule the 'readable'
+      // emission at all. A 'readable' listener attached later redeems it
+      // (see Readable.prototype.on), and read() and resume() reach the
+      // end of the stream on their own.
+      state[kState] |= kEofReadablePending;
+    }
   } else {
     // Emit 'readable' now to make sure it gets picked up.
     state[kState] &= ~kNeedReadable;
@@ -1178,8 +1188,17 @@ Readable.prototype.on = function(ev, fn) {
       debug('on readable');
       if (state.length) {
         emitReadable(this);
-      } else if ((state[kState] & kReading) === 0) {
-        process.nextTick(nReadingNextTick, this);
+      } else {
+        if ((state[kState] & kEofReadablePending) !== 0) {
+          // The end-of-stream 'readable' emission was skipped because
+          // nobody was listening when the stream ended (see onEofChunk):
+          // emit it now.
+          state[kState] &= ~kEofReadablePending;
+          emitReadable(this);
+        }
+        if ((state[kState] & kReading) === 0) {
+          process.nextTick(nReadingNextTick, this);
+        }
       }
     }
   }
diff --git a/test/parallel/test-stream-readable-unobserved-eof-readable.js b/test/parallel/test-stream-readable-unobserved-eof-readable.js
new file mode 100644
index 000000000000..5eb6d1b2b631
--- /dev/null
+++ b/test/parallel/test-stream-readable-unobserved-eof-readable.js
@@ -0,0 +1,76 @@
+'use strict';
+const common = require('../common');
+const { Readable } = require('stream');
+const assert = require('assert');
+
+// When a stream reaches its end while nobody is observing it, the
+// end-of-stream 'readable' emission is not scheduled. It is emitted
+// later if a 'readable' listener is attached, and read()/resume()
+// still reach 'end' on their own.
+
+{
+  // Listener attached synchronously after push(null) gets 'readable'
+  // and then 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  let readableEmitted = false;
+  r.on('readable', common.mustCall(() => {
+    readableEmitted = true;
+    assert.strictEqual(r.read(), null);
+  }));
+  r.on('end', common.mustCall(() => {
+    assert.strictEqual(readableEmitted, true);
+  }));
+}
+
+{
+  // Listener attached one macrotask after the unobserved end still gets
+  // the owed 'readable' before 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    let readableEmitted = false;
+    r.on('readable', common.mustCall(() => {
+      readableEmitted = true;
+      assert.strictEqual(r.read(), null);
+    }));
+    r.on('end', common.mustCall(() => {
+      assert.strictEqual(readableEmitted, true);
+    }));
+  }));
+}
+
+{
+  // A stream that ends unobserved still emits 'end' when resumed later.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.resume();
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // read() after an unobserved end consumes the owed notification: a
+  // 'readable' listener attached afterwards does not receive it, but
+  // 'end' is still emitted.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(r.read(), null);
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // A 'data' listener attached after an unobserved end still gets 'end'.
+  const r = new Readable({ read() {} });
+  r.push('x');
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.on('data', common.mustCall((chunk) => {
+      assert.strictEqual(chunk.toString(), 'x');
+    }));
+    r.on('end', common.mustCall());
+  }));
+}

From 32b5d0d0f189e8ce67d8847aa43b22e447fae4ab Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 5 Sep 2026 00:21:58 +0200
Subject: [PATCH 080/202] tools: do not hardcode `yamllint` path

Allows user to get `yamlllint` from other source than Pip (e.g. Nix).

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65747
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 Makefile               | 16 +++++++++-------
 shell.nix              |  8 ++++++++
 tools/nix/devTools.nix |  1 +
 3 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/Makefile b/Makefile
index f0d453cf6213..a354f55ab28e 100644
--- a/Makefile
+++ b/Makefile
@@ -3,6 +3,7 @@
 BUILDTYPE ?= Release
 PYTHON ?= python3
 RUFF ?= tools/pip/site-packages/bin/ruff
+YAMLLINT ?= tools/pip/site-packages/bin/yamllint
 DESTDIR ?=
 SIGN ?=
 PREFIX ?= /usr/local
@@ -1726,14 +1727,15 @@ lint-yaml-build: ## Build resources needed to lint YAML files.
 		$(PYTHON) -m pip install --upgrade --system -t tools/pip/site-packages yamllint
 
 .PHONY: lint-yaml
+ifneq ("","$(wildcard $(YAMLLINT))")
 lint-yaml: ## Lint the YAML files with yamllint.
-	@if [ -d "tools/pip/site-packages/yamllint" ]; then \
-			$(info Running YAML linter...) \
-			PYTHONPATH=tools/pip $(PYTHON) -m yamllint .; \
-	else \
-		echo 'YAML linting with yamllint is not available'; \
-		echo "Run 'make lint-yaml-build'"; \
-	fi
+	$(info Running YAML linter...)
+	PYTHONPATH=tools/pip $(YAMLLINT) .
+else
+lint-yaml:
+	$(warning YAML linting with yamllint is not available)
+	$(warning Run 'make lint-yaml-build')
+endif
 
 .PHONY: lint
 .PHONY: lint-ci
diff --git a/shell.nix b/shell.nix
index 0bc13ec5c2f1..53abe6859d4a 100644
--- a/shell.nix
+++ b/shell.nix
@@ -155,6 +155,14 @@ pkgs.mkShell {
       RUFF = pkgs.lib.getExe ruff;
     }
   )
+  // (
+    let
+      yamllint = pkgs.lib.lists.findFirst (p: p.meta.mainProgram == "yamllint") null devTools;
+    in
+    pkgs.lib.optionalAttrs (yamllint != null) {
+      YAMLLINT = pkgs.lib.getExe yamllint;
+    }
+  )
   // pkgs.lib.optionalAttrs (!withSQLite) {
     NOSQLITE = "1";
   }
diff --git a/tools/nix/devTools.nix b/tools/nix/devTools.nix
index 0ead37da9108..e33ae720785c 100644
--- a/tools/nix/devTools.nix
+++ b/tools/nix/devTools.nix
@@ -9,6 +9,7 @@
   pkgs.jq
   pkgs.ruff
   pkgs.shellcheck
+  pkgs.yamllint
 ]
 ++ (
   if (ncu-path == null) then

From f85bb5ed783a4b40f90d55a45099c8dbc853d47c Mon Sep 17 00:00:00 2001
From: Issac <163278029+theSnackOverflow@users.noreply.github.com>
Date: Sat, 5 Sep 2026 07:22:10 +0900
Subject: [PATCH 081/202] permission: do not enforce fs and addons in audit
 mode

--permission-audit is documented to perform permission checks without
denying access, publishing each violation through the diagnostics
channel while execution continues. Three code paths still enforced:

* fs.lstat() and fs.symlink() are checked in the JavaScript layer,
  which threw ERR_ACCESS_DENIED without consulting audit mode. The
  isAuditMode() helper introduced for ffi was never wired into fs.
* Addon loading was disabled upfront in Environment setup, so
  process.dlopen() failed with ERR_DLOPEN_DISABLED before reaching
  the audit-aware permission check, and no audit event was published.

Skip the throw in the JavaScript checks when audit mode is on, keeping
the permission.has() call first so the diagnostics channel event is
still published. Leave native addons enabled in audit mode while still
applying the kAddon scope, so DLOpen() publishes the denial through
the channel and continues to the regular loading path. This also
covers the worker path, which inherits kNoNativeAddons from the same
option.

Each fs API carries its own copy of the check in its sync, callback
and promise flavour, so the regression test exercises all six call
sites, asserting the --permission enforce behaviour as a control.

Fixes: https://github.com/nodejs/node/issues/65419
Refs: https://github.com/nodejs/node/pull/63047
Assisted-by: claude:opus-5
Signed-off-by: Ji Hoon Kang <ivory.ma9ic@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65659
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 lib/fs.js                                     |  12 +-
 lib/internal/fs/promises.js                   |   6 +-
 src/env.cc                                    |   7 +-
 ...t-permission-audit-addons-does-not-deny.js |  65 ++++++++
 ...on-audit-fs-lstat-symlink-does-not-deny.js | 144 ++++++++++++++++++
 5 files changed, 227 insertions(+), 7 deletions(-)
 create mode 100644 test/parallel/test-permission-audit-addons-does-not-deny.js
 create mode 100644 test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js

diff --git a/lib/fs.js b/lib/fs.js
index 63312ba19507..b858902cf44a 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -1992,7 +1992,8 @@ function lstat(path, options = { __proto__: null, bigint: false }, callback) {
 
   callback = makeStatsCallback(callback);
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     callback(new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource));
     return;
@@ -2110,7 +2111,8 @@ function lstatSync(path, options = { __proto__: null, bigint: false, throwIfNoEn
     }
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2237,7 +2239,8 @@ function symlink(target, path, type, callback) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     callback(new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.'));
     return;
   }
@@ -2311,7 +2314,8 @@ function symlinkSync(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index ec163ccf9068..73c637a36d7c 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -1748,7 +1748,8 @@ async function symlink(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -1793,7 +1794,8 @@ async function lstat(path, options = { __proto__: null, bigint: false }) {
     if (promise !== undefined) return await promise;
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = pathModule.toNamespacedPath(BufferIsBuffer(path) ? BufferToString(path) : path);
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
diff --git a/src/env.cc b/src/env.cc
index 842ffebf2b2c..5626b2a7e10e 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -992,7 +992,12 @@ Environment::Environment(IsolateData* isolate_data,
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
-      options_->allow_native_addons = false;
+      // In audit mode addon loading must stay enabled: the denial is
+      // published through the diagnostics channel by the permission
+      // check in DLOpen() instead of being rejected upfront.
+      if (!options_->permission_audit) {
+        options_->allow_native_addons = false;
+      }
       permission()->Apply(this, args, permission::PermissionScope::kAddon);
     }
     if (!options_->allow_inspector) {
diff --git a/test/parallel/test-permission-audit-addons-does-not-deny.js b/test/parallel/test-permission-audit-addons-does-not-deny.js
new file mode 100644
index 000000000000..dd08058ab3ff
--- /dev/null
+++ b/test/parallel/test-permission-audit-addons-does-not-deny.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not disable native addon
+// loading. In audit mode process.dlopen() must reach the regular loading
+// path (failing with ERR_DLOPEN_FAILED for a missing file, after publishing
+// the denial to the diagnostics channel) instead of being rejected upfront
+// with ERR_DLOPEN_DISABLED, which is still the expected behavior under
+// --permission.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+
+function run(flag) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:addon', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    try {
+      process.dlopen({ exports: {} }, '/nonexistent/audit-test.node');
+      console.log('RESULT NO_THROW');
+    } catch (e) {
+      console.log('RESULT THREW ' + e.code);
+    }
+    console.log('AUDIT ' + JSON.stringify(msgs));
+  `;
+
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8' },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+test('audit mode reaches the real dlopen and logs the denial', () => {
+  const { result, msgs } = run('--permission-audit');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_FAILED');
+  assert.strictEqual(msgs.length, 1);
+  assert.strictEqual(msgs[0].permission, 'Addon');
+});
+
+test('enforce mode still disables dlopen upfront', () => {
+  const { result } = run('--permission');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_DISABLED');
+});
diff --git a/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
new file mode 100644
index 000000000000..f2d98a0b6f83
--- /dev/null
+++ b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
@@ -0,0 +1,144 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not deny fs.lstat() and
+// fs.symlink(), whose permission checks live in the JavaScript layer, while
+// --permission still denies them. Audit mode must publish the denial through
+// the diagnostics channel and let the operation continue. Each API is covered
+// in its three flavours (sync, callback and promise), since every flavour
+// carries its own copy of the check.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const blockedFile = fixtures.path('permission', 'deny', 'protected-file.md');
+
+function run(flag, { op, name }) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:fs', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    (async () => {
+      try {
+        await (${op});
+        console.log('RESULT NO_THROW');
+      } catch (e) {
+        console.log('RESULT THREW ' + e.code);
+      }
+      console.log('AUDIT ' + JSON.stringify(msgs));
+    })();
+  `;
+
+  const env = {
+    ...process.env,
+    BLOCKED_FILE: blockedFile,
+    LINK_PATH: tmpdir.resolve(`audit-symlink-${flag.replace(/\W/g, '')}-${name}`),
+  };
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8', env },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+const lstatOps = [
+  {
+    name: 'lstatSync',
+    api: 'fs.lstatSync()',
+    op: 'require("node:fs").lstatSync(process.env.BLOCKED_FILE)',
+  },
+  {
+    name: 'lstatCallback',
+    api: 'fs.lstat()',
+    op: 'new Promise((resolve, reject) => require("node:fs").lstat(' +
+      'process.env.BLOCKED_FILE, (err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'lstatPromises',
+    api: 'fsPromises.lstat()',
+    op: 'require("node:fs").promises.lstat(process.env.BLOCKED_FILE)',
+  },
+];
+
+const symlinkOps = [
+  {
+    name: 'symlinkSync',
+    api: 'fs.symlinkSync()',
+    op: 'require("node:fs").symlinkSync(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+  {
+    name: 'symlinkCallback',
+    api: 'fs.symlink()',
+    op: 'new Promise((resolve, reject) => require("node:fs").symlink(' +
+      'process.env.BLOCKED_FILE, process.env.LINK_PATH, ' +
+      '(err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'symlinkPromises',
+    api: 'fsPromises.symlink()',
+    op: 'require("node:fs").promises.symlink(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+];
+
+tmpdir.refresh();
+
+for (const entry of lstatOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, () => {
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.strictEqual(msgs.length, 1);
+    assert.strictEqual(msgs[0].permission, 'FileSystemRead');
+    assert.ok(msgs[0].resource.endsWith('protected-file.md'));
+  });
+
+  test(`enforce mode still denies ${entry.api}`, () => {
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
+
+for (const entry of symlinkOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.ok(
+      msgs.some((m) => m.permission === 'FileSystem'),
+      JSON.stringify(msgs),
+    );
+  });
+
+  test(`enforce mode still denies ${entry.api}`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}

From 838baeba7f680bd9f789909a50bfd9ae75294f17 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 18:54:40 +0000
Subject: [PATCH 082/202] lib: add runId, fileRunId, entryFile, namePath to
 node:bench

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                              |  45 +++++--
 lib/internal/bench_runner/benchmark.js        |  20 ++-
 lib/internal/bench_runner/cli.js              |  90 +++++++++++++-
 lib/internal/bench_runner/harness.js          | 117 +++++++++++++++---
 .../bench-runner/identity-child-a.cjs         |  11 ++
 .../bench-runner/identity-child-b.cjs         |  11 ++
 .../bench-runner/identity-entry-a.cjs         |  10 ++
 .../bench-runner/identity-entry-b.cjs         |  10 ++
 test/fixtures/bench-runner/identity-hook.cjs  |   9 ++
 .../bench-runner/identity-preload.cjs         |   9 ++
 .../fixtures/bench-runner/identity-shared.cjs |  11 ++
 test/fixtures/bench-runner/identity-suite.cjs |  10 ++
 .../bench-runner/malformed-record.cjs         |  13 +-
 test/parallel/test-bench-cli.js               | 101 +++++++++++++++
 test/parallel/test-bench-create-runner.js     |  10 ++
 15 files changed, 440 insertions(+), 37 deletions(-)
 create mode 100644 test/fixtures/bench-runner/identity-child-a.cjs
 create mode 100644 test/fixtures/bench-runner/identity-child-b.cjs
 create mode 100644 test/fixtures/bench-runner/identity-entry-a.cjs
 create mode 100644 test/fixtures/bench-runner/identity-entry-b.cjs
 create mode 100644 test/fixtures/bench-runner/identity-hook.cjs
 create mode 100644 test/fixtures/bench-runner/identity-preload.cjs
 create mode 100644 test/fixtures/bench-runner/identity-shared.cjs
 create mode 100644 test/fixtures/bench-runner/identity-suite.cjs

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 7cb5720ffe28..9c24d04ee4f0 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -137,6 +137,12 @@ Benchmark files passed to `--bench` should declare benchmarks but must not call
 `--bench-warmup`, `--bench-reporter`, and `--bench-reporter-destination`. See
 the [command-line options documentation][] for details.
 
+Preload modules passed through `--require` or `--import` should not declare
+benchmarks. Such declarations are not associated with an entry file and have
+an `entryFile` value of `null`. Their `fileRunId` identifies the runner or child
+execution in which they occurred. With process isolation, a preload is evaluated
+and its declarations run once for every benchmark child process.
+
 ## Benchmark reporters
 
 The built-in reporters are available from the scheme-only
@@ -262,9 +268,19 @@ benchmark. Later benchmarks continue to run.
 A timeout or abort cannot interrupt synchronous JavaScript and does not forcibly
 cancel asynchronous work that ignores `context.signal`.
 
-The stable `benchId` is based on the source file, hierarchical suite and
-benchmark names, and canonicalized parameters. Declaring the same identity
-more than once reports an error rather than merging the samples.
+The `benchId` is based on the declaration source file, hierarchical suite and
+benchmark names, and canonicalized parameters. It is stable for repeated runs
+from the same source location, but the embedded source value is not normalized
+across checkout roots, module formats, operating systems, or path casing.
+
+Execution scope is represented separately. A `runId` identifies one logical
+run, while `fileRunId` identifies a file runner or child execution within that
+run. The `entryFile` field records which entry-file import caused a declaration
+and is `null` for declarations made by preload modules.
+The same `benchId` can therefore occur under multiple `fileRunId` values when
+entry files use a shared declaration helper. Declaring the same `benchId` more
+than once within one file execution scope reports an error rather than merging
+the samples.
 
 ### `bench.skip([name][, options], fn)`
 
@@ -537,14 +553,20 @@ The events are emitted in execution order:
 * `'bench:diagnostic'`
 * `'bench:summary'`
 
-Every benchmark-scoped event contains `benchId` and `parentId`.
+Every benchmark-scoped event contains `runId`, `fileRunId`, `entryFile`,
+`benchId`, `parentId`, and `namePath`. `runId` and `fileRunId` are opaque and
+change between runs. `entryFile` identifies the top-level benchmark file whose
+loading caused the declaration, while `file` identifies the source location of
+the declaration itself. `parentId` is based on the containing suite's source
+file and hierarchical name path.
+
 `'bench:complete'` data contains a [benchmark result][]. A failed result has an
 additional `error` property and may contain samples recorded before the error.
 A skipped result has an additional `skip` property and an empty `samples`
 array. `'bench:diagnostic'` reports suite and hook errors. `'bench:summary'`
-contains overall `success`, `counts`, `duration_ns`, and `file` properties. The
-`file` is {string|null}; it is `null` when the summary aggregates multiple
-files.
+contains overall `runId`, `fileRunId`, `entryFile`, `success`, `counts`,
+`duration_ns`, and `file` properties. `fileRunId`, `entryFile`, and `file` are
+{string|null}; they are `null` when the summary aggregates multiple files.
 
 ## Sample result
 
@@ -560,10 +582,15 @@ Each measured sample has the following properties:
 
 A completed benchmark result contains:
 
-* `benchId` {string} The stable benchmark identity.
+* `runId` {string} The opaque logical run identity.
+* `fileRunId` {string} The opaque file runner or child execution identity.
+* `entryFile` {string|null} The top-level file that caused this declaration.
+* `benchId` {string} The stable declaration identity within the same source
+  layout.
 * `parentId` {string|null} The stable containing suite identity.
 * `name` {string} The benchmark name.
-* `file` {string} The source file.
+* `namePath` {string\[]} The hierarchical suite and benchmark names.
+* `file` {string} The declaration source file.
 * `line` {number} The source line.
 * `column` {number} The source column.
 * `tags` {string\[]} The inherited canonical tags.
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
index d3c55c1b2ef5..dae60f6e0599 100644
--- a/lib/internal/bench_runner/benchmark.js
+++ b/lib/internal/bench_runner/benchmark.js
@@ -48,6 +48,7 @@ const { structuredClone } = require('internal/worker/js_transferable');
 const { bigint: hrtime } = process.hrtime;
 const kDefaultSamples = 30;
 const kDefaultWarmup = 0;
+const kEmptyNamePath = ObjectFreeze([]);
 const kEmptyParams = ObjectFreeze({ __proto__: null });
 const kEmptyTags = ObjectFreeze([]);
 
@@ -163,10 +164,19 @@ class Suite extends AsyncResource {
     this.name = name;
     this.fn = fn;
     this.loc = createLocation(loc, harness.entryFile);
+    this.isRoot = isRoot;
+    this.fileScope = isRoot ? null :
+      (parent.isRoot ? harness.getFileScope() : parent.fileScope);
+    this.namePath = isRoot ? kEmptyNamePath :
+      ObjectFreeze(getNamePath(parent, name));
+    this.suiteId = isRoot ? null : JSONStringify([
+      this.loc.file,
+      this.namePath,
+    ]);
+    this.parentId = isRoot || parent.isRoot ? null : parent.suiteId;
     this.only = validated.only;
     this.skip = validated.skip;
     this.tags = validated.tags;
-    this.isRoot = isRoot;
     this.children = [];
     this.hooks = {
       __proto__: null,
@@ -214,17 +224,15 @@ class Bench extends AsyncResource {
     this.warmup = warmup;
     this.timeout = timeout;
     this.outerSignal = signal;
-    this.namePath = getNamePath(parent, name);
+    this.fileScope = parent.isRoot ? harness.getFileScope() : parent.fileScope;
+    this.namePath = ObjectFreeze(getNamePath(parent, name));
     this.fullName = ArrayPrototypeJoin(this.namePath, ' ');
     this.benchId = JSONStringify([
       this.loc.file,
       this.namePath,
       this.params,
     ]);
-    this.parentId = parent.isRoot ? null : JSONStringify([
-      this.loc.file,
-      getNamePath(parent.parent, parent.name),
-    ]);
+    this.parentId = parent.suiteId;
     this.finished = false;
     this.result = null;
     this.completion = PromiseWithResolvers();
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index ce54be0e1e22..6c717aab6fff 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayFrom,
+  ArrayIsArray,
   ArrayPrototypeFilter,
   ArrayPrototypeIncludes,
   ArrayPrototypeJoin,
@@ -32,6 +33,9 @@ const {
   kBenchmarksStreamDrain,
 } = require('internal/bench_runner/benchmarks_stream');
 const {
+  configureRunScope,
+  createRunId,
+  runInFileScope,
   runBenchmarks,
 } = require('internal/bench_runner/harness');
 const { deserializeError, serializeError } = require('internal/error_serdes');
@@ -116,6 +120,19 @@ function createChildFileList(patterns, cwd) {
   return null;
 }
 
+function createFileScopes(files, options) {
+  const scopes = [];
+  for (let i = 0; i < files.length; i++) {
+    ArrayPrototypePush(scopes, {
+      __proto__: null,
+      entryFile: resolve(options.cwd, files[i]),
+      fileRunId: options.isChild && i === 0 &&
+        options.fileRunId !== undefined ? options.fileRunId : createRunId(),
+    });
+  }
+  return scopes;
+}
+
 function parseNamePattern(value) {
   if (value.length === 0) return undefined;
   try {
@@ -163,11 +180,15 @@ function parseCommandLine() {
     __proto__: null,
     cwd: process.cwd(),
     destinations,
+    fileRunId: isChild && process.env.NODE_BENCH_FILE_RUN_ID ?
+      process.env.NODE_BENCH_FILE_RUN_ID : undefined,
     isChild,
     isolation: getOptionValue('--bench-isolation'),
     namePattern: parseNamePattern(getOptionValue('--bench-name-pattern')),
     namePatternSource: getOptionValue('--bench-name-pattern'),
     reporters,
+    runId: isChild && process.env.NODE_BENCH_RUN_ID ?
+      process.env.NODE_BENCH_RUN_ID : undefined,
     samples,
     warmup,
   };
@@ -292,7 +313,24 @@ function deserializeRecord(record) {
 function validateRecord(record) {
   if (record === null || typeof record !== 'object' ||
       !kEventTypes.has(record.type) || record.data === null ||
-      typeof record.data !== 'object') {
+      typeof record.data !== 'object' ||
+      typeof record.data.runId !== 'string' ||
+      (record.data.fileRunId !== null &&
+       typeof record.data.fileRunId !== 'string') ||
+      (record.data.entryFile !== null &&
+       typeof record.data.entryFile !== 'string')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  if ((record.type === 'bench:start' || record.type === 'bench:sample' ||
+       record.type === 'bench:complete') &&
+      (typeof record.data.benchId !== 'string' ||
+       (record.data.parentId !== null &&
+        typeof record.data.parentId !== 'string') ||
+       typeof record.data.name !== 'string' ||
+       !ArrayIsArray(record.data.namePath) ||
+       ArrayPrototypeSome(
+         record.data.namePath, (name) => typeof name !== 'string'))) {
     throw new ERR_INVALID_ARG_VALUE(
       'benchmark child message', record, 'is not a valid benchmark record');
   }
@@ -345,7 +383,8 @@ async function loadBenchmarkFiles(files, options, modules, onRecord) {
   for (let i = 0; i < files.length; i++) {
     const file = resolve(options.cwd, files[i]);
     try {
-      await loader.import(pathToFileURL(file), parentURL, kEmptyObject);
+      await runInFileScope(options.fileScopes[i], () =>
+        loader.import(pathToFileURL(file), parentURL, kEmptyObject));
     } catch (error) {
       loadFailed = true;
       await onRecord({
@@ -353,6 +392,8 @@ async function loadBenchmarkFiles(files, options, modules, onRecord) {
         type: 'bench:diagnostic',
         data: {
           __proto__: null,
+          runId: options.runId,
+          ...options.fileScopes[i],
           message: error?.message ?? String(error),
           error,
           level: 'error',
@@ -377,6 +418,10 @@ async function loadBenchmarkFiles(files, options, modules, onRecord) {
     if (record.type === 'bench:summary') {
       record.data.file = files.length === 1 ?
         resolve(options.cwd, files[0]) : null;
+      record.data.fileRunId = files.length === 1 ?
+        options.fileScopes[0].fileRunId : null;
+      record.data.entryFile = files.length === 1 ?
+        options.fileScopes[0].entryFile : null;
       summary = record.data;
     }
     await onRecord(record);
@@ -445,7 +490,7 @@ function getChildArgs(path, options) {
   return args;
 }
 
-async function runChild(path, options, onRecord) {
+async function runChild(path, options, scope, onRecord) {
   const child = spawn(process.execPath, getChildArgs(path, options), {
     __proto__: null,
     cwd: options.cwd,
@@ -453,6 +498,8 @@ async function runChild(path, options, onRecord) {
       __proto__: null,
       ...process.env,
       NODE_BENCH_CONTEXT: 'child',
+      NODE_BENCH_FILE_RUN_ID: scope.fileRunId,
+      NODE_BENCH_RUN_ID: options.runId,
     },
     serialization: 'advanced',
     stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
@@ -487,6 +534,8 @@ async function runChild(path, options, onRecord) {
       type: 'bench:diagnostic',
       data: {
         __proto__: null,
+        runId: options.runId,
+        ...scope,
         message,
         level: 'info',
         file: path,
@@ -506,8 +555,15 @@ async function runChild(path, options, onRecord) {
   child.on('message', (message) => {
     if (message?.type !== kChildMessageType) return;
     try {
-      const pending = handleRecord(
-        deserializeRecord(validateRecord(message.record)));
+      const record = deserializeRecord(validateRecord(message.record));
+      record.data.runId = options.runId;
+      if (record.data.fileRunId !== null) {
+        record.data.fileRunId = scope.fileRunId;
+      }
+      if (record.data.entryFile !== null) {
+        record.data.entryFile = scope.entryFile;
+      }
+      const pending = handleRecord(record);
       trackPending(pending);
     } catch (error) {
       protocolError = error;
@@ -533,10 +589,11 @@ async function runIsolated(files, options, output) {
 
   for (let i = 0; i < files.length; i++) {
     const path = files[i];
+    const scope = options.fileScopes[i];
     let childSummary;
     let result;
     try {
-      result = await runChild(path, options, (record) => {
+      result = await runChild(path, options, scope, (record) => {
         if (record.type === 'bench:summary') {
           childSummary = record.data;
           return;
@@ -547,6 +604,8 @@ async function runIsolated(files, options, output) {
       success = false;
       output.diagnostic({
         __proto__: null,
+        runId: options.runId,
+        ...scope,
         message: error.message,
         error,
         level: 'error',
@@ -570,6 +629,8 @@ async function runIsolated(files, options, output) {
           `exit code ${result.code}` : `signal ${result.signal}`;
         output.diagnostic({
           __proto__: null,
+          runId: options.runId,
+          ...scope,
           message: `Benchmark file '${path}' failed with ${status}`,
           level: 'error',
           file: path,
@@ -578,8 +639,12 @@ async function runIsolated(files, options, output) {
     }
   }
 
+  const scope = files.length === 1 ? options.fileScopes[0] : null;
   const summary = {
     __proto__: null,
+    runId: options.runId,
+    fileRunId: scope?.fileRunId ?? null,
+    entryFile: scope?.entryFile ?? null,
     success: success && (process.exitCode ?? 0) === 0,
     counts,
     duration_ns: hrtime() - start,
@@ -596,6 +661,19 @@ async function run(patterns) {
     createBenchmarkFileList(patterns, options.cwd);
   if (files === null) return { __proto__: null, success: false };
 
+  options.runId ??= createRunId();
+  options.fileScopes = createFileScopes(files, options);
+  const scope = files.length === 1 ? options.fileScopes[0] : {
+    __proto__: null,
+    entryFile: null,
+    fileRunId: options.runId,
+  };
+  configureRunScope({
+    __proto__: null,
+    runId: options.runId,
+    ...scope,
+  });
+
   if (options.isChild) {
     try {
       const modules = await loadUserImports(options);
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index 59b85860c2e9..09c06245c239 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -6,6 +6,7 @@ const {
   ArrayPrototypeSlice,
   BigInt,
   FunctionPrototypeCall,
+  JSONStringify,
   MathCeil,
   Promise,
   PromisePrototypeThen,
@@ -16,6 +17,7 @@ const {
   RegExpPrototypeExec,
   SafeMap,
   SafePromiseRace,
+  String,
   SymbolDispose,
 } = primordials;
 const { getCallerLocation } = internalBinding('util');
@@ -59,6 +61,11 @@ const {
 const { bigint: hrtime } = process.hrtime;
 const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
 const kIsCliRunner = getOptionValue('--bench');
+let nextRunId = 0;
+
+function createRunId() {
+  return `${process.pid}:${String(hrtime())}:${nextRunId++}`;
+}
 
 function eventLoopTurn() {
   return new Promise((resolve) => setImmediate(resolve));
@@ -78,6 +85,7 @@ class Harness {
   #buildPromises = [];
   #duplicateErrors = new SafeMap();
   #explicitRun = false;
+  #fileScopeStorage = new AsyncLocalStorage();
   #hasOnly = false;
   #runPromise = null;
   #scheduled = false;
@@ -96,7 +104,9 @@ class Harness {
       yieldBetweenSamples, 'options.yieldBetweenSamples');
     this.#autoRun = autoRun;
     this.#yieldBetweenSamples = yieldBetweenSamples;
-    this.entryFile = process.argv?.[1];
+    this.runId = createRunId();
+    this.fileRunId = this.runId;
+    this.entryFile = process.argv?.[1] ?? null;
     this.stream = new BenchmarksStream();
     this.state = 'collecting';
     this.namePattern = null;
@@ -122,6 +132,24 @@ class Harness {
     );
   }
 
+  getFileScope() {
+    return this.#fileScopeStorage.getStore() ?? null;
+  }
+
+  runInFileScope(scope, fn) {
+    return this.#fileScopeStorage.run(scope, fn);
+  }
+
+  setRunScope({ entryFile, fileRunId, runId }) {
+    if (this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE(
+        'benchmark execution scope cannot change after execution has started');
+    }
+    this.entryFile = entryFile;
+    this.fileRunId = fileRunId;
+    this.runId = runId;
+  }
+
   #ensureCollecting() {
     if (this.state === 'building' &&
         this.#storage.getStore() instanceof Suite) return;
@@ -178,6 +206,7 @@ class Harness {
     const parent = this.#getParent();
     ArrayPrototypePush(parent.hooks[name], {
       __proto__: null,
+      fileScope: parent.isRoot ? this.getFileScope() : parent.fileScope,
       fn,
       loc: getCallerLocation(),
     });
@@ -312,9 +341,13 @@ class Harness {
       if (!(node instanceof Bench)) return;
 
       this.counts.total++;
-      const existing = identities.get(node.benchId);
+      const identity = JSONStringify([
+        this.#getRecordScope(node).fileRunId,
+        node.benchId,
+      ]);
+      const existing = identities.get(identity);
       if (existing === undefined) {
-        identities.set(node.benchId, node);
+        identities.set(identity, node);
       } else {
         this.#duplicateErrors.set(node, new ERR_INVALID_STATE(
           `duplicate benchmark identity for "${node.fullName}"`));
@@ -378,13 +411,48 @@ class Harness {
       name: suite.name,
       signal: this.outerSignal,
     };
-    await this.#runHooks(suite, name, suite, suite, context);
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      try {
+        await this.#invoke(suite, suite, hooks[i].fn, [context]);
+      } catch (error) {
+        return { __proto__: null, error, hook: hooks[i] };
+      }
+    }
+    return null;
+  }
+
+  #getRecordScope(node = undefined) {
+    const scope = node?.fileScope;
+    if (scope !== null && scope !== undefined) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: scope.fileRunId,
+        entryFile: scope.entryFile,
+      };
+    }
+    if (node !== undefined && kIsCliRunner) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: this.fileRunId,
+        entryFile: null,
+      };
+    }
+    return {
+      __proto__: null,
+      runId: this.runId,
+      fileRunId: this.fileRunId,
+      entryFile: this.entryFile,
+    };
   }
 
-  #diagnostic(error, loc, level = 'info') {
+  #diagnostic(error, loc, level = 'info', node = undefined) {
     this.success = false;
     this.stream.diagnostic({
       __proto__: null,
+      ...this.#getRecordScope(node),
       message: error?.message ?? `${error}`,
       error,
       level,
@@ -410,7 +478,7 @@ class Harness {
 
   async #executeSuite(suite) {
     if (suite.buildError !== null) {
-      this.#diagnostic(suite.buildError, suite.loc, 'error');
+      this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
       await this.#completeSubtree(suite, suite.buildError);
       suite.finished = true;
       suite.completion.resolve();
@@ -421,11 +489,11 @@ class Harness {
     const active = this.#suiteHasActiveBench(suite);
     let beforeError;
     if (active) {
-      try {
-        await this.#runSuiteHooks(suite, 'before');
-      } catch (error) {
-        beforeError = error;
-        this.#diagnostic(error, suite.loc, 'error');
+      const failure = await this.#runSuiteHooks(suite, 'before');
+      if (failure !== null) {
+        beforeError = failure.error;
+        this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
       }
     }
 
@@ -443,10 +511,10 @@ class Harness {
     }
 
     if (active) {
-      try {
-        await this.#runSuiteHooks(suite, 'after');
-      } catch (error) {
-        this.#diagnostic(error, suite.loc, 'error');
+      const failure = await this.#runSuiteHooks(suite, 'after');
+      if (failure !== null) {
+        this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
       }
     }
     suite.finished = true;
@@ -537,9 +605,11 @@ class Harness {
   #createResult(benchmark, samples, extra = kEmptyObject) {
     return {
       __proto__: null,
+      ...this.#getRecordScope(benchmark),
       benchId: benchmark.benchId,
       parentId: benchmark.parentId,
       name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
       file: benchmark.loc.file,
       line: benchmark.loc.line,
       column: benchmark.loc.column,
@@ -595,9 +665,11 @@ class Harness {
 
     this.stream.start({
       __proto__: null,
+      ...this.#getRecordScope(benchmark),
       benchId: benchmark.benchId,
       parentId: benchmark.parentId,
       name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
       file: benchmark.loc.file,
       line: benchmark.loc.line,
       column: benchmark.loc.column,
@@ -648,9 +720,11 @@ class Harness {
               ArrayPrototypePush(samples, sample);
               this.stream.sample({
                 __proto__: null,
+                ...this.#getRecordScope(benchmark),
                 benchId: benchmark.benchId,
                 parentId: benchmark.parentId,
                 name: benchmark.name,
+                namePath: ArrayPrototypeSlice(benchmark.namePath),
                 index: i - warmup,
                 ...sample,
               });
@@ -697,6 +771,7 @@ class Harness {
     const duration = startTime === undefined ? 0n : hrtime() - startTime;
     this.stream.summary({
       __proto__: null,
+      ...this.#getRecordScope(),
       success: this.success,
       counts: this.counts,
       duration_ns: duration,
@@ -716,6 +791,7 @@ class Harness {
     this.state = 'building';
     const startTime = hrtime();
     await this.#waitForBuild();
+    this.#fileScopeStorage.disable();
     this.#prepare();
     this.state = 'running';
     await this.#executeSuite(this.root);
@@ -780,6 +856,14 @@ function createRunner(options = kEmptyObject) {
   };
 }
 
+function configureRunScope(scope) {
+  lazyHarness().setRunScope(scope);
+}
+
+function runInFileScope(scope, fn) {
+  return lazyHarness().runInFileScope(scope, fn);
+}
+
 function runBenchmarks(options, force) {
   return lazyHarness().run(options, force);
 }
@@ -791,7 +875,10 @@ module.exports = {
   before: createHook(kHookNames[2], lazyHarness),
   beforeEach: createHook(kHookNames[3], lazyHarness),
   bench,
+  configureRunScope,
+  createRunId,
   createRunner,
+  runInFileScope,
   runBenchmarks,
   suite,
 };
diff --git a/test/fixtures/bench-runner/identity-child-a.cjs b/test/fixtures/bench-runner/identity-child-a.cjs
new file mode 100644
index 000000000000..2b8c4b728b1c
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-a.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+module.exports = function declareChildA() {
+  bench('child a', { samples: 1 }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-child-b.cjs b/test/fixtures/bench-runner/identity-child-b.cjs
new file mode 100644
index 000000000000..249bcdcfc4f1
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-b.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+module.exports = function declareChildB() {
+  bench('child b', { samples: 1 }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-entry-a.cjs b/test/fixtures/bench-runner/identity-entry-a.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-entry-b.cjs b/test/fixtures/bench-runner/identity-entry-b.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-hook.cjs b/test/fixtures/bench-runner/identity-hook.cjs
new file mode 100644
index 000000000000..14c4cacd9cdc
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-hook.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { before, bench } = require('node:bench');
+
+before(() => {
+  throw new Error('scoped hook failed');
+});
+
+bench('scoped hook benchmark', { samples: 1 }, () => {});
diff --git a/test/fixtures/bench-runner/identity-preload.cjs b/test/fixtures/bench-runner/identity-preload.cjs
new file mode 100644
index 000000000000..ed55e627527b
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-preload.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('preload identity', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/identity-shared.cjs b/test/fixtures/bench-runner/identity-shared.cjs
new file mode 100644
index 000000000000..40ce0f27be29
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-shared.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+module.exports = function registerSharedIdentity() {
+  bench('shared identity', { samples: 1 }, (b) => {
+    b.start();
+    process.hrtime.bigint();
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-suite.cjs b/test/fixtures/bench-runner/identity-suite.cjs
new file mode 100644
index 000000000000..53c5982ce1a9
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-suite.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const declareChildA = require('./identity-child-a.cjs');
+const declareChildB = require('./identity-child-b.cjs');
+
+suite('cross-module suite', () => {
+  declareChildA();
+  declareChildB();
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
index 5744bf1ea4b0..ab8b4bb84dc1 100644
--- a/test/fixtures/bench-runner/malformed-record.cjs
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -2,13 +2,24 @@
 
 const common = require('../../common');
 
-const record = process.env.NODE_BENCH_MALFORMED_RECORD === 'summary' ? {
+const kind = process.env.NODE_BENCH_MALFORMED_RECORD;
+const record = kind === 'summary' ? {
   type: 'bench:summary',
   data: {
     counts: { completed: 0, failed: 0, skipped: 0, total: -1 },
     duration_ns: 1n,
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
     success: true,
   },
+} : kind === 'identity' ? {
+  type: 'bench:complete',
+  data: {
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+  },
 } : null;
 
 process.send?.({ type: 'node:bench:record', record });
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 28dcc8b2dbb7..8130bf38dc9f 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -121,6 +121,106 @@ for (const { patterns, message } of [
   });
 }
 
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(completions[0].benchId, completions[1].benchId);
+  assert.strictEqual(completions[0].runId, completions[1].runId);
+  assert.strictEqual(completions[0].runId, summary.runId);
+  assert.notStrictEqual(
+    completions[0].fileRunId, completions[1].fileRunId);
+  assert.deepStrictEqual(completions.map(({ entryFile }) => entryFile), [
+    fixtures.path('bench-runner/identity-entry-a.cjs'),
+    fixtures.path('bench-runner/identity-entry-b.cjs'),
+  ]);
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['shared suite', 'shared identity'],
+    ['shared suite', 'shared identity'],
+  ]);
+  assert.strictEqual(summary.fileRunId, null);
+  assert.strictEqual(summary.entryFile, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-suite.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const parentId = JSON.stringify([
+    fixtures.path('bench-runner/identity-suite.cjs'),
+    ['cross-module suite'],
+  ]);
+
+  assert.deepStrictEqual(completions.map(({ name }) => name), [
+    'child a',
+    'child b',
+  ]);
+  assert(completions.every((completion) =>
+    completion.parentId === parentId));
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['cross-module suite', 'child a'],
+    ['cross-module suite', 'child b'],
+  ]);
+  assert(completions.every(({ entryFile }) =>
+    entryFile === fixtures.path('bench-runner/identity-suite.cjs')));
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    '--require', fixtures.path('bench-runner/identity-preload.cjs'),
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const preloads = records.filter(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'preload identity').map(({ data }) => data);
+  assert.strictEqual(preloads.length, isolation === 'process' ? 2 : 1);
+  assert.strictEqual(
+    new Set(preloads.map(({ fileRunId }) => fileRunId)).size,
+    preloads.length,
+  );
+  assert(preloads.every(({ entryFile }) => entryFile === null));
+  assert(preloads.every(
+    ({ runId }) => runId === records.at(-1).data.runId));
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/identity-hook.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.message === 'scoped hook failed').data;
+  const completion = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'scoped hook benchmark').data;
+  assert.strictEqual(diagnostic.entryFile,
+                     fixtures.path('bench-runner/identity-hook.cjs'));
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+}
+
 {
   const result = spawnBench([
     '--bench-reporter=json',
@@ -297,6 +397,7 @@ for (const isolation of ['process', 'none']) {
 
 for (const { kind, message } of [
   { kind: 'record', message: /not a valid benchmark record/ },
+  { kind: 'identity', message: /not a valid benchmark record/ },
   { kind: 'summary', message: /not a valid benchmark summary/ },
 ]) {
   const result = spawnBench([
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
index a7194d002d55..5540a189ad52 100644
--- a/test/parallel/test-bench-create-runner.js
+++ b/test/parallel/test-bench-create-runner.js
@@ -54,6 +54,16 @@ const { setImmediate } = require('timers/promises');
   assert.strictEqual(secondResult.samples.length, 1);
   assert.strictEqual(firstResult.error, undefined);
   assert.strictEqual(secondResult.error, undefined);
+  assert.strictEqual(firstResult.benchId, secondResult.benchId);
+  assert.notStrictEqual(firstResult.runId, secondResult.runId);
+  assert.strictEqual(firstResult.fileRunId, firstResult.runId);
+  assert.strictEqual(secondResult.fileRunId, secondResult.runId);
+  assert.strictEqual(firstResult.entryFile, process.argv[1]);
+  assert.strictEqual(secondResult.entryFile, process.argv[1]);
+  assert.deepStrictEqual(firstResult.namePath, ['same name']);
+  assert.deepStrictEqual(secondResult.namePath, ['same name']);
+  assert(firstRecords.every(({ data }) => data.runId === firstResult.runId));
+  assert(secondRecords.every(({ data }) => data.runId === secondResult.runId));
   assert.strictEqual(
     firstRecords.filter(({ type }) => type === 'bench:summary').length, 1);
   assert.strictEqual(

From 5a346e081265e9b72517b449a5769bd29873b6d9 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 21:01:21 +0000
Subject: [PATCH 083/202] lib: improve node:bench stream handling

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                              |  24 ++
 .../bench_runner/benchmarks_stream.js         | 247 +++++++++++++--
 lib/internal/bench_runner/cli.js              | 128 ++++++--
 lib/internal/bench_runner/harness.js          | 179 ++++++++---
 lib/internal/error_serdes.js                  |  10 +-
 .../bench-runner/acknowledged-records.mjs     |  41 +++
 .../bench-runner/malformed-record.cjs         |   3 +-
 test/parallel/test-bench-cli.js               |  17 +
 test/parallel/test-bench-stream.js            | 292 ++++++++++++++++++
 test/sequential/test-error-serdes.js          |   4 +
 10 files changed, 846 insertions(+), 99 deletions(-)
 create mode 100644 test/fixtures/bench-runner/acknowledged-records.mjs
 create mode 100644 test/parallel/test-bench-stream.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 9c24d04ee4f0..00faab4a8d2b 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -553,6 +553,30 @@ The events are emitted in execution order:
 * `'bench:diagnostic'`
 * `'bench:summary'`
 
+Named event payloads, readable records, and benchmark completion values are
+independent snapshots. Mutating a value received through one delivery mechanism
+does not change values received through the others. As with other
+{EventEmitter} events, multiple listeners for the same named event receive the
+same event payload. Memory referenced through a {SharedArrayBuffer} remains
+shared, following structured clone semantics.
+
+Once a consumer starts reading, the runner honors the stream's object-mode
+high-water mark and waits between records when the consumer is slower than the
+producer. These waits occur after sample timing has ended, and records are not
+dropped. Snapshot creation and delivery waits are excluded from benchmark
+timeout accounting. Before readable consumption starts, records accumulate in
+the standard readable buffer and are included in `readableLength`. This keeps an
+unread stream and a consumer using only named events from deadlocking, but the
+buffer can grow without bound. A named-event-only consumer that does not need
+readable records should call `stream.resume()` to discard them. Destroying the
+stream stops readable delivery but does not cancel benchmark execution, so
+benchmark completion promises still settle. Automatically scheduled
+module-level runs drain their stream internally.
+
+With process isolation, each record sent by a child is acknowledged only after
+the parent has accepted it. A child sends no additional record until it receives
+that acknowledgement, bounding the IPC relay when a reporter is slow.
+
 Every benchmark-scoped event contains `runId`, `fileRunId`, `entryFile`,
 `benchId`, `parentId`, and `namePath`. `runId` and `fileRunId` are opaque and
 change between runs. `entryFile` identifies the top-level benchmark file whose
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
index 21d34896608b..6d656e0ffdd4 100644
--- a/lib/internal/bench_runner/benchmarks_stream.js
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -1,18 +1,201 @@
 'use strict';
 
 const {
+  ArrayFrom,
+  ArrayIsArray,
   ArrayPrototypePush,
-  ArrayPrototypeShift,
+  MapPrototypeClear,
+  MapPrototypeEntries,
+  MapPrototypeSet,
+  ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetOwnPropertyNames,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectSetPrototypeOf,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  SafeMap,
+  SetPrototypeAdd,
+  SetPrototypeClear,
+  SetPrototypeValues,
   Symbol,
 } = primordials;
 const Readable = require('internal/streams/readable');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { isError } = require('internal/util');
+const { isMap, isSet } = require('internal/util/types');
+const { structuredClone } = require('internal/worker/js_transferable');
 
 const kEmitMessage = Symbol('kEmitMessage');
-const kBenchmarksStreamDrain = Symbol('kBenchmarksStreamDrain');
+
+function repairError(source, clone, seen) {
+  const serialized = deserializeError(serializeError(source));
+  let sourceName;
+  try {
+    sourceName = source.name;
+  } catch {
+    // The serialized form already omits properties whose getters throw.
+  }
+  let repaired = clone;
+  if (!isError(repaired) ||
+      (sourceName !== undefined && repaired.name !== sourceName)) {
+    repaired = serialized;
+  }
+  if (repaired === null || typeof repaired !== 'object') return repaired;
+  seen.set(source, repaired);
+
+  if (serialized !== null && typeof serialized === 'object') {
+    const serializedKeys = ObjectGetOwnPropertyNames(serialized);
+    for (let i = 0; i < serializedKeys.length; i++) {
+      const key = serializedKeys[i];
+      if (ObjectPrototypeHasOwnProperty(repaired, key)) continue;
+      const descriptor = ObjectGetOwnPropertyDescriptor(serialized, key);
+      ObjectSetPrototypeOf(descriptor, null);
+      ObjectDefineProperty(repaired, key, descriptor);
+    }
+  }
+
+  const keys = ObjectGetOwnPropertyNames(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value') ||
+        typeof descriptor.value === 'function' ||
+        typeof descriptor.value === 'symbol') {
+      continue;
+    }
+    const existing = ObjectGetOwnPropertyDescriptor(repaired, key);
+    const value = descriptor.value !== null &&
+      typeof descriptor.value === 'object' ?
+      repairClone(descriptor.value, existing?.value, seen) : descriptor.value;
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(repaired, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  return repaired;
+}
+
+function repairClone(source, clone, seen) {
+  if (source === null || (typeof source !== 'object' &&
+                          typeof source !== 'function')) {
+    return clone === undefined ? source : clone;
+  }
+  if (typeof source === 'function') return clone;
+  if (seen.has(source)) return seen.get(source);
+  if (isError(source)) return repairError(source, clone, seen);
+  if (clone === null || typeof clone !== 'object') {
+    try {
+      clone = structuredClone(source);
+    } catch {
+      const prototype = ObjectGetPrototypeOf(source);
+      if (!ArrayIsArray(source) && prototype !== null &&
+          prototype !== ObjectPrototype) {
+        return clone;
+      }
+      clone = ArrayIsArray(source) ? [] : { __proto__: prototype };
+    }
+  }
+  seen.set(source, clone);
+  if (isMap(source) && isMap(clone)) {
+    const sourceEntries = ArrayFrom(MapPrototypeEntries(source));
+    const cloneEntries = ArrayFrom(MapPrototypeEntries(clone));
+    const repairedEntries = [];
+    for (let i = 0; i < sourceEntries.length; i++) {
+      ArrayPrototypePush(repairedEntries, [
+        repairClone(sourceEntries[i][0], cloneEntries[i][0], seen),
+        repairClone(sourceEntries[i][1], cloneEntries[i][1], seen),
+      ]);
+    }
+    MapPrototypeClear(clone);
+    for (let i = 0; i < repairedEntries.length; i++) {
+      MapPrototypeSet(clone, repairedEntries[i][0], repairedEntries[i][1]);
+    }
+    return clone;
+  }
+  if (isSet(source) && isSet(clone)) {
+    const sourceValues = ArrayFrom(SetPrototypeValues(source));
+    const cloneValues = ArrayFrom(SetPrototypeValues(clone));
+    const repairedValues = [];
+    for (let i = 0; i < sourceValues.length; i++) {
+      ArrayPrototypePush(
+        repairedValues, repairClone(sourceValues[i], cloneValues[i], seen));
+    }
+    SetPrototypeClear(clone);
+    for (let i = 0; i < repairedValues.length; i++) {
+      SetPrototypeAdd(clone, repairedValues[i]);
+    }
+    return clone;
+  }
+  const prototype = ObjectGetPrototypeOf(source);
+  if (prototype === null) ObjectSetPrototypeOf(clone, null);
+  if (prototype !== null && prototype !== ObjectPrototype &&
+      !ArrayIsArray(source)) {
+    return clone;
+  }
+  const keys = ObjectKeys(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value')) continue;
+    const existing = ObjectGetOwnPropertyDescriptor(clone, key);
+    const value = repairClone(descriptor.value, existing?.value, seen);
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(clone, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  if (ArrayIsArray(source)) {
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, 'length');
+    ObjectSetPrototypeOf(descriptor, null);
+    ObjectDefineProperty(clone, 'length', descriptor);
+  }
+  return clone;
+}
+
+function cloneRecordData(data) {
+  let clone;
+  try {
+    clone = structuredClone(data);
+  } catch (error) {
+    if (data.error === undefined) throw error;
+    clone = structuredClone({ __proto__: null, ...data, error: undefined });
+    clone.error = deserializeError(serializeError(data.error));
+  }
+  try {
+    return repairClone(data, clone, new SafeMap());
+  } catch {
+    return clone;
+  }
+}
 
 class BenchmarksStream extends Readable {
-  #buffer = [];
-  #canPush = true;
+  #blocked = false;
+  #drainWaiters = [];
+  #hasReader = false;
 
   constructor() {
     super({
@@ -22,13 +205,37 @@ class BenchmarksStream extends Readable {
   }
 
   _read() {
-    const wasBlocked = !this.#canPush;
-    this.#canPush = true;
-    while (this.#buffer.length > 0) {
-      const record = ArrayPrototypeShift(this.#buffer);
-      if (!this.#tryPush(record)) return;
+    if (this.#blocked) {
+      this.#blocked = false;
+      const waiters = this.#drainWaiters;
+      this.#drainWaiters = [];
+      for (let i = 0; i < waiters.length; i++) waiters[i].resolve();
+    }
+  }
+
+  read(size) {
+    if (size !== 0) this.#hasReader = true;
+    return super.read(size);
+  }
+
+  _destroy(error, callback) {
+    const failure = error ??
+      new ERR_INVALID_STATE('benchmark stream is closed');
+    const waiters = this.#drainWaiters;
+    this.#drainWaiters = [];
+    for (let i = 0; i < waiters.length; i++) waiters[i].reject(failure);
+    callback(error);
+  }
+
+  waitForDrain() {
+    if (this.destroyed) {
+      return PromiseReject(this.errored ??
+        new ERR_INVALID_STATE('benchmark stream is closed'));
     }
-    if (wasBlocked) this.emit(kBenchmarksStreamDrain);
+    if (!this.#blocked) return PromiseResolve();
+    const waiter = PromiseWithResolvers();
+    ArrayPrototypePush(this.#drainWaiters, waiter);
+    return waiter.promise;
   }
 
   start(data) {
@@ -56,21 +263,25 @@ class BenchmarksStream extends Readable {
   }
 
   [kEmitMessage](type, data) {
-    this.emit(type, data);
-    return this.#tryPush({ type, data });
+    const recordData = cloneRecordData(data);
+    const record = { __proto__: null, type, data: recordData };
+    if (this.listenerCount(type) > 0) {
+      this.emit(type, cloneRecordData(recordData));
+    }
+    return this.#tryPush(record);
   }
 
   #tryPush(record) {
-    if (this.#canPush) {
-      this.#canPush = this.push(record);
-    } else {
-      ArrayPrototypePush(this.#buffer, record);
+    if (this.destroyed) return false;
+    const canPush = this.push(record);
+    if (record !== null && !canPush && this.#hasReader) {
+      this.#blocked = true;
+      return false;
     }
-    return this.#canPush;
+    return true;
   }
 }
 
 module.exports = {
   BenchmarksStream,
-  kBenchmarksStreamDrain,
 };
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index 6c717aab6fff..ae33694818b5 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -16,6 +16,7 @@ const {
   PromisePrototypeThen,
   PromiseReject,
   PromiseResolve,
+  PromiseWithResolvers,
   RegExp,
   SafeMap,
   SafePromiseAllReturnVoid,
@@ -30,7 +31,6 @@ const { createWriteStream, statSync } = require('fs');
 const { Glob } = require('internal/fs/glob');
 const {
   BenchmarksStream,
-  kBenchmarksStreamDrain,
 } = require('internal/bench_runner/benchmarks_stream');
 const {
   configureRunScope,
@@ -65,6 +65,7 @@ const kBuiltinReporters = new SafeMap([
   ['json', 'internal/bench_runner/reporter/json'],
   ['spec', 'internal/bench_runner/reporter/spec'],
 ]);
+const kChildAckMessageType = 'node:bench:ack';
 const kChildMessageType = 'node:bench:record';
 const kEventTypes = new SafeSet([
   'bench:start',
@@ -281,7 +282,7 @@ function emitRecordAndWait(stream, record) {
     return PromiseReject(stream.errored ??
       new ERR_INVALID_STATE('benchmark output stream is closed'));
   }
-  return once(stream, kBenchmarksStreamDrain);
+  return stream.waitForDrain();
 }
 
 function serializeRecord(record) {
@@ -350,20 +351,66 @@ function validateRecord(record) {
   return record;
 }
 
+let nextChildRecordId = 0;
+let listeningForAcks = false;
+const pendingChildRecordAcks = new SafeMap();
+
+function listenForAcks() {
+  if (listeningForAcks) return;
+  listeningForAcks = true;
+  process.on('message', (message) => {
+    if (message?.type !== kChildAckMessageType) return;
+    const pending = pendingChildRecordAcks.get(message.id);
+    if (pending === undefined) return;
+    pendingChildRecordAcks.delete(message.id);
+    pending.resolve();
+  });
+  process.once('disconnect', () => {
+    const error = new ERR_INVALID_STATE(
+      'benchmark IPC channel closed before acknowledging records');
+    for (const pending of pendingChildRecordAcks.values()) {
+      pending.reject(error);
+    }
+    pendingChildRecordAcks.clear();
+  });
+}
+
 function sendRecord(record) {
+  listenForAcks();
+  const id = nextChildRecordId++;
+  const acknowledged = PromiseWithResolvers();
+  pendingChildRecordAcks.set(id, acknowledged);
+  try {
+    process.send({
+      __proto__: null,
+      id,
+      type: kChildMessageType,
+      record: serializeRecord(record),
+    }, undefined, undefined, (error) => {
+      if (error) {
+        pendingChildRecordAcks.delete(id);
+        acknowledged.reject(error);
+      }
+    });
+  } catch (error) {
+    pendingChildRecordAcks.delete(id);
+    acknowledged.reject(error);
+  }
+  return acknowledged.promise;
+}
+
+function sendAck(child, id) {
   return new Promise((resolve, reject) => {
-    try {
-      process.send({
-        __proto__: null,
-        type: kChildMessageType,
-        record: serializeRecord(record),
-      }, undefined, undefined, (error) => {
-        if (error) reject(error);
-        else resolve();
-      });
-    } catch (error) {
-      reject(error);
+    if (!child.connected) {
+      reject(new ERR_INVALID_STATE(
+        'benchmark child disconnected before acknowledgement'));
+      return;
     }
+    child.send({ __proto__: null, id, type: kChildAckMessageType },
+               undefined, undefined, (error) => {
+                 if (error) reject(error);
+                 else resolve();
+               });
   });
 }
 
@@ -505,6 +552,7 @@ async function runChild(path, options, scope, onRecord) {
     stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
   });
   let protocolError;
+  let recordPending = false;
   const pendingRecords = new SafeSet();
   const handleRecord = (record) => {
     if (protocolError !== undefined) return;
@@ -555,6 +603,12 @@ async function runChild(path, options, scope, onRecord) {
   child.on('message', (message) => {
     if (message?.type !== kChildMessageType) return;
     try {
+      if (!NumberIsSafeInteger(message.id) || message.id < 0 || recordPending) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'benchmark child message', message,
+          'does not have a valid record sequence');
+      }
+      recordPending = true;
       const record = deserializeRecord(validateRecord(message.record));
       record.data.runId = options.runId;
       if (record.data.fileRunId !== null) {
@@ -564,7 +618,13 @@ async function runChild(path, options, scope, onRecord) {
         record.data.entryFile = scope.entryFile;
       }
       const pending = handleRecord(record);
-      trackPending(pending);
+      if (protocolError === undefined) {
+        const acknowledged = PromisePrototypeThen(
+          PromiseResolve(pending), () => sendAck(child, message.id));
+        trackPending(PromisePrototypeThen(acknowledged, () => {
+          recordPending = false;
+        }));
+      }
     } catch (error) {
       protocolError = error;
       child.kill();
@@ -602,14 +662,18 @@ async function runIsolated(files, options, output) {
       });
     } catch (error) {
       success = false;
-      output.diagnostic({
+      await emitRecordAndWait(output, {
         __proto__: null,
-        runId: options.runId,
-        ...scope,
-        message: error.message,
-        error,
-        level: 'error',
-        file: path,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: error.message,
+          error,
+          level: 'error',
+          file: path,
+        },
       });
       continue;
     }
@@ -627,13 +691,17 @@ async function runIsolated(files, options, output) {
       if (childSummary === undefined || childSummary.success) {
         const status = result.signal === null ?
           `exit code ${result.code}` : `signal ${result.signal}`;
-        output.diagnostic({
+        await emitRecordAndWait(output, {
           __proto__: null,
-          runId: options.runId,
-          ...scope,
-          message: `Benchmark file '${path}' failed with ${status}`,
-          level: 'error',
-          file: path,
+          type: 'bench:diagnostic',
+          data: {
+            __proto__: null,
+            runId: options.runId,
+            ...scope,
+            message: `Benchmark file '${path}' failed with ${status}`,
+            level: 'error',
+            file: path,
+          },
         });
       }
     }
@@ -650,7 +718,11 @@ async function runIsolated(files, options, output) {
     duration_ns: hrtime() - start,
     file: files.length === 1 ? resolve(options.cwd, files[0]) : null,
   };
-  output.summary(summary);
+  await emitRecordAndWait(output, {
+    __proto__: null,
+    type: 'bench:summary',
+    data: summary,
+  });
   return summary;
 }
 
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index 09c06245c239..fa0a2146d53d 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -8,6 +8,7 @@ const {
   FunctionPrototypeCall,
   JSONStringify,
   MathCeil,
+  Number,
   Promise,
   PromisePrototypeThen,
   PromiseResolve,
@@ -311,15 +312,50 @@ class Harness {
     this.#scheduled = true;
     queueMicrotask(() => {
       if (this.#runPromise === null) {
-        this.#runPromise = this.#execute();
-        PromisePrototypeThen(this.#runPromise, undefined, (error) => {
-          this.#diagnostic(error, undefined, 'error');
-          this.#finish();
-        });
+        if (!this.#explicitRun) this.stream.resume();
+        this.#runPromise = PromisePrototypeThen(
+          this.#execute(), undefined, (error) => this.#recover(error));
       }
     });
   }
 
+  async #recover(error) {
+    this.#settleSubtree(this.root, error);
+    if (this.state !== 'finished') {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the original error.
+      }
+    }
+    try {
+      await this.#finish();
+    } catch {
+      // Stream failure has already been reported to its consumer.
+    }
+  }
+
+  #settleSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child.finished) continue;
+      if (child instanceof Suite) {
+        this.#settleSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+      } else {
+        this.success = false;
+        this.counts.failed++;
+        const result = this.#createResult(
+          child, [], { __proto__: null, error });
+        child.finished = true;
+        child.result = result;
+        child.completion.resolve(result);
+      }
+      child.emitDestroy();
+    }
+  }
+
   async #waitForBuild() {
     for (let i = 0; i < this.#buildPromises.length; i++) {
       await this.#buildPromises[i];
@@ -448,9 +484,18 @@ class Harness {
     };
   }
 
-  #diagnostic(error, loc, level = 'info', node = undefined) {
+  async #waitForStream(canContinue) {
+    if (canContinue) return;
+    try {
+      await this.stream.waitForDrain();
+    } catch (error) {
+      if (!this.stream.destroyed) throw error;
+    }
+  }
+
+  async #diagnostic(error, loc, level = 'info', node = undefined) {
     this.success = false;
-    this.stream.diagnostic({
+    await this.#waitForStream(this.stream.diagnostic({
       __proto__: null,
       ...this.#getRecordScope(node),
       message: error?.message ?? `${error}`,
@@ -459,7 +504,7 @@ class Harness {
       file: loc?.file ?? loc?.[2],
       line: loc?.line ?? loc?.[0],
       column: loc?.column ?? loc?.[1],
-    });
+    }));
   }
 
   async #completeSubtree(node, error) {
@@ -478,7 +523,7 @@ class Harness {
 
   async #executeSuite(suite) {
     if (suite.buildError !== null) {
-      this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
+      await this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
       await this.#completeSubtree(suite, suite.buildError);
       suite.finished = true;
       suite.completion.resolve();
@@ -492,7 +537,7 @@ class Harness {
       const failure = await this.#runSuiteHooks(suite, 'before');
       if (failure !== null) {
         beforeError = failure.error;
-        this.#diagnostic(
+        await this.#diagnostic(
           failure.error, failure.hook.loc, 'error', failure.hook);
       }
     }
@@ -513,7 +558,7 @@ class Harness {
     if (active) {
       const failure = await this.#runSuiteHooks(suite, 'after');
       if (failure !== null) {
-        this.#diagnostic(
+        await this.#diagnostic(
           failure.error, failure.hook.loc, 'error', failure.hook);
       }
     }
@@ -540,7 +585,7 @@ class Harness {
     }
   }
 
-  async #runWithStop(benchmark, controller, callback) {
+  async #runWithStop(benchmark, controller, callback, deadline) {
     const signals = [];
     if (this.outerSignal !== undefined) {
       ArrayPrototypePush(signals, this.outerSignal);
@@ -569,15 +614,31 @@ class Harness {
         stop.reject(error);
       }));
     }
-    if (benchmark.timeout !== Infinity) {
+    const armTimer = () => {
+      let remaining = deadline.value - hrtime();
+      if (remaining < 0n) remaining = 0n;
       timer = setTimeout(() => {
         const error = createTimeoutError(benchmark);
         controller.abort(error);
         stop.reject(error);
-      }, benchmark.timeout);
-    }
+      }, Number(remaining) / 1e6);
+    };
+    if (deadline !== null) armTimer();
+
+    const pause = async (work) => {
+      if (deadline === null) return work();
+      clearTimeout(timer);
+      timer = undefined;
+      const start = hrtime();
+      try {
+        return await work();
+      } finally {
+        deadline.value += hrtime() - start;
+        if (!controller.signal.aborted) armTimer();
+      }
+    };
 
-    const work = callback();
+    const work = callback(pause);
     try {
       if (signals.length === 0 && timer === undefined) return await work;
       return await SafePromiseRace([work, stop.promise]);
@@ -620,12 +681,17 @@ class Harness {
     };
   }
 
-  #recordResult(benchmark, result) {
+  async #recordResult(benchmark, result) {
     benchmark.finished = true;
     benchmark.result = result;
-    this.stream.complete(result);
-    benchmark.completion.resolve(result);
-    benchmark.emitDestroy();
+    let canContinue;
+    try {
+      canContinue = this.stream.complete(result);
+    } finally {
+      benchmark.completion.resolve(result);
+      benchmark.emitDestroy();
+    }
+    await this.#waitForStream(canContinue);
   }
 
   async #executeBench(benchmark, forcedError = undefined) {
@@ -633,7 +699,7 @@ class Harness {
     if (duplicateError !== undefined) {
       this.success = false;
       this.counts.failed++;
-      this.#recordResult(benchmark, this.#createResult(
+      await this.#recordResult(benchmark, this.#createResult(
         benchmark,
         [],
         { __proto__: null, error: duplicateError },
@@ -644,7 +710,7 @@ class Harness {
     const skip = this.#getSkip(benchmark);
     if (skip !== null) {
       this.counts.skipped++;
-      this.#recordResult(benchmark, this.#createResult(
+      await this.#recordResult(benchmark, this.#createResult(
         benchmark,
         [],
         { __proto__: null, skip },
@@ -655,7 +721,7 @@ class Harness {
     if (forcedError !== undefined) {
       this.success = false;
       this.counts.failed++;
-      this.#recordResult(benchmark, this.#createResult(
+      await this.#recordResult(benchmark, this.#createResult(
         benchmark,
         [],
         { __proto__: null, error: forcedError },
@@ -663,7 +729,7 @@ class Harness {
       return;
     }
 
-    this.stream.start({
+    await this.#waitForStream(this.stream.start({
       __proto__: null,
       ...this.#getRecordScope(benchmark),
       benchId: benchmark.benchId,
@@ -675,13 +741,15 @@ class Harness {
       column: benchmark.loc.column,
       tags: ArrayPrototypeSlice(benchmark.tags),
       params: benchmark.params,
-    });
+    }));
 
     const controller = new AbortController();
-    const deadline = benchmark.timeout === Infinity ?
-      null : hrtime() + BigInt(MathCeil(benchmark.timeout * 1e6));
+    const deadline = benchmark.timeout === Infinity ? null : {
+      __proto__: null,
+      value: hrtime() + BigInt(MathCeil(benchmark.timeout * 1e6)),
+    };
     const checkDeadline = () => {
-      if (deadline !== null && hrtime() >= deadline) {
+      if (deadline !== null && hrtime() >= deadline.value) {
         const timeoutError = createTimeoutError(benchmark);
         controller.abort(timeoutError);
         throw timeoutError;
@@ -697,7 +765,7 @@ class Harness {
     let error;
 
     try {
-      await this.#runWithStop(benchmark, controller, async () => {
+      await this.#runWithStop(benchmark, controller, async (pause) => {
         try {
           await this.#runBenchHooks(
             benchmark, 'beforeEach', hookContext);
@@ -718,7 +786,7 @@ class Harness {
             }
             if (i >= warmup) {
               ArrayPrototypePush(samples, sample);
-              this.stream.sample({
+              await pause(() => this.#waitForStream(this.stream.sample({
                 __proto__: null,
                 ...this.#getRecordScope(benchmark),
                 benchId: benchmark.benchId,
@@ -727,7 +795,7 @@ class Harness {
                 namePath: ArrayPrototypeSlice(benchmark.namePath),
                 index: i - warmup,
                 ...sample,
-              });
+              })));
             }
             if (done) break;
             if (i + 1 < total && this.#yieldBetweenSamples) {
@@ -739,7 +807,7 @@ class Harness {
             benchmark, 'afterEach', hookContext);
           checkDeadline();
         }
-      });
+      }, deadline);
     } catch (cause) {
       error = cause;
     } finally {
@@ -749,7 +817,7 @@ class Harness {
     if (error !== undefined) {
       this.success = false;
       this.counts.failed++;
-      this.#recordResult(benchmark, this.#createResult(
+      await this.#recordResult(benchmark, this.#createResult(
         benchmark,
         samples,
         { __proto__: null, error },
@@ -758,32 +826,41 @@ class Harness {
     }
 
     this.counts.completed++;
-    this.#recordResult(benchmark, this.#createResult(
+    await this.#recordResult(benchmark, this.#createResult(
       benchmark,
       samples,
       { __proto__: null, summary: summarizeSamples(samples) },
     ));
   }
 
-  #finish(startTime) {
+  async #finish(startTime) {
     if (this.state === 'finished') return;
     this.state = 'finished';
     const duration = startTime === undefined ? 0n : hrtime() - startTime;
-    this.stream.summary({
-      __proto__: null,
-      ...this.#getRecordScope(),
-      success: this.success,
-      counts: this.counts,
-      duration_ns: duration,
-      file: this.entryFile,
-    });
-    this.stream.end();
-    this.root.finished = true;
-    this.root.completion.resolve();
-    this.root.emitDestroy();
-    this.#storage.disable();
-    if (!this.#explicitRun && !this.success) {
-      process.exitCode = kGenericUserError;
+    try {
+      await this.#waitForStream(this.stream.summary({
+        __proto__: null,
+        ...this.#getRecordScope(),
+        success: this.success,
+        counts: this.counts,
+        duration_ns: duration,
+        file: this.entryFile,
+      }));
+    } catch (error) {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the summary listener error.
+      }
+    } finally {
+      this.stream.end();
+      this.root.finished = true;
+      this.root.completion.resolve();
+      this.root.emitDestroy();
+      this.#storage.disable();
+      if (!this.#explicitRun && !this.success) {
+        process.exitCode = kGenericUserError;
+      }
     }
   }
 
@@ -795,7 +872,7 @@ class Harness {
     this.#prepare();
     this.state = 'running';
     await this.#executeSuite(this.root);
-    this.#finish(startTime);
+    await this.#finish(startTime);
   }
 }
 
diff --git a/lib/internal/error_serdes.js b/lib/internal/error_serdes.js
index efe75192d9f5..d473da06fd49 100644
--- a/lib/internal/error_serdes.js
+++ b/lib/internal/error_serdes.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  AggregateError,
   ArrayPrototypeForEach,
   Error,
   EvalError,
@@ -41,7 +42,14 @@ const kCircularReference = 5;
 const kSymbolStringLength = 'Symbol('.length;
 
 const errors = {
-  Error, TypeError, RangeError, URIError, SyntaxError, ReferenceError, EvalError,
+  AggregateError,
+  Error,
+  EvalError,
+  RangeError,
+  ReferenceError,
+  SyntaxError,
+  TypeError,
+  URIError,
 };
 const errorConstructorNames = new SafeSet(ObjectKeys(errors));
 
diff --git a/test/fixtures/bench-runner/acknowledged-records.mjs b/test/fixtures/bench-runner/acknowledged-records.mjs
new file mode 100644
index 000000000000..633f3412eaaf
--- /dev/null
+++ b/test/fixtures/bench-runner/acknowledged-records.mjs
@@ -0,0 +1,41 @@
+import common from '../../common/index.js';
+
+const pending = new Map();
+const onMessage = (message) => {
+  if (message?.type !== 'node:bench:ack') return;
+  pending.get(message.id)?.();
+  pending.delete(message.id);
+};
+process.on('message', onMessage);
+
+const timeout = setTimeout(() => {
+  throw new Error('benchmark record was not acknowledged');
+}, common.platformTimeout(10_000));
+
+function sendDiagnostic(id) {
+  return new Promise((resolve, reject) => {
+    pending.set(id, resolve);
+    process.send({
+      id,
+      type: 'node:bench:record',
+      record: {
+        type: 'bench:diagnostic',
+        data: {
+          runId: process.env.NODE_BENCH_RUN_ID,
+          fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+          entryFile: process.argv[1],
+          message: `acknowledged ${id}`,
+          level: 'info',
+          file: process.argv[1],
+        },
+      },
+    }, (error) => {
+      if (error) reject(error);
+    });
+  });
+}
+
+for (let i = 0; i < 32; i++) await sendDiagnostic(10_000 + i);
+
+clearTimeout(timeout);
+process.off('message', onMessage);
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
index ab8b4bb84dc1..909e11877e72 100644
--- a/test/fixtures/bench-runner/malformed-record.cjs
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -3,6 +3,7 @@
 const common = require('../../common');
 
 const kind = process.env.NODE_BENCH_MALFORMED_RECORD;
+const id = kind === 'sequence' ? null : 0;
 const record = kind === 'summary' ? {
   type: 'bench:summary',
   data: {
@@ -22,5 +23,5 @@ const record = kind === 'summary' ? {
   },
 } : null;
 
-process.send?.({ type: 'node:bench:record', record });
+process.send?.({ id, type: 'node:bench:record', record });
 setTimeout(() => process.exit(2), common.platformTimeout(10_000));
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 8130bf38dc9f..07924acadcfc 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -396,6 +396,7 @@ for (const isolation of ['process', 'none']) {
 }
 
 for (const { kind, message } of [
+  { kind: 'sequence', message: /valid record sequence/ },
   { kind: 'record', message: /not a valid benchmark record/ },
   { kind: 'identity', message: /not a valid benchmark record/ },
   { kind: 'summary', message: /not a valid benchmark summary/ },
@@ -561,6 +562,22 @@ if (common.hasInspector) {
                      Array.from({ length: 30 }, (_, i) => `${i}\n`).join(''));
 }
 
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/acknowledged-records.mjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(diagnostics.every(
+    ({ data }) => /^acknowledged 10\d{3}$/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, true);
+}
+
 {
   const result = spawnBench([
     `--bench-reporter=${fixtures.fileURL('bench-runner/destroying-reporter.cjs')}`,
diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
new file mode 100644
index 000000000000..89425e4c079c
--- /dev/null
+++ b/test/parallel/test-bench-stream.js
@@ -0,0 +1,292 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate, setTimeout } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    operations: 1,
+    duration_ns: 1n,
+  });
+}
+
+async function testReadableBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('bounded stream', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:start');
+  await setImmediate();
+  assert(calls < sampleCount);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  const result = await completion;
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(records.length, sampleCount + 3);
+}
+
+async function testNamedEventsWithoutReading() {
+  const runner = createRunner();
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('named events', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const summary = await new Promise((resolve) => {
+    stream.once('bench:summary', resolve);
+  });
+  const result = await completion;
+
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(stream.readableLength, sampleCount + 3);
+  assert(stream.readableLength > stream.readableHighWaterMark);
+  stream.destroy();
+}
+
+async function testCancellationCompletesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const first = runner.bench('cancelled stream', { samples: 64 }, recordSample);
+  const second = runner.bench('continues headlessly', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await iterator.return();
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].samples.length, 64);
+  assert.strictEqual(results[1].samples.length, 1);
+}
+
+async function testDeliveryDoesNotConsumeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.bench('slow consumer', {
+    samples: 32,
+    timeout: common.platformTimeout(20),
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await setTimeout(common.platformTimeout(50));
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+  }
+
+  const result = await completion;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 32);
+}
+
+async function testReportingFailureSettlesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('record listener failed');
+  const first = runner.bench('reported', { samples: 1 }, recordSample);
+  const second = runner.bench('settled', { samples: 1 }, recordSample);
+  const stream = runner.run();
+  stream.once('bench:complete', common.mustCall(() => {
+    throw failure;
+  }));
+  stream.resume();
+
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].error, undefined);
+  assert.strictEqual(results[1].error, failure);
+  await setImmediate();
+}
+
+async function testSummaryListenerFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('summary listener failed');
+  const completion = runner.bench('summary failure', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const diagnostics = [];
+  stream.on('bench:diagnostic', (diagnostic) => {
+    diagnostics.push(diagnostic);
+  });
+  stream.once('bench:summary', common.mustCall(() => {
+    throw failure;
+  }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+
+  const result = await completion;
+  await ended;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(diagnostics.length, 1);
+  assert.strictEqual(diagnostics[0].error.message, failure.message);
+}
+
+async function testRecordOwnership() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const expectedError = new Error('expected failure');
+  expectedError.code = 'ERR_EXPECTED';
+  expectedError.cause = expectedError;
+  expectedError.uncloneable = new WeakMap();
+  expectedError.context = {
+    note: 'preserved',
+    callback() {},
+  };
+  const innerError = new Error('inner failure');
+  innerError.code = 'ERR_INNER';
+  const aggregate = new AggregateError([innerError], 'aggregate failure');
+  aggregate.code = 'ERR_AGGREGATE';
+  const causedError = new Error('caused failure', { cause: aggregate });
+  causedError.references = new Map([['self', causedError]]);
+  causedError.members = new Set([causedError]);
+  const measured = runner.bench('owned result', {
+    params: { kind: 'original' },
+    samples: 1,
+  }, (b) => {
+    b.record({
+      __proto__: null,
+      operations: 1,
+      duration_ns: 1n,
+      detail: { value: 'original' },
+    });
+  });
+  const failed = runner.bench('owned error', { samples: 1 }, () => {
+    throw expectedError;
+  });
+  const caused = runner.bench('owned cause', { samples: 1 }, () => {
+    throw causedError;
+  });
+  const thrownValue = new WeakMap();
+  const uncloneable = runner.bench('uncloneable error', {
+    samples: 1,
+  }, () => {
+    throw thrownValue;
+  });
+  const proxyError = new Proxy({}, {
+    getPrototypeOf() {
+      throw new Error('prototype trap');
+    },
+  });
+  const trapped = runner.bench('trapping error', { samples: 1 }, () => {
+    throw proxyError;
+  });
+  const afterTrap = runner.bench('after trapping error', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  let eventSample;
+  let eventComplete;
+  let eventError;
+  let eventSummary;
+
+  stream.on('bench:sample', (sample) => {
+    if (sample.name !== 'owned result') return;
+    eventSample = sample;
+    sample.name = 'changed by event';
+    sample.detail.value = 'changed by event';
+  });
+  stream.on('bench:complete', (result) => {
+    if (result.name === 'owned result') {
+      eventComplete = result;
+      result.params.kind = 'changed by event';
+      result.samples[0].detail.value = 'changed by event';
+    } else if (result.name === 'owned error') {
+      eventError = result.error;
+      result.error.code = 'ERR_CHANGED';
+    }
+  });
+  stream.on('bench:summary', (summary) => {
+    eventSummary = summary;
+    summary.counts.total = 100;
+  });
+
+  const records = await stream.toArray();
+  const measuredResult = await measured;
+  const failedResult = await failed;
+  await caused;
+  const uncloneableResult = await uncloneable;
+  const trappedResult = await trapped;
+  const afterTrapResult = await afterTrap;
+  const streamSample = records.find(
+    ({ type }) => type === 'bench:sample').data;
+  const streamResults = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const streamMeasured = streamResults.find(
+    ({ name }) => name === 'owned result');
+  const streamFailed = streamResults.find(
+    ({ name }) => name === 'owned error');
+  const streamCaused = streamResults.find(
+    ({ name }) => name === 'owned cause');
+  const streamSummary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+
+  assert.notStrictEqual(eventSample, streamSample);
+  assert.notStrictEqual(eventComplete, streamMeasured);
+  assert.notStrictEqual(streamMeasured, measuredResult);
+  assert.strictEqual(streamSample.name, 'owned result');
+  assert.strictEqual(streamSample.detail.value, 'original');
+  assert.strictEqual(streamMeasured.params.kind, 'original');
+  assert.strictEqual(streamMeasured.samples[0].detail.value, 'original');
+  assert.strictEqual(measuredResult.params.kind, 'original');
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+
+  streamMeasured.samples[0].detail.value = 'changed by stream';
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+  assert.notStrictEqual(eventError, streamFailed.error);
+  assert.notStrictEqual(streamFailed.error, expectedError);
+  assert.strictEqual(streamFailed.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(streamFailed.error.cause, streamFailed.error);
+  assert.strictEqual(streamFailed.error.context.note, 'preserved');
+  assert.strictEqual(streamFailed.error.context.callback, undefined);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(failedResult.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(failedResult.error.cause, failedResult.error);
+  assert.strictEqual(uncloneableResult.error, thrownValue);
+  assert.strictEqual(trappedResult.error, proxyError);
+  assert.strictEqual(afterTrapResult.error, undefined);
+  assert(streamCaused.error.cause instanceof AggregateError);
+  assert.strictEqual(streamCaused.error.cause.name, 'AggregateError');
+  assert.strictEqual(streamCaused.error.cause.code, 'ERR_AGGREGATE');
+  assert.strictEqual(streamCaused.error.cause.errors[0].code, 'ERR_INNER');
+  assert.strictEqual(
+    streamCaused.error.references.get('self'), streamCaused.error);
+  assert.strictEqual(streamCaused.error.members.has(streamCaused.error), true);
+  assert.notStrictEqual(eventSummary, streamSummary);
+  assert.strictEqual(streamSummary.counts.total, 6);
+}
+
+(async () => {
+  await testReadableBackpressure();
+  await testNamedEventsWithoutReading();
+  await testCancellationCompletesBenchmarks();
+  await testDeliveryDoesNotConsumeTimeout();
+  await testReportingFailureSettlesBenchmarks();
+  await testSummaryListenerFailure();
+  await testRecordOwnership();
+})().then(common.mustCall());
diff --git a/test/sequential/test-error-serdes.js b/test/sequential/test-error-serdes.js
index acd08903efab..75a37b376ca1 100644
--- a/test/sequential/test-error-serdes.js
+++ b/test/sequential/test-error-serdes.js
@@ -39,6 +39,10 @@ assert.strictEqual(cycle(new ReferenceError('foo')).name, 'ReferenceError');
 assert.strictEqual(cycle(new URIError('foo')).name, 'URIError');
 assert.strictEqual(cycle(new EvalError('foo')).name, 'EvalError');
 assert.strictEqual(cycle(new SyntaxError('foo')).name, 'SyntaxError');
+const aggregate = cycle(new AggregateError([new Error('inner')], 'aggregate'));
+assert(aggregate instanceof AggregateError);
+assert.strictEqual(aggregate.message, 'aggregate');
+assert.strictEqual(aggregate.errors[0].message, 'inner');
 
 class SubError extends Error {}
 

From 220f6b540730c634b6a1069ceda9dacd55a5f79b Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 21:13:09 +0000
Subject: [PATCH 084/202] lib: clarify mean in node:bench docs

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                            | 19 ++++++++++++++++++-
 test/parallel/test-bench-context-control.js | 19 +++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 00faab4a8d2b..4e3c8c890777 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -81,6 +81,22 @@ Calling `context.done()` during a measured sample completes the benchmark after
 that sample. This allows a higher-level tool to treat `samples` as a maximum and
 implement a dynamic sampling policy.
 
+The number of operations can differ between samples. Summary statistics treat
+each sample's `rate` as one equally weighted observation. In particular,
+`summary.mean` is the arithmetic mean of the per-sample rates. It is not the
+pooled throughput calculated as:
+
+```text
+1_000_000_000 * sum(sample.operations) / sum(sample.duration_ns)
+```
+
+The two values can differ when sample durations vary because pooled throughput
+weights each per-sample rate by its duration. A higher-level tool that varies
+batch sizes should choose the aggregation that matches its analysis. It can
+calculate pooled throughput from the raw `samples`; operation counts should be
+summed as `bigint` values because their total can exceed
+`Number.MAX_SAFE_INTEGER` even though each count cannot.
+
 ## Reusable runners
 
 The module-level declaration functions use a shared runner and schedule it
@@ -621,7 +637,8 @@ A completed benchmark result contains:
 * `params` {Object} The canonical parameter metadata.
 * `samples` {Object\[]} The exact measured samples.
 * `summary` {Object}
-  * `mean` {number} The arithmetic mean of per-sample rates.
+  * `mean` {number} The equally weighted arithmetic mean of per-sample rates,
+    not pooled throughput across all operations and durations.
   * `median` {number} The median per-sample rate.
   * `min` {number} The minimum per-sample rate.
   * `max` {number} The maximum per-sample rate.
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
index b9adb9f2f9f1..b847e926ffcd 100644
--- a/test/parallel/test-bench-context-control.js
+++ b/test/parallel/test-bench-context-control.js
@@ -59,10 +59,21 @@ const { createRunner } = require('node:bench');
       b.done();
     }));
 
+  const variableSamples = [
+    { __proto__: null, duration_ns: 1_000_000_000n, operations: 1 },
+    { __proto__: null, duration_ns: 100_000_000n, operations: 100 },
+  ];
+  const variableCompletion = runner.bench('variable batch', {
+    samples: variableSamples.length,
+  }, common.mustCall((b) => {
+    b.record(variableSamples[b.index]);
+  }, variableSamples.length));
+
   const records = await runner.run().toArray();
-  const [controlled, recorded] = await Promise.all([
+  const [controlled, recorded, variable] = await Promise.all([
     controlledCompletion,
     recordedCompletion,
+    variableCompletion,
   ]);
 
   assert.deepStrictEqual(invocations, [
@@ -80,8 +91,12 @@ const { createRunner } = require('node:bench');
   assert.strictEqual(recorded.samples.length, 1);
   assert.deepStrictEqual(recorded.samples[0].detail,
                          { source: 'worker', value: 1n });
+  assert.deepStrictEqual(variable.samples.map(({ rate }) => rate), [1, 1000]);
+  assert.strictEqual(variable.summary.mean, 500.5);
+  const pooledRate = 1_000_000_000 * 101 / 1_100_000_000;
+  assert.notStrictEqual(variable.summary.mean, pooledRate);
   assert.strictEqual(
-    records.filter(({ type }) => type === 'bench:sample').length, 3);
+    records.filter(({ type }) => type === 'bench:sample').length, 5);
   assert.throws(() => closedContext.start(), { code: 'ERR_INVALID_STATE' });
   assert.throws(() => closedContext.end(1), { code: 'ERR_INVALID_STATE' });
   assert.throws(() => closedContext.record({

From dd22718ea96e113f93c5f4255e27230d2c2360f8 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 21:23:37 +0000
Subject: [PATCH 085/202] doc: clarify measurement integrity details of
 node:bench

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md | 36 ++++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 4e3c8c890777..0636f35cbfbb 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -38,12 +38,17 @@ suite('URL', () => {
     params: { input: 'short' },
   }, (b) => {
     const operations = 10_000;
+    let totalLength = 0;
 
     b.start();
     for (let i = 0; i < operations; i++) {
-      new URL(input);
+      totalLength += new URL(input).href.length;
     }
     b.end(operations);
+
+    if (totalLength !== operations * input.length) {
+      throw new Error('Unexpected URL result');
+    }
   });
 });
 ```
@@ -77,6 +82,32 @@ system load can all affect results. Keep raw samples when comparing results and
 investigate noisy or skewed distributions rather than treating a confidence
 interval as a pass/fail threshold.
 
+### Measurement integrity
+
+A statistically consistent result does not prove that a benchmark measured the
+intended work. An optimizing runtime can remove work whose result is unused or
+specialize it more narrowly than the workload being modeled. Framework and loop
+overhead can also dominate operations that are too short. To reduce these risks:
+
+* Make values produced by measured work observable outside the measured
+  interval, for example by validating an aggregate derived from every result.
+  Passing them only through unused local computations is insufficient.
+* Perform enough operations in each sample to amortize fixed timer reads and
+  calls to `context.start()` and `context.end()`. If loop bookkeeping is material
+  relative to one operation, batch multiple operations per iteration and report
+  the total operation count.
+* Inspect raw `samples` for trends that indicate insufficient warmup or
+  optimization tiering, pauses consistent with garbage collection, and
+  multimodal distributions.
+* Validate surprising results with an independent benchmark shape that performs
+  the same intended work differently.
+
+`node:bench` does not force a particular optimization state or infer whether an
+engine eliminated work. Such controls and diagnostics are runtime-specific and
+heuristic, and do not replace validating the benchmark workload.
+
+### Dynamic sampling and variable batches
+
 Calling `context.done()` during a measured sample completes the benchmark after
 that sample. This allows a higher-level tool to treat `samples` as a maximum and
 implement a dynamic sampling policy.
@@ -635,7 +666,8 @@ A completed benchmark result contains:
 * `column` {number} The source column.
 * `tags` {string\[]} The inherited canonical tags.
 * `params` {Object} The canonical parameter metadata.
-* `samples` {Object\[]} The exact measured samples.
+* `samples` {Object\[]} The exact measured samples in measurement invocation
+  order.
 * `summary` {Object}
   * `mean` {number} The equally weighted arithmetic mean of per-sample rates,
     not pooled throughput across all operations and durations.

From 09de6104f2cc4a31889b40ed7d05294ee70134bd Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 22:23:39 +0000
Subject: [PATCH 086/202] lib: add `bench:plan` event to `node:bench`

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                              | 28 ++++++
 .../bench_runner/benchmarks_stream.js         |  4 +
 lib/internal/bench_runner/cli.js              | 86 ++++++++++++++++---
 lib/internal/bench_runner/harness.js          | 34 +++++++-
 .../bench-runner/destroying-reporter.cjs      |  2 +-
 .../load-error-after-declaration.cjs          | 11 +++
 .../bench-runner/malformed-plan-order.mjs     | 34 ++++++++
 .../bench-runner/malformed-record.cjs         | 33 +++++++
 test/fixtures/bench-runner/slow-reporter.cjs  |  1 +
 test/parallel/test-bench-cli.js               | 80 +++++++++++++++++
 test/parallel/test-bench-filtering.js         | 23 ++++-
 test/parallel/test-bench-harness-errors.js    |  6 ++
 test/parallel/test-bench-reporters.js         |  4 +-
 test/parallel/test-bench-run-options.js       | 30 ++++++-
 test/parallel/test-bench-run.js               |  6 ++
 test/parallel/test-bench-stream.js            | 42 ++++++++-
 16 files changed, 402 insertions(+), 22 deletions(-)
 create mode 100644 test/fixtures/bench-runner/load-error-after-declaration.cjs
 create mode 100644 test/fixtures/bench-runner/malformed-plan-order.mjs

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 0636f35cbfbb..b22f8f5050ce 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -594,6 +594,7 @@ both emitted as a named event and made available on the stream as
 
 The events are emitted in execution order:
 
+* `'bench:plan'`
 * `'bench:start'`
 * `'bench:sample'`
 * `'bench:complete'`
@@ -631,6 +632,33 @@ loading caused the declaration, while `file` identifies the source location of
 the declaration itself. `parentId` is based on the containing suite's source
 file and hierarchical name path.
 
+After asynchronous suite declarations settle, an in-process runner emits one
+`'bench:plan'` event for every benchmark it collected, in declaration order.
+All plans from that runner are emitted before its suite hooks or benchmark
+callbacks run. With process isolation, files run in separate children, so plans
+for a later file are emitted after an earlier child has completed. With no
+isolation, all files share one runner and their plans are emitted before any
+benchmark executes. Plan data contains the benchmark-scoped identity, location,
+tags, and parameters described in [benchmark result][], together with:
+
+* `samples` {number} The effective maximum number of measured callback
+  invocations after run-level overrides.
+* `warmup` {number} The effective number of unreported warmup callback
+  invocations after run-level overrides.
+* `timeout` {number|null} The timeout in milliseconds, or `null` when no timeout
+  is configured.
+* `yieldBetweenSamples` {boolean} Whether an event loop turn is scheduled between
+  sample callbacks.
+* `selected` {boolean} Whether the benchmark is eligible to run after applying
+  `skip`, `only`, and `namePattern` selection. Execution can still be prevented
+  by a duplicate declaration, suite build, hook, abort, or other runtime failure.
+* `skip` {boolean|string} When `selected` is `false`, the explicit skip value or
+  the selection reason, such as `'only'` or `'name pattern'`.
+
+The plan contains execution settings known to the runner. Runtime version,
+operating system, processor, and other environment metadata are intentionally
+left for reporters and higher-level tools to collect.
+
 `'bench:complete'` data contains a [benchmark result][]. A failed result has an
 additional `error` property and may contain samples recorded before the error.
 A skipped result has an additional `skip` property and an empty `samples`
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
index 6d656e0ffdd4..295aa20483ce 100644
--- a/lib/internal/bench_runner/benchmarks_stream.js
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -238,6 +238,10 @@ class BenchmarksStream extends Readable {
     return waiter.promise;
   }
 
+  plan(data) {
+    return this[kEmitMessage]('bench:plan', data);
+  }
+
   start(data) {
     return this[kEmitMessage]('bench:start', data);
   }
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index ae33694818b5..c0e07d4a72f4 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -10,8 +10,12 @@ const {
   ArrayPrototypePushApply,
   ArrayPrototypeSome,
   ArrayPrototypeSort,
+  NumberIsFinite,
   NumberIsSafeInteger,
   ObjectGetOwnPropertyDescriptor,
+  ObjectGetPrototypeOf,
+  ObjectPrototype,
+  ObjectValues,
   Promise,
   PromisePrototypeThen,
   PromiseReject,
@@ -46,6 +50,7 @@ const {
   },
 } = require('internal/errors');
 const { getOptionValue, getOptionsAsFlagsFromBinding } = require('internal/options');
+const { TIMEOUT_MAX } = require('internal/timers');
 const { kEmptyObject } = require('internal/util');
 const { validateUint32 } = require('internal/validators');
 const { pathToFileURL } = require('internal/url');
@@ -68,6 +73,7 @@ const kBuiltinReporters = new SafeMap([
 const kChildAckMessageType = 'node:bench:ack';
 const kChildMessageType = 'node:bench:record';
 const kEventTypes = new SafeSet([
+  'bench:plan',
   'bench:start',
   'bench:sample',
   'bench:complete',
@@ -256,6 +262,8 @@ async function finishReporters(state) {
 
 function emitRecord(stream, record) {
   switch (record.type) {
+    case 'bench:plan':
+      return stream.plan(record.data);
     case 'bench:start':
       return stream.start(record.data);
     case 'bench:sample':
@@ -311,6 +319,14 @@ function deserializeRecord(record) {
   };
 }
 
+function isStringArray(value) {
+  if (!ArrayIsArray(value)) return false;
+  for (let i = 0; i < value.length; i++) {
+    if (typeof value[i] !== 'string') return false;
+  }
+  return true;
+}
+
 function validateRecord(record) {
   if (record === null || typeof record !== 'object' ||
       !kEventTypes.has(record.type) || record.data === null ||
@@ -323,18 +339,52 @@ function validateRecord(record) {
     throw new ERR_INVALID_ARG_VALUE(
       'benchmark child message', record, 'is not a valid benchmark record');
   }
-  if ((record.type === 'bench:start' || record.type === 'bench:sample' ||
-       record.type === 'bench:complete') &&
-      (typeof record.data.benchId !== 'string' ||
+  if ((record.type === 'bench:plan' || record.type === 'bench:start' ||
+       record.type === 'bench:sample' || record.type === 'bench:complete') &&
+      (typeof record.data.fileRunId !== 'string' ||
+       typeof record.data.benchId !== 'string' ||
        (record.data.parentId !== null &&
-        typeof record.data.parentId !== 'string') ||
-       typeof record.data.name !== 'string' ||
-       !ArrayIsArray(record.data.namePath) ||
-       ArrayPrototypeSome(
-         record.data.namePath, (name) => typeof name !== 'string'))) {
+         typeof record.data.parentId !== 'string') ||
+        typeof record.data.name !== 'string' ||
+        !isStringArray(record.data.namePath))) {
     throw new ERR_INVALID_ARG_VALUE(
       'benchmark child message', record, 'is not a valid benchmark record');
   }
+  if (record.type === 'bench:plan') {
+    const {
+      samples,
+      selected,
+      skip,
+      timeout,
+      warmup,
+      yieldBetweenSamples,
+    } = record.data;
+    if (typeof record.data.file !== 'string' ||
+        !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+        !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+        !isStringArray(record.data.tags) ||
+        record.data.params === null ||
+        typeof record.data.params !== 'object' ||
+        ArrayIsArray(record.data.params) ||
+        (ObjectGetPrototypeOf(record.data.params) !== null &&
+         ObjectGetPrototypeOf(record.data.params) !== ObjectPrototype) ||
+        ArrayPrototypeSome(ObjectValues(record.data.params), (value) =>
+          typeof value !== 'string' && typeof value !== 'boolean' &&
+          (typeof value !== 'number' || !NumberIsFinite(value))) ||
+        !NumberIsSafeInteger(samples) || samples <= 0 ||
+        samples > 0xFFFFFFFF ||
+        !NumberIsSafeInteger(warmup) || warmup < 0 || warmup > 0xFFFFFFFF ||
+        (timeout !== null &&
+         (!NumberIsFinite(timeout) || timeout < 0 || timeout > TIMEOUT_MAX)) ||
+        typeof yieldBetweenSamples !== 'boolean' ||
+        typeof selected !== 'boolean' ||
+        (selected && skip !== undefined) ||
+        (!selected && skip !== true && typeof skip !== 'string')) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child plan', record.data,
+        'is not a valid benchmark plan');
+    }
+  }
   if (record.type === 'bench:summary') {
     const { counts, duration_ns, success } = record.data;
     if (typeof success !== 'boolean' || typeof duration_ns !== 'bigint' ||
@@ -552,7 +602,9 @@ async function runChild(path, options, scope, onRecord) {
     stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
   });
   let protocolError;
+  let plansComplete = false;
   let recordPending = false;
+  let summaryReceived = false;
   const pendingRecords = new SafeSet();
   const handleRecord = (record) => {
     if (protocolError !== undefined) return;
@@ -571,7 +623,7 @@ async function runChild(path, options, scope, onRecord) {
       source?.resume();
     }, (error) => {
       pendingRecords.delete(tracked);
-      protocolError = error;
+      protocolError ??= error;
       child.kill();
     });
     pendingRecords.add(tracked);
@@ -610,10 +662,18 @@ async function runChild(path, options, scope, onRecord) {
       }
       recordPending = true;
       const record = deserializeRecord(validateRecord(message.record));
-      record.data.runId = options.runId;
-      if (record.data.fileRunId !== null) {
-        record.data.fileRunId = scope.fileRunId;
+      if (summaryReceived || (record.type === 'bench:plan' && plansComplete)) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'benchmark child message', message,
+          'does not have a valid lifecycle sequence');
       }
+      if (record.type !== 'bench:plan' &&
+          record.type !== 'bench:diagnostic') {
+        plansComplete = true;
+      }
+      if (record.type === 'bench:summary') summaryReceived = true;
+      record.data.runId = options.runId;
+      record.data.fileRunId = scope.fileRunId;
       if (record.data.entryFile !== null) {
         record.data.entryFile = scope.entryFile;
       }
@@ -626,7 +686,7 @@ async function runChild(path, options, scope, onRecord) {
         }));
       }
     } catch (error) {
-      protocolError = error;
+      protocolError ??= error;
       child.kill();
     }
   });
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index fa0a2146d53d..0247500059be 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -254,7 +254,7 @@ class Harness {
       if (typeof namePattern === 'string') {
         nextNamePattern = new RegExp(namePattern);
       } else if (isRegExp(namePattern)) {
-        nextNamePattern = namePattern;
+        nextNamePattern = new RegExp(namePattern);
       } else {
         throw new ERR_INVALID_ARG_TYPE(
           'options.namePattern', ['string', 'RegExp'], namePattern);
@@ -391,6 +391,37 @@ class Harness {
     });
   }
 
+  async #emitPlans() {
+    const benchmarks = [];
+    this.#walk(this.root, (node) => {
+      if (node instanceof Bench) ArrayPrototypePush(benchmarks, node);
+    });
+    for (let i = 0; i < benchmarks.length; i++) {
+      const benchmark = benchmarks[i];
+      const skip = this.#getSkip(benchmark);
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+        tags: ArrayPrototypeSlice(benchmark.tags),
+        params: benchmark.params,
+        samples: this.samples ?? benchmark.samples,
+        warmup: this.warmup ?? benchmark.warmup,
+        timeout: benchmark.timeout === Infinity ? null : benchmark.timeout,
+        yieldBetweenSamples: this.#yieldBetweenSamples,
+        selected: skip === null,
+      };
+      if (skip !== null) data.skip = skip;
+      await this.#waitForStream(this.stream.plan(data));
+    }
+  }
+
   #hasSelectedAncestor(benchmark) {
     for (let current = benchmark; current !== null; current = current.parent) {
       if (current.only) return true;
@@ -871,6 +902,7 @@ class Harness {
     this.#fileScopeStorage.disable();
     this.#prepare();
     this.state = 'running';
+    await this.#emitPlans();
     await this.#executeSuite(this.root);
     await this.#finish(startTime);
   }
diff --git a/test/fixtures/bench-runner/destroying-reporter.cjs b/test/fixtures/bench-runner/destroying-reporter.cjs
index 9e3c04fb1fb0..8a2a2406f932 100644
--- a/test/fixtures/bench-runner/destroying-reporter.cjs
+++ b/test/fixtures/bench-runner/destroying-reporter.cjs
@@ -1,7 +1,7 @@
 'use strict';
 
 module.exports = async function* destroyingReporter(source) {
-  source.once('bench:start', () => {
+  source.once('bench:plan', () => {
     source.destroy(new Error('benchmark reporter closed the stream'));
   });
   yield* source;
diff --git a/test/fixtures/bench-runner/load-error-after-declaration.cjs b/test/fixtures/bench-runner/load-error-after-declaration.cjs
new file mode 100644
index 000000000000..eca2188d41c5
--- /dev/null
+++ b/test/fixtures/bench-runner/load-error-after-declaration.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('declared before load error', { samples: 1 }, (b) => {
+  b.start();
+  process.hrtime.bigint();
+  b.end(1);
+});
+
+throw new Error('load failed after declaration');
diff --git a/test/fixtures/bench-runner/malformed-plan-order.mjs b/test/fixtures/bench-runner/malformed-plan-order.mjs
new file mode 100644
index 000000000000..80c8cdf4cd8f
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-plan-order.mjs
@@ -0,0 +1,34 @@
+import { bench } from 'node:bench';
+import common from '../../common/index.js';
+
+await new Promise((resolve, reject) => {
+  const timeout = setTimeout(() => {
+    reject(new Error('benchmark summary was not acknowledged'));
+  }, common.platformTimeout(10_000));
+  process.on('message', (message) => {
+    if (message?.type === 'node:bench:ack' && message.id === 0) {
+      clearTimeout(timeout);
+      resolve();
+    }
+  });
+  process.send?.({
+    id: 0,
+    type: 'node:bench:record',
+    record: {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 0, failed: 0, skipped: 0, total: 0 },
+        duration_ns: 1n,
+        entryFile: import.meta.filename,
+        fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+        file: import.meta.filename,
+        runId: process.env.NODE_BENCH_RUN_ID,
+        success: true,
+      },
+    },
+  });
+});
+
+bench('late plan', { samples: 1 }, () => {
+  throw new Error('late plan benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
index 909e11877e72..0e903da1a356 100644
--- a/test/fixtures/bench-runner/malformed-record.cjs
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -4,6 +4,33 @@ const common = require('../../common');
 
 const kind = process.env.NODE_BENCH_MALFORMED_RECORD;
 const id = kind === 'sequence' ? null : 0;
+const benchmarkData = {
+  __proto__: null,
+  benchId: 'invalid plan',
+  column: 1,
+  entryFile: __filename,
+  file: __filename,
+  fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+  line: 1,
+  name: 'invalid plan',
+  namePath: ['invalid plan'],
+  params: {},
+  parentId: null,
+  runId: process.env.NODE_BENCH_RUN_ID,
+  tags: [],
+};
+const plan = {
+  type: 'bench:plan',
+  data: {
+    __proto__: null,
+    ...benchmarkData,
+    samples: 1,
+    selected: true,
+    timeout: null,
+    warmup: 0,
+    yieldBetweenSamples: true,
+  },
+};
 const record = kind === 'summary' ? {
   type: 'bench:summary',
   data: {
@@ -14,6 +41,12 @@ const record = kind === 'summary' ? {
     runId: process.env.NODE_BENCH_RUN_ID,
     success: true,
   },
+} : kind === 'plan' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    samples: 0,
+  },
 } : kind === 'identity' ? {
   type: 'bench:complete',
   data: {
diff --git a/test/fixtures/bench-runner/slow-reporter.cjs b/test/fixtures/bench-runner/slow-reporter.cjs
index b5670d28ea70..7832bd94cd49 100644
--- a/test/fixtures/bench-runner/slow-reporter.cjs
+++ b/test/fixtures/bench-runner/slow-reporter.cjs
@@ -9,6 +9,7 @@ module.exports = async function* slowReporter(source) {
     if (++emitted === source.readableHighWaterMark) resolve();
   };
   for (const type of [
+    'bench:plan',
     'bench:start',
     'bench:sample',
     'bench:complete',
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 07924acadcfc..6913bb803f06 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -91,9 +91,12 @@ for (const { patterns, message } of [
   const result = spawnBench(['--bench-reporter=json', basicPattern]);
   assert.strictEqual(result.status, 0);
   const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
   const completions = records.filter(
     ({ type }) => type === 'bench:complete');
 
+  assert.deepStrictEqual(plans.map(({ name }) => name), ['alpha', 'beta']);
   assert.deepStrictEqual(completions.map(({ data }) => data.name), [
     'alpha',
     'beta',
@@ -129,10 +132,20 @@ for (const isolation of ['process', 'none']) {
   ]);
   assert.strictEqual(result.status, 0);
   const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
   const completions = records.filter(
     ({ type }) => type === 'bench:complete').map(({ data }) => data);
   const summary = records.at(-1).data;
 
+  assert.strictEqual(plans.length, 2);
+  for (const plan of plans) {
+    const planIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:plan' && data.fileRunId === plan.fileRunId);
+    const startIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:start' && data.fileRunId === plan.fileRunId);
+    assert(planIndex < startIndex);
+  }
   assert.strictEqual(completions.length, 2);
   assert.strictEqual(completions[0].benchId, completions[1].benchId);
   assert.strictEqual(completions[0].runId, completions[1].runId);
@@ -249,8 +262,38 @@ for (const isolation of ['process', 'none']) {
   ]);
   assert.strictEqual(result.status, 0);
   const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
   const samples = records.filter(({ type }) => type === 'bench:sample');
   assert.deepStrictEqual(samples.map(({ data }) => data.operations), [4, 5]);
+  assert.deepStrictEqual(plans.map((plan) => ({
+    name: plan.name,
+    samples: plan.samples,
+    selected: plan.selected,
+    skip: plan.skip,
+    timeout: plan.timeout,
+    warmup: plan.warmup,
+    yieldBetweenSamples: plan.yieldBetweenSamples,
+  })), [
+    {
+      name: 'selected',
+      samples: 2,
+      selected: true,
+      skip: undefined,
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+    {
+      name: 'filtered out',
+      samples: 2,
+      selected: false,
+      skip: 'name pattern',
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+  ]);
 
   const completions = records.filter(
     ({ type }) => type === 'bench:complete');
@@ -304,6 +347,28 @@ for (const isolation of ['process', 'none']) {
   assert.strictEqual(records.at(-1).data.success, false);
 }
 
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/load-error-after-declaration.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'declared before load error');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(completion.name, plan.name);
+  assert.strictEqual(completion.error, undefined);
+  assert.strictEqual(completion.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+}
+
 {
   const result = spawnBench([
     '--bench-reporter=json',
@@ -399,6 +464,7 @@ for (const { kind, message } of [
   { kind: 'sequence', message: /valid record sequence/ },
   { kind: 'record', message: /not a valid benchmark record/ },
   { kind: 'identity', message: /not a valid benchmark record/ },
+  { kind: 'plan', message: /not a valid benchmark plan/ },
   { kind: 'summary', message: /not a valid benchmark summary/ },
 ]) {
   const result = spawnBench([
@@ -419,6 +485,20 @@ for (const { kind, message } of [
   assert.strictEqual(records.at(-1).data.success, false);
 }
 
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-plan-order.mjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => /valid lifecycle sequence/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
 for (const { mode, message } of [
   { mode: 'code', message: /failed with exit code 2/ },
   { mode: 'late', message: /failed with exit code 2/ },
diff --git a/test/parallel/test-bench-filtering.js b/test/parallel/test-bench-filtering.js
index 41784c0dafef..39f5368d26a0 100644
--- a/test/parallel/test-bench-filtering.js
+++ b/test/parallel/test-bench-filtering.js
@@ -26,7 +26,18 @@ suite('selected', { only: true }, () => {
 bench('only filtered', { samples: 1 }, common.mustNotCall());
 
 const results = [];
-const stream = run({ namePattern: /^selected (included|explicitly skipped)$/ });
+const plans = [];
+const namePattern = /^selected (included|explicitly skipped)$/;
+let patternMutated = false;
+const stream = run({ namePattern });
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan);
+  if (!patternMutated) {
+    patternMutated = true;
+    namePattern.compile('only filtered');
+  }
+}, 4));
 stream.on('bench:complete', (result) => results.push(result));
 stream.on('end', common.mustCall(() => {
   assert.deepStrictEqual(calls, ['included']);
@@ -37,5 +48,15 @@ stream.on('end', common.mustCall(() => {
   assert.strictEqual(byName.get('explicitly skipped').skip, true);
   assert.strictEqual(byName.get('pattern filtered').skip, 'name pattern');
   assert.strictEqual(byName.get('only filtered').skip, 'only');
+  assert.deepStrictEqual(plans.map(({ name, selected, skip }) => ({
+    name,
+    selected,
+    skip,
+  })), [
+    { name: 'included', selected: true, skip: undefined },
+    { name: 'explicitly skipped', selected: false, skip: true },
+    { name: 'pattern filtered', selected: false, skip: 'name pattern' },
+    { name: 'only filtered', selected: false, skip: 'only' },
+  ]);
 }));
 stream.resume();
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
index 3e4ebefd2ebf..a5e01894c640 100644
--- a/test/parallel/test-bench-harness-errors.js
+++ b/test/parallel/test-bench-harness-errors.js
@@ -22,8 +22,14 @@ async function testSynchronousSuiteFailure() {
   });
   const records = await runner.run().toArray();
   await completion;
+  const plan = records.find(
+    ({ type }) => type === 'bench:plan').data;
   const result = records.find(
     ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'blocked');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:start'), false);
   assert.strictEqual(result.name, 'blocked');
   assert.strictEqual(result.error.message, 'synchronous suite failure');
 }
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
index ed6039d9da3a..44e43bd5be78 100644
--- a/test/parallel/test-bench-reporters.js
+++ b/test/parallel/test-bench-reporters.js
@@ -27,7 +27,9 @@ bench('json failed', { samples: 1 }, () => {
   const lines = chunks.join('').trim().split('\n');
   const records = lines.map((line) => JSON.parse(line));
 
-  assert.strictEqual(records.length, 6);
+  assert.strictEqual(records.length, 8);
+  const plans = records.filter(({ type }) => type === 'bench:plan');
+  assert.deepStrictEqual(plans.map(({ data }) => data.selected), [true, true]);
   const sample = records.find(({ type }) => type === 'bench:sample');
   assert.match(sample.data.duration_ns, /^\d+$/);
 
diff --git a/test/parallel/test-bench-run-options.js b/test/parallel/test-bench-run-options.js
index e9397908a42c..e04bc15ef335 100644
--- a/test/parallel/test-bench-run-options.js
+++ b/test/parallel/test-bench-run-options.js
@@ -6,17 +6,43 @@ const assert = require('assert');
 const { bench, run } = require('node:bench');
 
 let invocations = 0;
-bench('overridden', { samples: 8, warmup: 8 }, (b) => {
+const timeout = common.platformTimeout(1000);
+bench('overridden', { samples: 8, timeout, warmup: 8 }, (b) => {
   invocations++;
   b.start();
   process.hrtime.bigint();
   b.end(invocations);
 });
 
+const plans = [];
 const samples = [];
-const stream = run({ samples: 2, warmup: 3 });
+const types = [];
+const stream = run({
+  samples: 2,
+  warmup: 3,
+  yieldBetweenSamples: false,
+});
+stream.on('bench:plan', (plan) => plans.push(plan));
 stream.on('bench:sample', ({ operations }) => samples.push(operations));
+stream.on('data', ({ type }) => types.push(type));
 stream.on('end', common.mustCall(() => {
+  assert.strictEqual(plans.length, 1);
+  assert.deepStrictEqual({
+    samples: plans[0].samples,
+    selected: plans[0].selected,
+    skip: plans[0].skip,
+    timeout: plans[0].timeout,
+    warmup: plans[0].warmup,
+    yieldBetweenSamples: plans[0].yieldBetweenSamples,
+  }, {
+    samples: 2,
+    selected: true,
+    skip: undefined,
+    timeout,
+    warmup: 3,
+    yieldBetweenSamples: false,
+  });
   assert.deepStrictEqual(samples, [4, 5]);
+  assert.deepStrictEqual(types.slice(0, 2), ['bench:plan', 'bench:start']);
 }));
 stream.resume();
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
index 5b7edb4e6418..0e152342bcaa 100644
--- a/test/parallel/test-bench-run.js
+++ b/test/parallel/test-bench-run.js
@@ -65,7 +65,12 @@ const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
 });
 
 const records = [];
+const plans = [];
 const stream = run();
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan.name);
+}, 3));
 stream.on('data', (record) => records.push(record));
 stream.on('end', common.mustCall(() => {
   assert.strictEqual(active, false);
@@ -80,6 +85,7 @@ stream.on('end', common.mustCall(() => {
   assert.strictEqual(samples.length, 4);
   assert.strictEqual(completions.length, 3);
   assert.strictEqual(summaries.length, 1);
+  assert.deepStrictEqual(plans, ['sync', 'async', 'skipped']);
 
   const sync = completions.find(({ data }) => data.name === 'sync').data;
   assert.strictEqual(sync.error, undefined);
diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
index 89425e4c079c..11a7e0184a54 100644
--- a/test/parallel/test-bench-stream.js
+++ b/test/parallel/test-bench-stream.js
@@ -28,7 +28,7 @@ async function testReadableBackpressure() {
   const iterator = stream[Symbol.asyncIterator]();
   const first = await iterator.next();
 
-  assert.strictEqual(first.value.type, 'bench:start');
+  assert.strictEqual(first.value.type, 'bench:plan');
   await setImmediate();
   assert(calls < sampleCount);
   assert(stream.readableLength <= stream.readableHighWaterMark);
@@ -43,7 +43,42 @@ async function testReadableBackpressure() {
   const result = await completion;
   assert.strictEqual(calls, sampleCount);
   assert.strictEqual(result.samples.length, sampleCount);
-  assert.strictEqual(records.length, sampleCount + 3);
+  assert.strictEqual(records[1].type, 'bench:start');
+  assert.strictEqual(records.length, sampleCount + 4);
+}
+
+async function testPlanBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const benchmarkCount = 32;
+  const completions = [];
+  let calls = 0;
+  for (let i = 0; i < benchmarkCount; i++) {
+    completions.push(runner.bench(`planned ${i}`, { samples: 1 }, (b) => {
+      calls++;
+      recordSample(b);
+    }));
+  }
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert.strictEqual(calls, 0);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  await Promise.all(completions);
+  assert.strictEqual(calls, benchmarkCount);
+  assert.strictEqual(
+    records.slice(0, benchmarkCount).every(({ type }) => type === 'bench:plan'),
+    true,
+  );
 }
 
 async function testNamedEventsWithoutReading() {
@@ -65,7 +100,7 @@ async function testNamedEventsWithoutReading() {
   assert.strictEqual(calls, sampleCount);
   assert.strictEqual(result.samples.length, sampleCount);
   assert.strictEqual(summary.success, true);
-  assert.strictEqual(stream.readableLength, sampleCount + 3);
+  assert.strictEqual(stream.readableLength, sampleCount + 4);
   assert(stream.readableLength > stream.readableHighWaterMark);
   stream.destroy();
 }
@@ -283,6 +318,7 @@ async function testRecordOwnership() {
 
 (async () => {
   await testReadableBackpressure();
+  await testPlanBackpressure();
   await testNamedEventsWithoutReading();
   await testCancellationCompletesBenchmarks();
   await testDeliveryDoesNotConsumeTimeout();

From 0f4bd3ce30bd72902cca1629bcaf43b5a57fb08b Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 22:36:07 +0000
Subject: [PATCH 087/202] doc: clarify isolation modes for node:bench

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md | 16 ++++++++++++++++
 doc/api/cli.md   |  4 ++++
 2 files changed, 20 insertions(+)

diff --git a/doc/api/bench.md b/doc/api/bench.md
index b22f8f5050ce..16833caac541 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -179,6 +179,21 @@ they do not corrupt reporter output.
 has lower startup overhead, but module, heap, and process state carry between
 files, and user writes share stdout and stderr with reporters.
 
+Worker-thread isolation is not a CLI mode. Each newly constructed {Worker} has a
+separate V8 isolate, JavaScript heap, and event loop, typically with lower
+startup cost than a child process. Reusing a worker preserves its module and heap
+state. Workers also share libuv's process-wide thread pool and can share
+process-global native or addon state, so they do not provide the same boundary
+as process isolation.
+
+Higher-level tools can experiment with worker isolation by loading benchmark
+code inside a worker, measuring there, transferring structured sample data, and
+passing it to [`context.record()`][]. The reported `duration_ns` can exclude
+message transport when the worker captures both timestamps. Tools should
+identify worker modules and workloads explicitly. They should not stringify
+arbitrary functions or closures to move them between isolates, because closures
+cannot be reconstructed with their original lexical environment.
+
 Benchmark files passed to `--bench` should declare benchmarks but must not call
 `run()`. The CLI supports `--bench-name-pattern`, `--bench-samples`,
 `--bench-warmup`, `--bench-reporter`, and `--bench-reporter-destination`. See
@@ -710,6 +725,7 @@ A completed benchmark result contains:
     interval for the median rate, with `lower` and `upper` properties.
   * `skewness` {number} The skewness of the scaled rate histogram.
 
+[`context.record()`]: #contextrecordsample
 [`run()`]: #runoptions
 [benchmark result]: #benchmark-result
 [command-line options documentation]: cli.md#--bench
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 32c91c26974d..bb44815f476b 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -512,6 +512,10 @@ benchmark runner process. This reduces startup overhead but allows module,
 heap, and process state to carry between files. User writes to stdout or stderr
 also share destinations with benchmark reporters in this mode.
 
+The supported modes are `'process'` and `'none'`. Worker-thread isolation is not
+a CLI mode. Higher-level tools can implement it using externally measured
+samples as described in the [benchmark runner][] documentation.
+
 ### `--bench-name-pattern=pattern`
 
 <!-- YAML

From 83277117d2210d969fe2baf9059e08f32350fb53 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 22:50:27 +0000
Subject: [PATCH 088/202] doc: clarify node:bench significance policy

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 16833caac541..300ae3aab0ec 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -128,6 +128,24 @@ calculate pooled throughput from the raw `samples`; operation counts should be
 summed as `bigint` values because their total can exceed
 `Number.MAX_SAFE_INTEGER` even though each count cannot.
 
+### Comparing benchmark results
+
+`node:bench` does not designate a benchmark as a baseline or produce a pass/fail
+comparison between runs. It exposes raw samples, stable benchmark identities,
+parameters, and tags so that comparison policy can remain in higher-level
+tools. A tool can use `benchId` to match the same declaration and parameters
+across compatible source layouts, and use a tag or its own metadata to identify
+a baseline.
+
+Comparison tools should retain the raw sample rates and verify that execution
+plans and relevant environment details are comparable. The appropriate analysis
+depends on the experimental design and distribution. For example, independent
+samples might use Welch's t-test or a rank-based test, while observations that
+were deliberately paired require paired analysis. Tools should also consider
+effect sizes, uncertainty, and correction when testing multiple benchmarks.
+The general-purpose {Histogram} statistics in `node:perf_hooks` can support such
+analysis, but the runner does not select a method or significance threshold.
+
 ## Reusable runners
 
 The module-level declaration functions use a shared runner and schedule it

From 12d7bb9262227314d9fcaeb9b2dc0b49b2b606f4 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 28 Aug 2026 23:39:14 +0000
Subject: [PATCH 089/202] lib: add context.diagnostic api to node:bench

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                              |  38 +++-
 lib/internal/bench_runner/benchmark.js        |  29 ++-
 lib/internal/bench_runner/cli.js              |  43 ++++-
 lib/internal/bench_runner/harness.js          | 124 ++++++++++---
 test/fixtures/bench-runner/diagnostic.cjs     |  11 ++
 .../bench-runner/malformed-record.cjs         |   9 +
 test/parallel/test-bench-cli.js               |  23 +++
 test/parallel/test-bench-context-errors.js    |  26 ++-
 test/parallel/test-bench-diagnostics.js       | 175 ++++++++++++++++++
 9 files changed, 446 insertions(+), 32 deletions(-)
 create mode 100644 test/fixtures/bench-runner/diagnostic.cjs
 create mode 100644 test/parallel/test-bench-diagnostics.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 300ae3aab0ec..c36ce3eed296 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -607,6 +607,33 @@ useful when a higher-level tool measures work in a worker and needs to exclude
 message transport from the duration. `record()` is mutually exclusive with
 `start()` and `end()` within one callback and must be called exactly once.
 
+### `context.diagnostic(message[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `message` {string} The diagnostic message.
+* `options` {Object}
+  * `level` {string} Either `'info'` or `'warning'`. **Default:** `'info'`.
+  * `detail` {any} Additional structured-cloneable diagnostic data. With CLI
+    process isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {undefined}
+
+Queues a diagnostic associated with the current benchmark, phase, and sample
+index. Multiple diagnostics preserve call order. They are emitted after the
+sample callback settles and before that sample's `'bench:sample'` event. Warmup
+diagnostics are emitted even though warmup samples are not. Diagnostics queued
+before a callback failure are emitted before the failed `'bench:complete'`
+event and do not themselves cause the benchmark to fail. If a timeout or abort
+wins before the callback settles, queued diagnostics might not be emitted.
+
+The message and options are validated, and detail is cloned, synchronously.
+Calling `diagnostic()` between `context.start()` and `context.end()` therefore
+includes that work in the measured duration. Invalid arguments or an
+uncloneable detail violate the sample contract.
+
 ### `context.done()`
 
 <!-- YAML
@@ -695,10 +722,13 @@ left for reporters and higher-level tools to collect.
 `'bench:complete'` data contains a [benchmark result][]. A failed result has an
 additional `error` property and may contain samples recorded before the error.
 A skipped result has an additional `skip` property and an empty `samples`
-array. `'bench:diagnostic'` reports suite and hook errors. `'bench:summary'`
-contains overall `runId`, `fileRunId`, `entryFile`, `success`, `counts`,
-`duration_ns`, and `file` properties. `fileRunId`, `entryFile`, and `file` are
-{string|null}; they are `null` when the summary aggregates multiple files.
+array. `'bench:diagnostic'` reports loading, suite, and hook errors as well as
+public context diagnostics. A context diagnostic contains the benchmark-scoped
+identity fields, `phase`, `index`, `message`, `level`, source location, and
+optional `detail`. `'bench:summary'` contains overall `runId`, `fileRunId`,
+`entryFile`, `success`, `counts`, `duration_ns`, and `file` properties.
+`fileRunId`, `entryFile`, and `file` are {string|null}; they are `null` when the
+summary aggregates multiple files.
 
 ## Sample result
 
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
index dae60f6e0599..93fe34595708 100644
--- a/lib/internal/bench_runner/benchmark.js
+++ b/lib/internal/bench_runner/benchmark.js
@@ -245,18 +245,20 @@ class BenchContext {
   #endCalled = false;
   #index;
   #invalid = false;
+  #onDiagnostic;
   #phase;
   #recordCalled = false;
   #sample = null;
   #startCalled = false;
   #startTime;
 
-  constructor(bench, signal, phase, index) {
+  constructor(bench, signal, phase, index, onDiagnostic) {
     this.name = bench.name;
     this.params = bench.params;
     this.signal = signal;
     this.#phase = phase;
     this.#index = index;
+    this.#onDiagnostic = onDiagnostic;
   }
 
   get index() {
@@ -267,6 +269,29 @@ class BenchContext {
     return this.#phase;
   }
 
+  diagnostic(message, options = kEmptyObject) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    try {
+      validateString(message, 'message');
+      validateObject(options, 'options');
+      const { detail, level = 'info' } = options;
+      validateString(level, 'options.level');
+      if (level !== 'info' && level !== 'warning') {
+        throw new ERR_INVALID_ARG_VALUE(
+          'options.level', level, "must be 'info' or 'warning'");
+      }
+      const diagnostic = { __proto__: null, level, message };
+      if (detail !== undefined) diagnostic.detail = structuredClone(detail);
+      this.#onDiagnostic(diagnostic);
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+  }
+
   start() {
     if (this.#closed) {
       this.#invalid = true;
@@ -402,7 +427,7 @@ class BenchContext {
     this.#closed = true;
     if (this.#invalid) {
       throw new ERR_INVALID_STATE(
-        'benchmark sample violated the start()/end() contract');
+        'benchmark sample violated the context method contract');
     }
     if (!this.#recordCalled && !this.#startCalled) {
       throw new ERR_INVALID_STATE(
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index c0e07d4a72f4..38611e49a991 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -327,6 +327,14 @@ function isStringArray(value) {
   return true;
 }
 
+function isContextDiagnostic(record) {
+  return record.type === 'bench:diagnostic' &&
+    (record.data.benchId !== undefined ||
+     record.data.phase !== undefined ||
+     record.data.index !== undefined ||
+     record.data.detail !== undefined);
+}
+
 function validateRecord(record) {
   if (record === null || typeof record !== 'object' ||
       !kEventTypes.has(record.type) || record.data === null ||
@@ -339,8 +347,10 @@ function validateRecord(record) {
     throw new ERR_INVALID_ARG_VALUE(
       'benchmark child message', record, 'is not a valid benchmark record');
   }
+  const contextDiagnostic = isContextDiagnostic(record);
   if ((record.type === 'bench:plan' || record.type === 'bench:start' ||
-       record.type === 'bench:sample' || record.type === 'bench:complete') &&
+       record.type === 'bench:sample' || record.type === 'bench:complete' ||
+       contextDiagnostic) &&
       (typeof record.data.fileRunId !== 'string' ||
        typeof record.data.benchId !== 'string' ||
        (record.data.parentId !== null &&
@@ -385,6 +395,21 @@ function validateRecord(record) {
         'is not a valid benchmark plan');
     }
   }
+  if (contextDiagnostic &&
+      ((record.data.phase !== 'warmup' &&
+        record.data.phase !== 'measurement') ||
+       !NumberIsSafeInteger(record.data.index) || record.data.index < 0 ||
+       record.data.index > 0xFFFFFFFF ||
+       typeof record.data.message !== 'string' ||
+       (record.data.level !== 'info' && record.data.level !== 'warning') ||
+       typeof record.data.file !== 'string' ||
+       !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+       !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+       record.data.error !== undefined)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child diagnostic', record.data,
+      'is not a valid benchmark diagnostic');
+  }
   if (record.type === 'bench:summary') {
     const { counts, duration_ns, success } = record.data;
     if (typeof success !== 'boolean' || typeof duration_ns !== 'bigint' ||
@@ -602,6 +627,7 @@ async function runChild(path, options, scope, onRecord) {
     stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
   });
   let protocolError;
+  let activeBenchId;
   let plansComplete = false;
   let recordPending = false;
   let summaryReceived = false;
@@ -662,7 +688,14 @@ async function runChild(path, options, scope, onRecord) {
       }
       recordPending = true;
       const record = deserializeRecord(validateRecord(message.record));
-      if (summaryReceived || (record.type === 'bench:plan' && plansComplete)) {
+      const contextDiagnostic = isContextDiagnostic(record);
+      if (summaryReceived || (record.type === 'bench:plan' && plansComplete) ||
+          (record.type === 'bench:start' && activeBenchId !== undefined) ||
+          ((record.type === 'bench:sample' || contextDiagnostic) &&
+           activeBenchId !== record.data.benchId) ||
+          (record.type === 'bench:complete' && activeBenchId !== undefined &&
+           activeBenchId !== record.data.benchId) ||
+          (record.type === 'bench:summary' && activeBenchId !== undefined)) {
         throw new ERR_INVALID_ARG_VALUE(
           'benchmark child message', message,
           'does not have a valid lifecycle sequence');
@@ -671,6 +704,12 @@ async function runChild(path, options, scope, onRecord) {
           record.type !== 'bench:diagnostic') {
         plansComplete = true;
       }
+      if (record.type === 'bench:start') {
+        activeBenchId = record.data.benchId;
+      } else if (record.type === 'bench:complete' &&
+                 activeBenchId === record.data.benchId) {
+        activeBenchId = undefined;
+      }
       if (record.type === 'bench:summary') summaryReceived = true;
       record.data.runId = options.runId;
       record.data.fileRunId = scope.fileRunId;
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index 0247500059be..f3e28bc01b1a 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -538,6 +538,29 @@ class Harness {
     }));
   }
 
+  async #emitSampleDiagnostics(benchmark, phase, index, diagnostics) {
+    for (let i = 0; i < diagnostics.length; i++) {
+      const diagnostic = diagnostics[i];
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        phase,
+        index,
+        message: diagnostic.message,
+        level: diagnostic.level,
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+      };
+      if (diagnostic.detail !== undefined) data.detail = diagnostic.detail;
+      await this.#waitForStream(this.stream.diagnostic(data));
+    }
+  }
+
   async #completeSubtree(node, error) {
     for (let i = 0; i < node.children.length; i++) {
       const child = node.children[i];
@@ -636,6 +659,7 @@ class Harness {
 
     const stop = PromiseWithResolvers();
     const listeners = [];
+    let pausedWork;
     let timer;
     for (let i = 0; i < signals.length; i++) {
       const signal = signals[i];
@@ -656,23 +680,33 @@ class Harness {
     };
     if (deadline !== null) armTimer();
 
-    const pause = async (work) => {
-      if (deadline === null) return work();
-      clearTimeout(timer);
-      timer = undefined;
-      const start = hrtime();
-      try {
-        return await work();
-      } finally {
-        deadline.value += hrtime() - start;
-        if (!controller.signal.aborted) armTimer();
-      }
+    const pause = (work) => {
+      pausedWork = (async () => {
+        if (deadline === null) return work();
+        clearTimeout(timer);
+        timer = undefined;
+        const start = hrtime();
+        try {
+          return await work();
+        } finally {
+          deadline.value += hrtime() - start;
+          if (!controller.signal.aborted) armTimer();
+        }
+      })();
+      return pausedWork;
     };
 
     const work = callback(pause);
     try {
       if (signals.length === 0 && timer === undefined) return await work;
       return await SafePromiseRace([work, stop.promise]);
+    } catch (error) {
+      try {
+        await pausedWork;
+      } catch {
+        // Preserve the error that stopped benchmark execution.
+      }
+      throw error;
     } finally {
       if (timer !== undefined) clearTimeout(timer);
       for (let i = 0; i < listeners.length; i++) {
@@ -682,15 +716,29 @@ class Harness {
   }
 
   async #runSample(benchmark, signal, phase, index) {
+    const diagnostics = [];
     const context = new BenchContext(
-      benchmark, signal, phase, index);
+      benchmark, signal, phase, index,
+      (diagnostic) => ArrayPrototypePush(diagnostics, diagnostic));
     try {
       await this.#invoke(
         benchmark, benchmark, benchmark.fn, [context]);
-      return context.finish();
+      const { done, sample } = context.finish();
+      return {
+        __proto__: null,
+        diagnostics,
+        done,
+        failed: false,
+        sample,
+      };
     } catch (error) {
       context.close();
-      throw error;
+      return {
+        __proto__: null,
+        diagnostics,
+        error,
+        failed: true,
+      };
     }
   }
 
@@ -794,6 +842,12 @@ class Harness {
       signal: controller.signal,
     };
     let error;
+    let failed = false;
+    const runAfterEach = async () => {
+      await this.#runBenchHooks(
+        benchmark, 'afterEach', hookContext);
+      checkDeadline();
+    };
 
     try {
       await this.#runWithStop(benchmark, controller, async (pause) => {
@@ -809,14 +863,36 @@ class Harness {
             }
             const phase = i < warmup ? 'warmup' : 'measurement';
             const index = phase === 'warmup' ? i : i - warmup;
-            const { done, sample } = await this.#runSample(
+            const outcome = await this.#runSample(
               benchmark, controller.signal, phase, index);
-            checkDeadline();
+            if (!outcome.failed) {
+              checkDeadline();
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+              if (i >= warmup) {
+                ArrayPrototypePush(samples, outcome.sample);
+              }
+            }
+
+            let diagnosticError;
+            let diagnosticFailed = false;
+            if (outcome.diagnostics.length > 0 &&
+                !controller.signal.aborted) {
+              try {
+                await pause(() => this.#emitSampleDiagnostics(
+                  benchmark, phase, index, outcome.diagnostics));
+              } catch (cause) {
+                diagnosticFailed = true;
+                diagnosticError = cause;
+              }
+            }
+            if (outcome.failed) throw outcome.error;
+            if (diagnosticFailed) throw diagnosticError;
             if (controller.signal.aborted) {
               throw controller.signal.reason;
             }
             if (i >= warmup) {
-              ArrayPrototypePush(samples, sample);
               await pause(() => this.#waitForStream(this.stream.sample({
                 __proto__: null,
                 ...this.#getRecordScope(benchmark),
@@ -825,27 +901,29 @@ class Harness {
                 name: benchmark.name,
                 namePath: ArrayPrototypeSlice(benchmark.namePath),
                 index: i - warmup,
-                ...sample,
+                ...outcome.sample,
               })));
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
             }
-            if (done) break;
+            if (outcome.done) break;
             if (i + 1 < total && this.#yieldBetweenSamples) {
               await eventLoopTurn();
             }
           }
         } finally {
-          await this.#runBenchHooks(
-            benchmark, 'afterEach', hookContext);
-          checkDeadline();
+          await runAfterEach();
         }
       }, deadline);
     } catch (cause) {
+      failed = true;
       error = cause;
     } finally {
       controller.abort();
     }
 
-    if (error !== undefined) {
+    if (failed) {
       this.success = false;
       this.counts.failed++;
       await this.#recordResult(benchmark, this.#createResult(
diff --git a/test/fixtures/bench-runner/diagnostic.cjs b/test/fixtures/bench-runner/diagnostic.cjs
new file mode 100644
index 000000000000..018b8a31de42
--- /dev/null
+++ b/test/fixtures/bench-runner/diagnostic.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('diagnostic relay', { samples: 1 }, (b) => {
+  b.diagnostic('relayed warning', {
+    detail: { value: 42n },
+    level: 'warning',
+  });
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
index 0e903da1a356..61de7d9b567a 100644
--- a/test/fixtures/bench-runner/malformed-record.cjs
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -54,6 +54,15 @@ const record = kind === 'summary' ? {
     fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
     runId: process.env.NODE_BENCH_RUN_ID,
   },
+} : kind === 'diagnostic' || kind === 'diagnostic-order' ? {
+  type: 'bench:diagnostic',
+  data: {
+    ...benchmarkData,
+    index: 0,
+    level: kind === 'diagnostic' ? 'error' : 'warning',
+    message: 'invalid diagnostic',
+    phase: 'measurement',
+  },
 } : null;
 
 process.send?.({ id, type: 'node:bench:record', record });
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 6913bb803f06..bd67b4b45bdb 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -388,6 +388,27 @@ for (const isolation of ['process', 'none']) {
   assert(Math.abs(rate - 500_000_000) < 1);
 }
 
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/diagnostic.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(diagnostic.message, 'relayed warning');
+  assert.strictEqual(diagnostic.level, 'warning');
+  assert.strictEqual(diagnostic.phase, 'measurement');
+  assert.strictEqual(diagnostic.index, 0);
+  assert.deepStrictEqual(diagnostic.detail, { value: '42' });
+  assert.strictEqual(diagnostic.benchId, completion.benchId);
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+  assert.strictEqual(completion.error, undefined);
+}
+
 for (const { file, status } of [
   { file: 'a.cjs', status: 0 },
   { file: 'error.cjs', status: 1 },
@@ -465,6 +486,8 @@ for (const { kind, message } of [
   { kind: 'record', message: /not a valid benchmark record/ },
   { kind: 'identity', message: /not a valid benchmark record/ },
   { kind: 'plan', message: /not a valid benchmark plan/ },
+  { kind: 'diagnostic', message: /not a valid benchmark diagnostic/ },
+  { kind: 'diagnostic-order', message: /valid lifecycle sequence/ },
   { kind: 'summary', message: /not a valid benchmark summary/ },
 ]) {
   const result = spawnBench([
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
index 072b9b3e2a9d..ad2be4aa1274 100644
--- a/test/parallel/test-bench-context-errors.js
+++ b/test/parallel/test-bench-context-errors.js
@@ -59,12 +59,28 @@ runner.bench('reentrant record', { samples: 1 }, (b) => {
 runner.bench('uncloneable detail', { samples: 1 }, (b) => {
   b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
 });
+runner.bench('invalid diagnostic message', { samples: 1 }, (b) => {
+  b.diagnostic(1);
+});
+runner.bench('invalid diagnostic level', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { level: 'error' });
+});
+runner.bench('uncloneable diagnostic detail', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { detail: () => {} });
+});
 runner.bench('caught contract violation', { samples: 1 },
              common.mustCall((b) => {
                b.start();
                assert.throws(() => b.start(), { code: 'ERR_INVALID_STATE' });
                b.end(1);
              }));
+runner.bench('caught diagnostic violation', { samples: 1 },
+             common.mustCall((b) => {
+               assert.throws(() => b.diagnostic('invalid', {
+                 level: 'error',
+               }), { code: 'ERR_INVALID_ARG_VALUE' });
+               b.record({ duration_ns: 1n, operations: 1 });
+             }));
 
 (async () => {
   const records = await runner.run().toArray();
@@ -97,6 +113,14 @@ runner.bench('caught contract violation', { samples: 1 },
                      'ERR_INVALID_STATE');
   assert.strictEqual(byName.get('uncloneable detail').error.name,
                      'DataCloneError');
+  assert.strictEqual(byName.get('invalid diagnostic message').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid diagnostic level').error.code,
+                     'ERR_INVALID_ARG_VALUE');
+  assert.strictEqual(byName.get('uncloneable diagnostic detail').error.name,
+                     'DataCloneError');
   assert.match(byName.get('caught contract violation').error.message,
-               /violated the start\(\)\/end\(\) contract/);
+               /violated the context method contract/);
+  assert.match(byName.get('caught diagnostic violation').error.message,
+               /violated the context method contract/);
 })().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostics.js b/test/parallel/test-bench-diagnostics.js
new file mode 100644
index 000000000000..9f8facbcb16f
--- /dev/null
+++ b/test/parallel/test-bench-diagnostics.js
@@ -0,0 +1,175 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    duration_ns: 1n,
+    operations: 1,
+  });
+}
+
+async function testListenerFailure(callbackError) {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const listenerError = new Error('diagnostic listener failed');
+  const completion = runner.bench('listener failure', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('listener failure');
+    if (callbackError !== undefined) throw callbackError;
+    recordSample(b);
+  }));
+  const stream = runner.run();
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw listenerError;
+  }));
+  await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error, callbackError ?? listenerError);
+  assert.strictEqual(result.samples.length, callbackError === undefined ? 1 : 0);
+}
+
+async function testAbortDuringDiagnosticDelivery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const abortReason = new Error('stop diagnostic delivery');
+  const controller = new AbortController();
+  const completion = runner.bench('abort diagnostics', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    for (let i = 0; i < 32; i++) b.diagnostic(`diagnostic ${i}`);
+    recordSample(b);
+  }));
+  const stream = runner.run({ signal: controller.signal });
+  const iterator = stream[Symbol.asyncIterator]();
+  const records = [];
+  records.push((await iterator.next()).value);
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+  controller.abort(abortReason);
+  while (true) {
+    const { done, value } = await iterator.next();
+    if (done) break;
+    records.push(value);
+  }
+
+  const result = await completion;
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const completeIndex = records.findIndex(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(records.indexOf(diagnostics.at(-1)) < completeIndex);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, abortReason);
+  assert.strictEqual(result.samples.length, 1);
+}
+
+async function testAfterEachFailurePrecedence() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const callbackError = new Error('callback failed');
+  const afterEachError = new Error('afterEach failed');
+  runner.afterEach(common.mustCall(() => {
+    throw afterEachError;
+  }));
+  const completion = runner.bench('afterEach precedence', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failures');
+    throw callbackError;
+  }));
+  await runner.run().toArray();
+  assert.strictEqual((await completion).error, afterEachError);
+}
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let finalContext;
+  const completed = runner.bench('diagnostics', {
+    samples: 2,
+    warmup: 1,
+  }, common.mustCall((b) => {
+    finalContext = b;
+    const detail = { index: b.index };
+    const level = b.phase === 'warmup' ? 'info' : 'warning';
+    assert.strictEqual(b.diagnostic(`${b.phase} ${b.index}`, {
+      detail,
+      level,
+    }), undefined);
+    detail.index = -1;
+    recordSample(b);
+  }, 3));
+  const expectedError = new Error('benchmark failed');
+  const failed = runner.bench('failed diagnostic', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failure', {
+      detail: { retained: true },
+      level: 'warning',
+    });
+    throw expectedError;
+  }));
+
+  const namedDiagnostics = [];
+  const stream = runner.run();
+  stream.on('bench:diagnostic', (diagnostic) => {
+    namedDiagnostics.push(diagnostic);
+  });
+  const records = await stream.toArray();
+  const completedResult = await completed;
+  const failedResult = await failed;
+  const diagnosticRecords = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const diagnostics = diagnosticRecords.map(({ data }) => data);
+
+  assert.strictEqual(completedResult.error, undefined);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(diagnostics.length, 4);
+  assert.strictEqual(namedDiagnostics.length, diagnostics.length);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    'warmup 0',
+    'measurement 0',
+    'measurement 1',
+    'before failure',
+  ]);
+  assert.deepStrictEqual(diagnostics.map(({ phase, index, level }) => ({
+    phase,
+    index,
+    level,
+  })), [
+    { phase: 'warmup', index: 0, level: 'info' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+    { phase: 'measurement', index: 1, level: 'warning' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+  ]);
+  assert.deepStrictEqual(
+    diagnostics.map(({ detail }) => detail),
+    [{ index: 0 }, { index: 0 }, { index: 1 }, { retained: true }]);
+  assert(diagnostics.slice(0, 3).every(
+    ({ benchId }) => benchId === completedResult.benchId));
+  assert.strictEqual(diagnostics[3].benchId, failedResult.benchId);
+  assert.notStrictEqual(namedDiagnostics[0], diagnostics[0]);
+
+  for (let i = 0; i < 2; i++) {
+    const diagnosticIndex = records.indexOf(diagnosticRecords[i + 1]);
+    const sampleIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:sample' && data.benchId === completedResult.benchId &&
+      data.index === i);
+    assert(diagnosticIndex < sampleIndex);
+  }
+  assert.throws(() => finalContext.diagnostic('too late'), {
+    code: 'ERR_INVALID_STATE',
+  });
+  await testListenerFailure(undefined);
+  await testListenerFailure(new Error('callback failed'));
+  await testAbortDuringDiagnosticDelivery();
+  await testAfterEachFailurePrecedence();
+})().then(common.mustCall());

From b6ade12c7d5498fe2eaa0c55bc5cae81bedca0dd Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 01:38:29 +0000
Subject: [PATCH 090/202] lib: add runFile api to node:bench

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                              |  48 +-
 lib/bench.js                                  |   2 +
 lib/internal/bench_runner/cli.js              | 584 +++++++++++++++---
 lib/internal/bench_runner/runner.js           |   5 +
 .../bench-runner/run-file-blocked.cjs         |   7 +
 .../bench-runner/run-file-lingering.cjs       |  11 +
 .../bench-runner/run-file-partial.cjs         |  11 +
 test/fixtures/bench-runner/run-file.cjs       |  21 +
 test/parallel/test-bench-cli.js               |   2 +
 test/parallel/test-bench-run-file.js          | 318 ++++++++++
 10 files changed, 920 insertions(+), 89 deletions(-)
 create mode 100644 test/fixtures/bench-runner/run-file-blocked.cjs
 create mode 100644 test/fixtures/bench-runner/run-file-lingering.cjs
 create mode 100644 test/fixtures/bench-runner/run-file-partial.cjs
 create mode 100644 test/fixtures/bench-runner/run-file.cjs
 create mode 100644 test/parallel/test-bench-run-file.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index c36ce3eed296..2eb6eb6a3822 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -11,7 +11,8 @@ added: REPLACEME
 <!-- source_link=lib/bench.js -->
 
 The `node:bench` module supports defining and running JavaScript benchmarks in
-the current process. To access it:
+the current process, and running one benchmark file in a fresh child process.
+To access it:
 
 ```mjs
 import { bench, suite } from 'node:bench';
@@ -497,6 +498,51 @@ for await (const { type, data } of run()) {
 }
 ```
 
+## `runFile(path[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `path` {string} The absolute path of one benchmark module.
+* `options` {Object}
+  * `env` {Object} The child process environment. Property values must be
+    strings or `undefined`. This replaces, rather than extends, the parent
+    environment. **Default:** A snapshot of `process.env`.
+  * `execArgv` {string\[]} Node.js command-line options for the child process.
+    This replaces, rather than extends, inherited options. Benchmark runner
+    options, positional arguments, and options that select another execution
+    mode are not allowed. **Default:** Compatible options inherited from the
+    current process.
+  * `signal` {AbortSignal} Terminates the child process when aborted.
+* Returns: {BenchmarksStream}
+
+Runs exactly one benchmark module in a fresh child process and returns its
+object-mode event stream. `path` is not interpreted as a glob. Unless the signal
+is aborted or the stream is destroyed before startup, every call uses a new
+child. Input discovery, ordering, concurrency, retries, and multi-file
+scheduling remain the caller's responsibility.
+
+Records use advanced child process serialization, preserving supported
+structured values such as `bigint` and errors. Child writes to stdout and stderr
+become `'bench:diagnostic'` records. A module loading error, abnormal child exit,
+or cancellation also emits an error diagnostic and produces a terminal
+`'bench:summary'` whose `success` property is `false`; these execution failures
+do not error the stream. If module evaluation fails after declaring benchmarks,
+those declarations still run before the unsuccessful summary.
+
+`env`, effective inherited options, and an explicitly provided `execArgv` are
+copied when `runFile()` is called. The runner removes `NODE_OPTIONS`, replaces
+IPC-related environment variables, and sets its private child-context, run
+identity, and file identity variables, overriding properties with those names
+in `env`. Pass child Node.js options through `execArgv`, not `NODE_OPTIONS`.
+Standard `child_process` environment propagation still applies, including
+`NODE_V8_COVERAGE`, permission-model options, and required z/OS variables.
+Aborting `signal` before the child starts produces an `AbortError` diagnostic
+without spawning it. Aborting during execution sends `SIGTERM` to the child and
+escalates to `SIGKILL` if it does not exit. Destroying the returned stream
+follows the same termination procedure.
+
 ## Class: `BenchContext`
 
 An instance of `BenchContext` is passed to every benchmark invocation. A new
diff --git a/lib/bench.js b/lib/bench.js
index 9d1bd24fcebd..96e199773d90 100644
--- a/lib/bench.js
+++ b/lib/bench.js
@@ -16,6 +16,7 @@ const {
 const {
   createRunner,
   run,
+  runFile,
 } = require('internal/bench_runner/runner');
 
 if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
@@ -33,5 +34,6 @@ ObjectAssign(module.exports, {
   createRunner,
   describe: suite,
   run,
+  runFile,
   suite,
 });
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index 38611e49a991..4b14493e391d 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -8,13 +8,17 @@ const {
   ArrayPrototypeJoin,
   ArrayPrototypePush,
   ArrayPrototypePushApply,
+  ArrayPrototypeSlice,
   ArrayPrototypeSome,
   ArrayPrototypeSort,
+  MathMax,
   NumberIsFinite,
   NumberIsSafeInteger,
   ObjectGetOwnPropertyDescriptor,
   ObjectGetPrototypeOf,
+  ObjectKeys,
   ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
   ObjectValues,
   Promise,
   PromisePrototypeThen,
@@ -27,8 +31,11 @@ const {
   SafeSet,
   String,
   StringPrototypeIndexOf,
+  StringPrototypeReplaceAll,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
+  StringPrototypeToUpperCase,
+  SymbolDispose,
 } = primordials;
 const { spawn } = require('child_process');
 const { createWriteStream, statSync } = require('fs');
@@ -44,19 +51,32 @@ const {
 } = require('internal/bench_runner/harness');
 const { deserializeError, serializeError } = require('internal/error_serdes');
 const {
+  AbortError,
   codes: {
+    ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
     ERR_INVALID_STATE,
   },
 } = require('internal/errors');
-const { getOptionValue, getOptionsAsFlagsFromBinding } = require('internal/options');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  getCLIOptionsInfo,
+  getOptionValue,
+  getOptionsAsFlagsFromBinding,
+} = require('internal/options');
 const { TIMEOUT_MAX } = require('internal/timers');
 const { kEmptyObject } = require('internal/util');
-const { validateUint32 } = require('internal/validators');
+const {
+  validateAbortSignal,
+  validateArray,
+  validateObject,
+  validateStringWithoutNullBytes,
+  validateUint32,
+} = require('internal/validators');
 const { pathToFileURL } = require('internal/url');
 const { pipeline } = require('stream/promises');
-const { once } = require('events');
-const { resolve, sep } = require('path');
+const { isAbsolute, resolve, sep } = require('path');
+const { clearTimeout, setTimeout } = require('timers');
 
 const console = require('internal/console/global');
 const esmLoader = require('internal/modules/esm/loader');
@@ -90,6 +110,51 @@ const kFilterArgValues = [
   '--bench-warmup',
   '--experimental-config-file',
 ];
+const kIncompatibleExecArgv = new SafeSet([
+  '--build-sea',
+  '--build-snapshot',
+  '--build-snapshot-config',
+  '--check',
+  '--completion-bash',
+  '--eval',
+  '--experimental-sea-config',
+  '--help',
+  '--help-all',
+  '--input-type',
+  '--interactive',
+  '--print',
+  '--prof-process',
+  '--run',
+  '--test',
+  '--version',
+  '--v8-options',
+  '--watch',
+  '--watch-path',
+  '-c',
+  '-e',
+  '-h',
+  '-i',
+  '-p',
+  '-v',
+]);
+const kExecArgvWithValue = new SafeSet([
+  '--eval',
+  '--input-type',
+  '--print',
+  '--run',
+  '--watch-path',
+  '-e',
+  '-p',
+]);
+const kIPCEnvironmentVariables = new SafeSet([
+  'NODE_CHANNEL_FD',
+  'NODE_CHANNEL_SERIALIZATION_MODE',
+  'NODE_BENCH_CONTEXT',
+  'NODE_BENCH_FILE_RUN_ID',
+  'NODE_BENCH_RUN_ID',
+  'NODE_OPTIONS',
+]);
+const kForceKillDelay = 1_000;
 
 function createBenchmarkFileList(patterns, cwd) {
   if (patterns.length === 0) {
@@ -533,6 +598,26 @@ async function loadBenchmarkFiles(files, options, modules, onRecord) {
   }, true);
   let summary;
   for await (const record of stream) {
+    if (record.type === 'bench:summary' && (process.exitCode ?? 0) !== 0) {
+      const scope = files.length === 1 ? options.fileScopes[0] : {
+        __proto__: null,
+        entryFile: null,
+        fileRunId: null,
+      };
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: `Benchmark process set exit code ${process.exitCode}`,
+          level: 'error',
+          file: files.length === 1 ?
+            resolve(options.cwd, files[0]) : null,
+        },
+      });
+    }
     if (record.type === 'bench:summary' &&
         (loadFailed || (process.exitCode ?? 0) !== 0)) {
       record.data.success = false;
@@ -552,18 +637,62 @@ async function loadBenchmarkFiles(files, options, modules, onRecord) {
 }
 
 function filterExecArgv(arg, index, args) {
-  return !ArrayPrototypeIncludes(kFilterArgs, arg) &&
+  const name = getOptionName(arg);
+  return !ArrayPrototypeIncludes(kFilterArgs, name) &&
     !ArrayPrototypeSome(kFilterArgValues, (option) => {
-      return arg === option ||
-        StringPrototypeStartsWith(arg, `${option}=`) ||
+      return name === option ||
         (option !== '--experimental-config-file' &&
-         index > 0 && args[index - 1] === option);
+         index > 0 && getOptionName(args[index - 1]) === option);
     });
 }
 
 function getOptionName(arg) {
   const equals = StringPrototypeIndexOf(arg, '=');
-  return equals === -1 ? arg : StringPrototypeSlice(arg, 0, equals);
+  const name = equals === -1 ? arg : StringPrototypeSlice(arg, 0, equals);
+  return StringPrototypeReplaceAll(name, '_', '-');
+}
+
+function getRunFileOptionName(arg) {
+  if (StringPrototypeStartsWith(arg, '-') &&
+      !StringPrototypeStartsWith(arg, '--') && arg.length > 2) {
+    const shortName = StringPrototypeSlice(arg, 0, 2);
+    if (kIncompatibleExecArgv.has(shortName)) return shortName;
+  }
+  return getOptionName(arg);
+}
+
+function filterRunFileExecArgv(arg, index, args) {
+  if (!filterExecArgv(arg, index, args)) return false;
+  if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+    return false;
+  }
+  const name = getRunFileOptionName(arg);
+  if (kIncompatibleExecArgv.has(name)) return false;
+  if (index > 0) {
+    const previous = getRunFileOptionName(args[index - 1]);
+    if (kExecArgvWithValue.has(previous) &&
+        StringPrototypeIndexOf(args[index - 1], '=') === -1) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function runFileOptionRequiresValue(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  let name = getRunFileOptionName(arg);
+  const { aliases, options } = getCLIOptionsInfo();
+  let info = options.get(name);
+  if (info === undefined) {
+    const alias = aliases.get(name);
+    if (alias !== undefined) info = options.get(alias[0]);
+  }
+  if (info === undefined && StringPrototypeStartsWith(name, '--no-')) {
+    name = `--${StringPrototypeSlice(name, 5)}`;
+    info = options.get(name);
+  }
+  return info !== undefined && info.type >= 3 &&
+    (equals === -1 || equals === arg.length - 1);
 }
 
 const kOptionAliases = new SafeMap([
@@ -572,7 +701,7 @@ const kOptionAliases = new SafeMap([
   ['-r', '--require'],
 ]);
 
-function getChildArgs(path, options) {
+function getInheritedChildArgs() {
   const nodeOptions = getOptionsAsFlagsFromBinding();
   const args = ArrayPrototypeFilter(nodeOptions, filterExecArgv);
   const nodeOptionNames = new SafeSet();
@@ -597,6 +726,12 @@ function getChildArgs(path, options) {
   ArrayPrototypePushApply(args, unknownExecArgv);
   // Option serialization omits port 0, which would otherwise become 9229.
   if (process.debugPort === 0) ArrayPrototypePush(args, '--inspect-port=0');
+  return args;
+}
+
+function getChildArgs(path, options) {
+  const args = options.execArgv === undefined ?
+    getInheritedChildArgs() : ArrayPrototypeSlice(options.execArgv);
   ArrayPrototypePush(args, '--bench', '--bench-isolation=none');
   if (options.namePatternSource.length > 0) {
     ArrayPrototypePush(
@@ -613,24 +748,100 @@ function getChildArgs(path, options) {
 }
 
 async function runChild(path, options, scope, onRecord) {
-  const child = spawn(process.execPath, getChildArgs(path, options), {
-    __proto__: null,
-    cwd: options.cwd,
-    env: {
+  if (options.signal?.aborted) {
+    return {
+      __proto__: null,
+      aborted: true,
+      error: new AbortError(undefined, {
+        __proto__: null,
+        cause: options.signal.reason,
+      }),
+    };
+  }
+  const child = spawn(
+    options.execPath ?? process.execPath,
+    getChildArgs(path, options),
+    {
       __proto__: null,
-      ...process.env,
-      NODE_BENCH_CONTEXT: 'child',
-      NODE_BENCH_FILE_RUN_ID: scope.fileRunId,
-      NODE_BENCH_RUN_ID: options.runId,
+      cwd: options.cwd,
+      env: {
+        __proto__: null,
+        ...(options.env ?? process.env),
+        NODE_BENCH_CONTEXT: 'child',
+        NODE_BENCH_FILE_RUN_ID: scope.fileRunId,
+        NODE_BENCH_RUN_ID: options.runId,
+      },
+      serialization: 'advanced',
+      stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
     },
-    serialization: 'advanced',
-    stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
-  });
+  );
+  let childClosed = false;
+  let forceKillTimer;
+  const terminateChild = () => {
+    if (childClosed) return;
+    child.kill();
+    forceKillTimer ??= setTimeout(() => {
+      child.kill('SIGKILL');
+    }, kForceKillDelay);
+  };
+  const closed = PromiseWithResolvers();
+  let closeTracked = false;
+  let spawnError;
+  try {
+    child.once('close', (...status) => closed.resolve(status));
+    closeTracked = true;
+    child.once('error', (error) => {
+      spawnError ??= error;
+      terminateChild();
+    });
+  } catch (error) {
+    terminateChild();
+    if (closeTracked) {
+      try {
+        await closed.promise;
+      } catch {
+        // Preserve the setup error.
+      }
+    }
+    throw error;
+  }
   let protocolError;
+  let abortError;
+  let aborted = false;
   let activeBenchId;
   let plansComplete = false;
   let recordPending = false;
   let summaryReceived = false;
+  let abortListener;
+  const closeListener = () => {
+    terminateChild();
+  };
+  try {
+    if (options.signal !== undefined) {
+      abortListener = addAbortListener(options.signal, () => {
+        aborted = true;
+        abortError = new AbortError(undefined, {
+          __proto__: null,
+          cause: options.signal.reason,
+        });
+        terminateChild();
+      });
+    }
+    options.output?.once('close', closeListener);
+    if (options.output?.destroyed) closeListener();
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
   const pendingRecords = new SafeSet();
   const handleRecord = (record) => {
     if (protocolError !== undefined) return;
@@ -638,7 +849,7 @@ async function runChild(path, options, scope, onRecord) {
       return onRecord(record);
     } catch (error) {
       protocolError = error;
-      child.kill();
+      terminateChild();
     }
   };
   const trackPending = (pending, source) => {
@@ -649,8 +860,8 @@ async function runChild(path, options, scope, onRecord) {
       source?.resume();
     }, (error) => {
       pendingRecords.delete(tracked);
-      protocolError ??= error;
-      child.kill();
+      if (!aborted) protocolError ??= error;
+      terminateChild();
     });
     pendingRecords.add(tracked);
   };
@@ -670,69 +881,99 @@ async function runChild(path, options, scope, onRecord) {
     });
     trackPending(pending, source);
   };
-  child.stdout.setEncoding('utf8');
-  child.stderr.setEncoding('utf8');
-  child.stdout.on('data', (data) => {
-    reportOutput(child.stdout, 'stdout', data);
-  });
-  child.stderr.on('data', (data) => {
-    reportOutput(child.stderr, 'stderr', data);
-  });
-  child.on('message', (message) => {
-    if (message?.type !== kChildMessageType) return;
-    try {
-      if (!NumberIsSafeInteger(message.id) || message.id < 0 || recordPending) {
-        throw new ERR_INVALID_ARG_VALUE(
-          'benchmark child message', message,
-          'does not have a valid record sequence');
-      }
-      recordPending = true;
-      const record = deserializeRecord(validateRecord(message.record));
-      const contextDiagnostic = isContextDiagnostic(record);
-      if (summaryReceived || (record.type === 'bench:plan' && plansComplete) ||
-          (record.type === 'bench:start' && activeBenchId !== undefined) ||
-          ((record.type === 'bench:sample' || contextDiagnostic) &&
-           activeBenchId !== record.data.benchId) ||
-          (record.type === 'bench:complete' && activeBenchId !== undefined &&
-           activeBenchId !== record.data.benchId) ||
-          (record.type === 'bench:summary' && activeBenchId !== undefined)) {
-        throw new ERR_INVALID_ARG_VALUE(
-          'benchmark child message', message,
-          'does not have a valid lifecycle sequence');
-      }
-      if (record.type !== 'bench:plan' &&
-          record.type !== 'bench:diagnostic') {
-        plansComplete = true;
-      }
-      if (record.type === 'bench:start') {
-        activeBenchId = record.data.benchId;
-      } else if (record.type === 'bench:complete' &&
-                 activeBenchId === record.data.benchId) {
-        activeBenchId = undefined;
-      }
-      if (record.type === 'bench:summary') summaryReceived = true;
-      record.data.runId = options.runId;
-      record.data.fileRunId = scope.fileRunId;
-      if (record.data.entryFile !== null) {
-        record.data.entryFile = scope.entryFile;
-      }
-      const pending = handleRecord(record);
-      if (protocolError === undefined) {
-        const acknowledged = PromisePrototypeThen(
-          PromiseResolve(pending), () => sendAck(child, message.id));
-        trackPending(PromisePrototypeThen(acknowledged, () => {
-          recordPending = false;
-        }));
+  try {
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (data) => {
+      reportOutput(child.stdout, 'stdout', data);
+    });
+    child.stderr.on('data', (data) => {
+      reportOutput(child.stderr, 'stderr', data);
+    });
+    child.on('message', (message) => {
+      if (message?.type !== kChildMessageType) return;
+      try {
+        if (!NumberIsSafeInteger(message.id) || message.id < 0 || recordPending) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid record sequence');
+        }
+        recordPending = true;
+        const record = deserializeRecord(validateRecord(message.record));
+        const contextDiagnostic = isContextDiagnostic(record);
+        if (summaryReceived || (record.type === 'bench:plan' && plansComplete) ||
+            (record.type === 'bench:start' && activeBenchId !== undefined) ||
+            ((record.type === 'bench:sample' || contextDiagnostic) &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:complete' && activeBenchId !== undefined &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:summary' && activeBenchId !== undefined)) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid lifecycle sequence');
+        }
+        if (record.type !== 'bench:plan' &&
+            record.type !== 'bench:diagnostic') {
+          plansComplete = true;
+        }
+        if (record.type === 'bench:start') {
+          activeBenchId = record.data.benchId;
+        } else if (record.type === 'bench:complete' &&
+                   activeBenchId === record.data.benchId) {
+          activeBenchId = undefined;
+        }
+        if (record.type === 'bench:summary') summaryReceived = true;
+        record.data.runId = options.runId;
+        record.data.fileRunId = scope.fileRunId;
+        if (record.data.entryFile !== null) {
+          record.data.entryFile = scope.entryFile;
+        }
+        const pending = handleRecord(record);
+        if (protocolError === undefined) {
+          const acknowledged = PromisePrototypeThen(
+            PromiseResolve(pending), () => sendAck(child, message.id));
+          trackPending(PromisePrototypeThen(acknowledged, () => {
+            recordPending = false;
+          }));
+        }
+      } catch (error) {
+        if (!aborted) protocolError ??= error;
+        terminateChild();
       }
-    } catch (error) {
-      protocolError ??= error;
-      child.kill();
+    });
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
     }
-  });
-  const { 0: code, 1: signal } = await once(child, 'close');
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  let status;
+  try {
+    status = await closed.promise;
+  } finally {
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+  }
+  const { 0: code, 1: signal } = status;
   await SafePromiseAllReturnVoid(ArrayFrom(pendingRecords));
-  if (protocolError !== undefined) throw protocolError;
-  return { __proto__: null, code, signal };
+  if (!aborted && spawnError !== undefined) throw spawnError;
+  if (!aborted && protocolError !== undefined) throw protocolError;
+  return {
+    __proto__: null,
+    aborted,
+    code,
+    error: abortError,
+    signal,
+  };
 }
 
 async function runIsolated(files, options, output) {
@@ -749,6 +990,13 @@ async function runIsolated(files, options, output) {
   for (let i = 0; i < files.length; i++) {
     const path = files[i];
     const scope = options.fileScopes[i];
+    const observedCounts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
     let childSummary;
     let result;
     try {
@@ -757,6 +1005,16 @@ async function runIsolated(files, options, output) {
           childSummary = record.data;
           return;
         }
+        if (record.type === 'bench:plan') observedCounts.total++;
+        if (record.type === 'bench:complete') {
+          if (ObjectPrototypeHasOwnProperty(record.data, 'error')) {
+            observedCounts.failed++;
+          } else if (ObjectPrototypeHasOwnProperty(record.data, 'skip')) {
+            observedCounts.skipped++;
+          } else {
+            observedCounts.completed++;
+          }
+        }
         return emitRecordAndWait(output, record);
       });
     } catch (error) {
@@ -774,18 +1032,49 @@ async function runIsolated(files, options, output) {
           file: path,
         },
       });
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
       continue;
     }
 
+    if (result.aborted) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: result.error.message,
+          error: result.error,
+          level: 'error',
+          file: path,
+        },
+      });
+    }
     if (childSummary !== undefined) {
       success &&= childSummary.success;
       counts.completed += childSummary.counts.completed;
       counts.failed += childSummary.counts.failed;
       counts.skipped += childSummary.counts.skipped;
       counts.total += childSummary.counts.total;
+    } else {
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
     }
-    if (childSummary === undefined || result.code !== 0 ||
-        result.signal !== null) {
+    if (!result.aborted && (childSummary === undefined || result.code !== 0 ||
+        result.signal !== null)) {
       success = false;
       if (childSummary === undefined || childSummary.success) {
         const status = result.signal === null ?
@@ -812,7 +1101,8 @@ async function runIsolated(files, options, output) {
     runId: options.runId,
     fileRunId: scope?.fileRunId ?? null,
     entryFile: scope?.entryFile ?? null,
-    success: success && (process.exitCode ?? 0) === 0,
+    success: success && (options.useProcessExitCode === false ||
+      (process.exitCode ?? 0) === 0),
     counts,
     duration_ns: hrtime() - start,
     file: files.length === 1 ? resolve(options.cwd, files[0]) : null,
@@ -825,6 +1115,124 @@ async function runIsolated(files, options, output) {
   return summary;
 }
 
+function runFile(path, options = kEmptyObject) {
+  validateStringWithoutNullBytes(path, 'path');
+  if (!isAbsolute(path)) {
+    throw new ERR_INVALID_ARG_VALUE('path', path, 'must be an absolute path');
+  }
+  const file = resolve(path);
+  validateObject(options, 'options');
+  const {
+    env = process.env,
+    execArgv,
+    signal,
+  } = options;
+  let childExecArgv;
+  if (execArgv !== undefined) {
+    validateArray(execArgv, 'options.execArgv');
+    childExecArgv = [];
+    const length = execArgv.length;
+    for (let i = 0; i < length; i++) {
+      const arg = execArgv[i];
+      validateStringWithoutNullBytes(arg, `options.execArgv[${i}]`);
+      if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must be a Node.js command-line option');
+      }
+      if (kIncompatibleExecArgv.has(getRunFileOptionName(arg))) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'is not compatible with benchmark execution');
+      }
+      if (runFileOptionRequiresValue(arg)) {
+        const equals = StringPrototypeIndexOf(arg, '=');
+        if (equals !== -1) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must include a non-empty value');
+        }
+        if (i + 1 >= length) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must be followed by a value');
+        }
+        ArrayPrototypePush(childExecArgv, arg);
+        i++;
+        const value = execArgv[i];
+        validateStringWithoutNullBytes(value, `options.execArgv[${i}]`);
+        if (value.length === 0) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, value,
+            'must not be empty');
+        }
+        ArrayPrototypePush(childExecArgv, value);
+        continue;
+      }
+      if (!StringPrototypeStartsWith(arg, '--') &&
+          StringPrototypeIndexOf(arg, '=') !== -1) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must not use = with a short option');
+      }
+      ArrayPrototypePush(childExecArgv, arg);
+    }
+    if (ArrayPrototypeFilter(childExecArgv, filterExecArgv).length !==
+        childExecArgv.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.execArgv', childExecArgv,
+        'must not contain benchmark runner options');
+    }
+  } else {
+    childExecArgv = ArrayPrototypeFilter(
+      getInheritedChildArgs(), filterRunFileExecArgv);
+  }
+  validateObject(env, 'options.env');
+  const childEnv = { __proto__: null };
+  const envKeys = ObjectKeys(env);
+  for (let i = 0; i < envKeys.length; i++) {
+    const key = envKeys[i];
+    validateStringWithoutNullBytes(key, 'options.env key');
+    const value = env[key];
+    if (value === undefined) continue;
+    validateStringWithoutNullBytes(value, `options.env.${key}`);
+    if (kIPCEnvironmentVariables.has(StringPrototypeToUpperCase(key))) continue;
+    childEnv[key] = value;
+  }
+  validateAbortSignal(signal, 'options.signal');
+  if (signal !== undefined &&
+      (typeof signal.addEventListener !== 'function' ||
+       typeof signal.removeEventListener !== 'function')) {
+    throw new ERR_INVALID_ARG_TYPE('options.signal', 'AbortSignal', signal);
+  }
+
+  const runId = createRunId();
+  const scope = {
+    __proto__: null,
+    entryFile: file,
+    fileRunId: createRunId(),
+  };
+  const output = new BenchmarksStream();
+  const runOptions = {
+    __proto__: null,
+    cwd: process.cwd(),
+    env: childEnv,
+    execPath: process.execPath,
+    execArgv: childExecArgv,
+    fileScopes: [scope],
+    namePatternSource: '',
+    output,
+    runId,
+    signal,
+    useProcessExitCode: false,
+  };
+  const execution = PromisePrototypeThen(PromiseResolve(), () =>
+    (output.destroyed ? undefined : runIsolated([file], runOptions, output)));
+  PromisePrototypeThen(execution, () => output.end(),
+                       (error) => output.destroy(error));
+  return output;
+}
+
 async function run(patterns) {
   const options = parseCommandLine();
   const files = options.isChild ?
@@ -883,4 +1291,4 @@ async function run(patterns) {
   return summary;
 }
 
-module.exports = { run };
+module.exports = { run, runFile };
diff --git a/lib/internal/bench_runner/runner.js b/lib/internal/bench_runner/runner.js
index fc8595d2a35d..c48a0a5339fa 100644
--- a/lib/internal/bench_runner/runner.js
+++ b/lib/internal/bench_runner/runner.js
@@ -10,7 +10,12 @@ function run(options = kEmptyObject) {
   return runBenchmarks(options);
 }
 
+function runFile(path, options = kEmptyObject) {
+  return require('internal/bench_runner/cli').runFile(path, options);
+}
+
 module.exports = {
   createRunner,
   run,
+  runFile,
 };
diff --git a/test/fixtures/bench-runner/run-file-blocked.cjs b/test/fixtures/bench-runner/run-file-blocked.cjs
new file mode 100644
index 000000000000..9298d0dccc4b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-blocked.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('blocked run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file-lingering.cjs b/test/fixtures/bench-runner/run-file-lingering.cjs
new file mode 100644
index 000000000000..954bc108d01d
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-lingering.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+setInterval(() => {}, 1_000);
+if (process.platform !== 'win32') process.on('SIGTERM', () => {});
+process.on('disconnect', () => process.stdout.write('child disconnected\n'));
+
+bench('lingering run file', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/run-file-partial.cjs b/test/fixtures/bench-runner/run-file-partial.cjs
new file mode 100644
index 000000000000..9e3019e94e62
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-partial.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('completed before abort', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+bench('aborted run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file.cjs b/test/fixtures/bench-runner/run-file.cjs
new file mode 100644
index 000000000000..382af4cc42f1
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file.cjs
@@ -0,0 +1,21 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('run file', {
+  samples: 1,
+  params: {
+    context: process.env.NODE_BENCH_CONTEXT,
+    exposed: typeof globalThis.gc === 'function',
+    value: process.env.NODE_BENCH_RUN_FILE ?? 'unset',
+  },
+}, (b) => {
+  b.record({
+    duration_ns: 1n,
+    operations: 1,
+    detail: {
+      execArgv: process.execArgv,
+      pid: process.pid,
+    },
+  });
+});
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index bd67b4b45bdb..d0f9629ad9a3 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -709,6 +709,8 @@ if (common.hasInspector) {
   ]);
   assert.strictEqual(result.status, 1);
   const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)));
   assert.strictEqual(records.at(-1).data.success, false);
 }
 
diff --git a/test/parallel/test-bench-run-file.js b/test/parallel/test-bench-run-file.js
new file mode 100644
index 000000000000..eccbf2e72960
--- /dev/null
+++ b/test/parallel/test-bench-run-file.js
@@ -0,0 +1,318 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { once } = require('events');
+const path = require('path');
+const { runFile } = require('node:bench');
+
+const fixture = fixtures.path('bench-runner/run-file.cjs');
+
+assert.throws(() => runFile(null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile('relative.cjs'), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => runFile(fixture, null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, { execArgv: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [1] }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--bench'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [fixture] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e', '0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require='] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [`-r=${fixture}`] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof-process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof_process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, {
+  execArgv: ['--bench_name_pattern=run'],
+}), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => runFile(`${fixture}\0`), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 'x\0' } }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: { NODE_CHANNEL_FD: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: {} }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: { aborted: false } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+
+async function testRunFile() {
+  const execArgv = ['--expose-gc', '-r', 'fs'];
+  const env = {
+    __proto__: null,
+    ...process.env,
+    NODE_BENCH_CONTEXT: 'not-a-child',
+    NODE_BENCH_RUN_FILE: 'original',
+    NODE_CHANNEL_FD: '999',
+    NODE_CHANNEL_SERIALIZATION_MODE: 'json',
+  };
+  const stream = runFile(fixture, { env, execArgv });
+  execArgv.length = 0;
+  env.NODE_BENCH_RUN_FILE = 'mutated';
+  const records = await stream.toArray();
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const result = records.find(({ type }) => type === 'bench:complete').data;
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(plan.params.context, 'child');
+  assert.strictEqual(plan.params.exposed, true);
+  assert.strictEqual(plan.params.value, 'original');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(typeof result.samples[0].duration_ns, 'bigint');
+  assert.notStrictEqual(result.samples[0].detail.pid, process.pid);
+  assert(result.samples[0].detail.execArgv.includes('--expose-gc'));
+  assert(result.samples[0].detail.execArgv.includes('-r'));
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(summary.file, fixture);
+  assert.strictEqual(summary.entryFile, fixture);
+  assert.strictEqual(summary.fileRunId, result.fileRunId);
+  assert.strictEqual(summary.runId, result.runId);
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:summary').length, 1);
+}
+
+async function testConcurrentCalls() {
+  const [cjsRecords, esmRecords] = await Promise.all([
+    runFile(fixtures.path('bench-runner/a.cjs')).toArray(),
+    runFile(fixtures.path('bench-runner/b.mjs')).toArray(),
+  ]);
+  const cjsResult = cjsRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  const esmResult = esmRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(cjsResult.name, 'alpha');
+  assert.strictEqual(esmResult.name, 'beta');
+  assert.notStrictEqual(cjsResult.params.pid, esmResult.params.pid);
+  assert.notStrictEqual(cjsResult.runId, esmResult.runId);
+}
+
+async function testLoadFailure() {
+  const missing = path.resolve(fixtures.fixturesDir, 'does-not-exist.cjs');
+  const records = await runFile(missing).toArray();
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => data.level === 'error' && /failed with exit code/.test(
+      data.message)));
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testEvaluationFailure() {
+  const records = await runFile(fixtures.path(
+    'bench-runner/load-error-after-declaration.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.name, 'declared before load error');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStructuredError() {
+  const records = await runFile(
+    fixtures.path('bench-runner/error.cjs')).toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(result.error.cause, { value: 42n });
+  assert.match(result.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testAbort() {
+  const controller = new AbortController();
+  const reason = new Error('cancel run file');
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'),
+    { signal: controller.signal });
+  stream.once('bench:start', common.mustCall(() => controller.abort(reason)));
+  const records = await stream.toArray();
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR').data;
+  assert.strictEqual(diagnostic.error.cause.message, reason.message);
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+  assert.deepStrictEqual(records.at(-1).data.counts, {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 1,
+  });
+}
+
+async function testPartialAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-partial.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:start', ({ name }) => {
+    if (name === 'aborted run file') controller.abort();
+  });
+  const records = await stream.toArray();
+  const summary = records.at(-1).data;
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').length, 1);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 1,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+  assert.strictEqual(summary.success, false);
+}
+
+async function testPostSummaryAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-lingering.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:diagnostic', common.mustCall(({ message, stream }) => {
+    if (stream === 'stdout' && /child disconnected/.test(message)) {
+      controller.abort(new Error('stop lingering child'));
+    }
+  }, 2));
+  const records = await stream.toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR'));
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testExitCode() {
+  const records = await runFile(
+    fixtures.path('bench-runner/exit-code.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testParentExitCode() {
+  process.exitCode = 42;
+  try {
+    const records = await runFile(fixture).toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.exitCode = undefined;
+  }
+}
+
+async function testDefaultExecArgvSnapshot() {
+  const stream = runFile(fixture);
+  process.execArgv.push('--require=/does/not/exist.cjs');
+  try {
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execArgv.pop();
+  }
+}
+
+async function testExecPathSnapshot() {
+  const stream = runFile(fixture);
+  const execPath = process.execPath;
+  process.execPath = '/does/not/exist';
+  try {
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execPath = execPath;
+  }
+}
+
+function testEvalParent() {
+  const script = `
+    require('node:bench').runFile(${JSON.stringify(fixture)})
+      .on('bench:summary', (summary) => console.log(summary.success));
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '-e',
+    script,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stdout, 'true\n');
+}
+
+async function testPreAborted() {
+  const records = await runFile(fixture, {
+    signal: AbortSignal.abort(new Error('already cancelled')),
+  }).toArray();
+  assert.strictEqual(records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(records.find(({ type }) =>
+    type === 'bench:diagnostic').data.error.code, 'ABORT_ERR');
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testDestroy() {
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'));
+  stream.once('bench:start', common.mustCall(() => stream.destroy()));
+  await once(stream, 'close');
+  assert.strictEqual(stream.destroyed, true);
+}
+
+(async () => {
+  await testRunFile();
+  await testConcurrentCalls();
+  await testLoadFailure();
+  await testEvaluationFailure();
+  await testStructuredError();
+  await testAbort();
+  await testPartialAbort();
+  await testPostSummaryAbort();
+  await testExitCode();
+  await testParentExitCode();
+  await testDefaultExecArgvSnapshot();
+  await testExecPathSnapshot();
+  await testPreAborted();
+  await testDestroy();
+  testEvalParent();
+})().then(common.mustCall());

From 0cd23edcedb7001596a097bceb466336d472b9a9 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 14:36:15 +0000
Subject: [PATCH 091/202] lib: have runFile honor permissions and accept
 URL/Buffer paths

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                     | 24 +++++---
 lib/internal/bench_runner/cli.js     | 24 ++++++--
 test/parallel/test-bench-run-file.js | 91 ++++++++++++++++++++++++++--
 3 files changed, 120 insertions(+), 19 deletions(-)

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 2eb6eb6a3822..96a5aade5a41 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -504,7 +504,7 @@ for await (const { type, data } of run()) {
 added: REPLACEME
 -->
 
-* `path` {string} The absolute path of one benchmark module.
+* `path` {string|Buffer|URL} The path of one benchmark module.
 * `options` {Object}
   * `env` {Object} The child process environment. Property values must be
     strings or `undefined`. This replaces, rather than extends, the parent
@@ -518,18 +518,22 @@ added: REPLACEME
 * Returns: {BenchmarksStream}
 
 Runs exactly one benchmark module in a fresh child process and returns its
-object-mode event stream. `path` is not interpreted as a glob. Unless the signal
-is aborted or the stream is destroyed before startup, every call uses a new
-child. Input discovery, ordering, concurrency, retries, and multi-file
-scheduling remain the caller's responsibility.
+object-mode event stream. A relative `path` is resolved from the current working
+directory when `runFile()` is called. `path` is not interpreted as a glob.
+Unless the signal is aborted or the stream is destroyed before startup, every
+call uses a new child. Input discovery, ordering, concurrency, retries, and
+multi-file scheduling remain the caller's responsibility.
+
+When the Permission Model is enabled, the caller must have file system read
+access to `path` and permission to create child processes.
 
 Records use advanced child process serialization, preserving supported
 structured values such as `bigint` and errors. Child writes to stdout and stderr
-become `'bench:diagnostic'` records. A module loading error, abnormal child exit,
-or cancellation also emits an error diagnostic and produces a terminal
-`'bench:summary'` whose `success` property is `false`; these execution failures
-do not error the stream. If module evaluation fails after declaring benchmarks,
-those declarations still run before the unsuccessful summary.
+become `'bench:diagnostic'` records. A permission failure, module loading error,
+abnormal child exit, or cancellation also emits an error diagnostic and produces
+a terminal `'bench:summary'` whose `success` property is `false`; these execution
+failures do not error the stream. If module evaluation fails after declaring
+benchmarks, those declarations still run before the unsuccessful summary.
 
 `env`, effective inherited options, and an explicitly provided `execArgv` are
 copied when `runFile()` is called. The runner removes `NODE_OPTIONS`, replaces
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index 4b14493e391d..8e3d62257b62 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -36,10 +36,14 @@ const {
   StringPrototypeStartsWith,
   StringPrototypeToUpperCase,
   SymbolDispose,
+  uncurryThis,
 } = primordials;
+const { Buffer } = require('buffer');
+const BufferToString = uncurryThis(Buffer.prototype.toString);
 const { spawn } = require('child_process');
 const { createWriteStream, statSync } = require('fs');
 const { Glob } = require('internal/fs/glob');
+const { getValidatedPath } = require('internal/fs/utils');
 const {
   BenchmarksStream,
 } = require('internal/bench_runner/benchmarks_stream');
@@ -53,6 +57,7 @@ const { deserializeError, serializeError } = require('internal/error_serdes');
 const {
   AbortError,
   codes: {
+    ERR_ACCESS_DENIED,
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
     ERR_INVALID_STATE,
@@ -64,6 +69,7 @@ const {
   getOptionValue,
   getOptionsAsFlagsFromBinding,
 } = require('internal/options');
+const permission = require('internal/process/permission');
 const { TIMEOUT_MAX } = require('internal/timers');
 const { kEmptyObject } = require('internal/util');
 const {
@@ -75,7 +81,7 @@ const {
 } = require('internal/validators');
 const { pathToFileURL } = require('internal/url');
 const { pipeline } = require('stream/promises');
-const { isAbsolute, resolve, sep } = require('path');
+const { resolve, sep } = require('path');
 const { clearTimeout, setTimeout } = require('timers');
 
 const console = require('internal/console/global');
@@ -758,6 +764,16 @@ async function runChild(path, options, scope, onRecord) {
       }),
     };
   }
+  const resource = resolve(options.cwd, path);
+  if (permission.isEnabled() &&
+      !permission.has('fs.read', resource) &&
+      !permission.isAuditMode()) {
+    throw new ERR_ACCESS_DENIED(
+      'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+      'FileSystemRead',
+      resource,
+    );
+  }
   const child = spawn(
     options.execPath ?? process.execPath,
     getChildArgs(path, options),
@@ -1116,10 +1132,8 @@ async function runIsolated(files, options, output) {
 }
 
 function runFile(path, options = kEmptyObject) {
-  validateStringWithoutNullBytes(path, 'path');
-  if (!isAbsolute(path)) {
-    throw new ERR_INVALID_ARG_VALUE('path', path, 'must be an absolute path');
-  }
+  path = getValidatedPath(path);
+  if (typeof path !== 'string') path = BufferToString(path);
   const file = resolve(path);
   validateObject(options, 'options');
   const {
diff --git a/test/parallel/test-bench-run-file.js b/test/parallel/test-bench-run-file.js
index eccbf2e72960..600f1a212ae5 100644
--- a/test/parallel/test-bench-run-file.js
+++ b/test/parallel/test-bench-run-file.js
@@ -10,9 +10,9 @@ const path = require('path');
 const { runFile } = require('node:bench');
 
 const fixture = fixtures.path('bench-runner/run-file.cjs');
+const relativeFixture = path.relative(process.cwd(), fixture);
 
 assert.throws(() => runFile(null), { code: 'ERR_INVALID_ARG_TYPE' });
-assert.throws(() => runFile('relative.cjs'), { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => runFile(fixture, null), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => runFile(fixture, { execArgv: null }), {
   code: 'ERR_INVALID_ARG_TYPE',
@@ -50,6 +50,9 @@ assert.throws(() => runFile(fixture, {
 assert.throws(() => runFile(`${fixture}\0`), {
   code: 'ERR_INVALID_ARG_VALUE',
 });
+assert.throws(() => runFile(Buffer.from(`${fixture}\0`)), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
 assert.throws(() => runFile(fixture, { env: null }), {
   code: 'ERR_INVALID_ARG_TYPE',
 });
@@ -79,7 +82,7 @@ async function testRunFile() {
     NODE_CHANNEL_FD: '999',
     NODE_CHANNEL_SERIALIZATION_MODE: 'json',
   };
-  const stream = runFile(fixture, { env, execArgv });
+  const stream = runFile(relativeFixture, { env, execArgv });
   execArgv.length = 0;
   env.NODE_BENCH_RUN_FILE = 'mutated';
   const records = await stream.toArray();
@@ -108,8 +111,11 @@ async function testRunFile() {
 
 async function testConcurrentCalls() {
   const [cjsRecords, esmRecords] = await Promise.all([
-    runFile(fixtures.path('bench-runner/a.cjs')).toArray(),
-    runFile(fixtures.path('bench-runner/b.mjs')).toArray(),
+    runFile(fixtures.fileURL('bench-runner/a.cjs')).toArray(),
+    runFile(Buffer.from(path.relative(
+      process.cwd(),
+      fixtures.path('bench-runner/b.mjs'),
+    ))).toArray(),
   ]);
   const cjsResult = cjsRecords.find(
     ({ type }) => type === 'bench:complete').data;
@@ -119,6 +125,14 @@ async function testConcurrentCalls() {
   assert.strictEqual(esmResult.name, 'beta');
   assert.notStrictEqual(cjsResult.params.pid, esmResult.params.pid);
   assert.notStrictEqual(cjsResult.runId, esmResult.runId);
+  assert.strictEqual(
+    cjsRecords.at(-1).data.file,
+    fixtures.path('bench-runner/a.cjs'),
+  );
+  assert.strictEqual(
+    esmRecords.at(-1).data.file,
+    fixtures.path('bench-runner/b.mjs'),
+  );
 }
 
 async function testLoadFailure() {
@@ -280,6 +294,74 @@ function testEvalParent() {
   assert.strictEqual(result.stdout, 'true\n');
 }
 
+function testPermissions() {
+  const fsReadScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const { pathToFileURL } = require('url');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('child'), true);
+    assert.strictEqual(process.permission.has('fs.read', target), false);
+    Promise.all([
+      target,
+      Buffer.from(target),
+      pathToFileURL(target),
+    ].map(async (input) => {
+      const records = await runFile(input).toArray();
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'FileSystemRead');
+      assert.strictEqual(diagnostic.data.error.resource, target);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    })).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--permission',
+    '--allow-child-process',
+    '-e',
+    fsReadScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+
+  const childProcessScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('fs.read', target), true);
+    assert.strictEqual(process.permission.has('child'), false);
+    runFile(target).toArray().then((records) => {
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'ChildProcess');
+      assert.strictEqual(diagnostic.data.error.resource, process.execPath);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    }).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const childProcessResult = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--permission',
+    `--allow-fs-read=${fixture}`,
+    '-e',
+    childProcessScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(
+    childProcessResult.status,
+    0,
+    childProcessResult.stderr,
+  );
+}
+
 async function testPreAborted() {
   const records = await runFile(fixture, {
     signal: AbortSignal.abort(new Error('already cancelled')),
@@ -315,4 +397,5 @@ async function testDestroy() {
   await testPreAborted();
   await testDestroy();
   testEvalParent();
+  testPermissions();
 })().then(common.mustCall());

From b00bd40525b1bb3a5eec5a7a704541479ded2340 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 15:11:16 +0000
Subject: [PATCH 092/202] lib: improve diagnostic message support

Support serializable context.diagnostic messages and
optionally listen to diagnostic_channel messages

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/bench.md                              |  25 +++-
 doc/api/cli.md                                |   4 +-
 doc/node.1                                    |   1 +
 lib/internal/bench_runner/benchmark.js        |  48 ++++++-
 lib/internal/bench_runner/cli.js              |   5 +-
 lib/internal/bench_runner/harness.js          |  36 ++++++
 test/fixtures/bench-runner/diagnostic.cjs     |  16 ++-
 test/parallel/test-bench-cli.js               |   9 +-
 test/parallel/test-bench-context-errors.js    |   8 +-
 .../test-bench-diagnostic-channels.js         | 119 ++++++++++++++++++
 test/parallel/test-bench-diagnostics.js       |  10 +-
 test/parallel/test-bench-validation.js        |   4 +
 12 files changed, 253 insertions(+), 32 deletions(-)
 create mode 100644 test/parallel/test-bench-diagnostic-channels.js

diff --git a/doc/api/bench.md b/doc/api/bench.md
index 96a5aade5a41..842e8a59264b 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -316,6 +316,9 @@ added: REPLACEME
 * `name` {string} The benchmark name. **Default:** The `name` property of `fn`,
   or `'<anonymous>'` when `fn` has no name.
 * `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names, deduplicated
+    and inherited from containing suites by union. Symbol values in the array
+    are silently ignored. **Default:** `[]`.
   * `only` {boolean} When any benchmark or containing suite has `only` set,
     benchmarks without `only` in their hierarchy are skipped. **Default:**
     `false`.
@@ -346,6 +349,12 @@ samples, but their samples are discarded. An exception, rejection, timeout,
 abort, missing timing call, or duplicate timing call stops the current
 benchmark. Later benchmarks continue to run.
 
+For each warmup and measured callback, the runner subscribes to the configured
+diagnostics channels. Each publication queues a context diagnostic whose
+`message` is `{ name, message }`, containing the string channel name and the
+published message. Subscriptions are removed when the callback settles or is
+aborted.
+
 A timeout or abort cannot interrupt synchronous JavaScript and does not forcibly
 cancel asynchronous work that ignores `context.signal`.
 
@@ -388,6 +397,9 @@ added: REPLACEME
 * `name` {string} The suite name. **Default:** The `name` property of `fn`, or
   `'<anonymous>'` when `fn` has no name.
 * `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names inherited by
+    nested suites and benchmarks. Symbol values in the array are silently
+    ignored. **Default:** `[]`.
   * `only` {boolean} Selects all benchmarks nested in this suite. **Default:**
     `false`.
   * `skip` {boolean|string} Skips all benchmarks nested in this suite.
@@ -663,7 +675,8 @@ message transport from the duration. `record()` is mutually exclusive with
 added: REPLACEME
 -->
 
-* `message` {string} The diagnostic message.
+* `message` {any} A structured-cloneable diagnostic value. With CLI process
+  isolation, it must also be supported by advanced child process serialization.
 * `options` {Object}
   * `level` {string} Either `'info'` or `'warning'`. **Default:** `'info'`.
   * `detail` {any} Additional structured-cloneable diagnostic data. With CLI
@@ -679,10 +692,10 @@ before a callback failure are emitted before the failed `'bench:complete'`
 event and do not themselves cause the benchmark to fail. If a timeout or abort
 wins before the callback settles, queued diagnostics might not be emitted.
 
-The message and options are validated, and detail is cloned, synchronously.
-Calling `diagnostic()` between `context.start()` and `context.end()` therefore
-includes that work in the measured duration. Invalid arguments or an
-uncloneable detail violate the sample contract.
+The message and detail are cloned synchronously. Options are also validated
+synchronously. Calling `diagnostic()` between `context.start()` and
+`context.end()` therefore includes that work in the measured duration. Invalid
+arguments or an uncloneable message or detail violate the sample contract.
 
 ### `context.done()`
 
@@ -751,6 +764,8 @@ isolation, all files share one runner and their plans are emitted before any
 benchmark executes. Plan data contains the benchmark-scoped identity, location,
 tags, and parameters described in [benchmark result][], together with:
 
+* `diagnosticChannels` {string\[]} The inherited string channel names
+  subscribed to during each callback.
 * `samples` {number} The effective maximum number of measured callback
   invocations after run-level overrides.
 * `warmup` {number} The effective number of unreported warmup callback
diff --git a/doc/api/cli.md b/doc/api/cli.md
index bb44815f476b..2fbbac6cd510 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -512,9 +512,7 @@ benchmark runner process. This reduces startup overhead but allows module,
 heap, and process state to carry between files. User writes to stdout or stderr
 also share destinations with benchmark reporters in this mode.
 
-The supported modes are `'process'` and `'none'`. Worker-thread isolation is not
-a CLI mode. Higher-level tools can implement it using externally measured
-samples as described in the [benchmark runner][] documentation.
+The supported modes are `'process'` and `'none'`.
 
 ### `--bench-name-pattern=pattern`
 
diff --git a/doc/node.1 b/doc/node.1
index 736df88c01be..5448bfd9b78e 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -315,6 +315,7 @@ When \fBmode\fR is \fB'none'\fR, all matching files and benchmarks run serially
 benchmark runner process. This reduces startup overhead but allows module,
 heap, and process state to carry between files. User writes to stdout or stderr
 also share destinations with benchmark reporters in this mode.
+The supported modes are \fB'process'\fR and \fB'none'\fR.
 .
 .It Fl -bench-name-pattern Ns = Ns Ar pattern
 Only runs benchmarks whose full hierarchical name matches the JavaScript
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
index 93fe34595708..375f8e6b635f 100644
--- a/lib/internal/bench_runner/benchmark.js
+++ b/lib/internal/bench_runner/benchmark.js
@@ -48,6 +48,7 @@ const { structuredClone } = require('internal/worker/js_transferable');
 const { bigint: hrtime } = process.hrtime;
 const kDefaultSamples = 30;
 const kDefaultWarmup = 0;
+const kEmptyDiagnosticChannels = ObjectFreeze([]);
 const kEmptyNamePath = ObjectFreeze([]);
 const kEmptyParams = ObjectFreeze({ __proto__: null });
 const kEmptyTags = ObjectFreeze([]);
@@ -82,6 +83,33 @@ function canonicalizeTags(tags, parentTags = kEmptyTags) {
   return ObjectFreeze(result);
 }
 
+function canonicalizeDiagnosticChannels(
+  diagnosticChannels,
+  parentDiagnosticChannels = kEmptyDiagnosticChannels,
+) {
+  if (diagnosticChannels === undefined) return parentDiagnosticChannels;
+  if (!ArrayIsArray(diagnosticChannels)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.diagnosticChannels', 'Array', diagnosticChannels);
+  }
+
+  const result = ArrayPrototypeSlice(parentDiagnosticChannels);
+  const seen = new SafeSet(parentDiagnosticChannels);
+  for (let i = 0; i < diagnosticChannels.length; i++) {
+    const name = diagnosticChannels[i];
+    if (typeof name === 'symbol') continue;
+    if (typeof name !== 'string') {
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.diagnosticChannels[${i}]`, ['string', 'symbol'], name);
+    }
+    if (!seen.has(name)) {
+      seen.add(name);
+      ArrayPrototypePush(result, name);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
 function canonicalizeParams(params) {
   if (params === undefined) return kEmptyParams;
   validateObject(params, 'options.params');
@@ -106,15 +134,17 @@ function canonicalizeParams(params) {
   return ObjectFreeze(result);
 }
 
-function validateNodeOptions(options, parentTags) {
+function validateNodeOptions(options, parentTags, parentDiagnosticChannels) {
   validateObject(options, 'options');
-  const { only = false, skip, tags } = options;
+  const { diagnosticChannels, only = false, skip, tags } = options;
   if (typeof only !== 'boolean') {
     throw new ERR_INVALID_ARG_TYPE('options.only', 'boolean', only);
   }
   validateSkip(skip);
   return {
     __proto__: null,
+    diagnosticChannels: canonicalizeDiagnosticChannels(
+      diagnosticChannels, parentDiagnosticChannels),
     only,
     skip,
     tags: canonicalizeTags(tags, parentTags),
@@ -157,7 +187,10 @@ class Suite extends AsyncResource {
   constructor(harness, parent, name, options, fn, loc, isRoot = false) {
     super('BenchSuite');
     const validated = validateNodeOptions(
-      options, parent?.tags ?? kEmptyTags);
+      options,
+      parent?.tags ?? kEmptyTags,
+      parent?.diagnosticChannels ?? kEmptyDiagnosticChannels,
+    );
 
     this.harness = harness;
     this.parent = parent;
@@ -174,6 +207,7 @@ class Suite extends AsyncResource {
       this.namePath,
     ]);
     this.parentId = isRoot || parent.isRoot ? null : parent.suiteId;
+    this.diagnosticChannels = validated.diagnosticChannels;
     this.only = validated.only;
     this.skip = validated.skip;
     this.tags = validated.tags;
@@ -195,7 +229,8 @@ class Suite extends AsyncResource {
 class Bench extends AsyncResource {
   constructor(harness, parent, name, options, fn, loc) {
     super('Benchmark');
-    const validated = validateNodeOptions(options, parent.tags);
+    const validated = validateNodeOptions(
+      options, parent.tags, parent.diagnosticChannels);
     const {
       params,
       samples = kDefaultSamples,
@@ -216,6 +251,7 @@ class Bench extends AsyncResource {
     this.name = name;
     this.fn = fn;
     this.loc = createLocation(loc, harness.entryFile);
+    this.diagnosticChannels = validated.diagnosticChannels;
     this.only = validated.only;
     this.skip = validated.skip;
     this.tags = validated.tags;
@@ -275,7 +311,7 @@ class BenchContext {
       throw new ERR_INVALID_STATE('benchmark sample is no longer active');
     }
     try {
-      validateString(message, 'message');
+      const clonedMessage = structuredClone(message);
       validateObject(options, 'options');
       const { detail, level = 'info' } = options;
       validateString(level, 'options.level');
@@ -283,7 +319,7 @@ class BenchContext {
         throw new ERR_INVALID_ARG_VALUE(
           'options.level', level, "must be 'info' or 'warning'");
       }
-      const diagnostic = { __proto__: null, level, message };
+      const diagnostic = { __proto__: null, level, message: clonedMessage };
       if (detail !== undefined) diagnostic.detail = structuredClone(detail);
       this.#onDiagnostic(diagnostic);
     } catch (error) {
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index 8e3d62257b62..0cc4dc5210a1 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -440,7 +440,8 @@ function validateRecord(record) {
       warmup,
       yieldBetweenSamples,
     } = record.data;
-    if (typeof record.data.file !== 'string' ||
+    if (!isStringArray(record.data.diagnosticChannels) ||
+        typeof record.data.file !== 'string' ||
         !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
         !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
         !isStringArray(record.data.tags) ||
@@ -471,7 +472,7 @@ function validateRecord(record) {
         record.data.phase !== 'measurement') ||
        !NumberIsSafeInteger(record.data.index) || record.data.index < 0 ||
        record.data.index > 0xFFFFFFFF ||
-       typeof record.data.message !== 'string' ||
+       !ObjectPrototypeHasOwnProperty(record.data, 'message') ||
        (record.data.level !== 'info' && record.data.level !== 'warning') ||
        typeof record.data.file !== 'string' ||
        !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index f3e28bc01b1a..c18f439f6719 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -24,6 +24,10 @@ const {
 const { getCallerLocation } = internalBinding('util');
 const { exitCodes: { kGenericUserError } } = internalBinding('errors');
 const { AsyncLocalStorage } = require('async_hooks');
+const {
+  subscribe: subscribeToChannel,
+  unsubscribe: unsubscribeFromChannel,
+} = require('diagnostics_channel');
 const { AbortController } = require('internal/abort_controller');
 const {
   AbortError,
@@ -406,6 +410,7 @@ class Harness {
         parentId: benchmark.parentId,
         name: benchmark.name,
         namePath: ArrayPrototypeSlice(benchmark.namePath),
+        diagnosticChannels: ArrayPrototypeSlice(benchmark.diagnosticChannels),
         file: benchmark.loc.file,
         line: benchmark.loc.line,
         column: benchmark.loc.column,
@@ -720,9 +725,37 @@ class Harness {
     const context = new BenchContext(
       benchmark, signal, phase, index,
       (diagnostic) => ArrayPrototypePush(diagnostics, diagnostic));
+    const channels = benchmark.diagnosticChannels;
+    let abortSubscription;
+    let diagnosticError;
+    let diagnosticFailed = false;
+    let subscribed = 0;
+    const onMessage = (message, name) => {
+      if (signal.aborted || diagnosticFailed) return;
+      try {
+        context.diagnostic({ __proto__: null, name, message });
+      } catch (error) {
+        diagnosticError = error;
+        diagnosticFailed = true;
+      }
+    };
+    const unsubscribe = () => {
+      while (subscribed > 0) {
+        subscribed--;
+        unsubscribeFromChannel(channels[subscribed], onMessage);
+      }
+    };
     try {
+      for (let i = 0; i < channels.length; i++) {
+        subscribeToChannel(channels[i], onMessage);
+        subscribed++;
+      }
+      if (subscribed > 0) {
+        abortSubscription = addAbortListener(signal, unsubscribe);
+      }
       await this.#invoke(
         benchmark, benchmark, benchmark.fn, [context]);
+      if (diagnosticFailed) throw diagnosticError;
       const { done, sample } = context.finish();
       return {
         __proto__: null,
@@ -739,6 +772,9 @@ class Harness {
         error,
         failed: true,
       };
+    } finally {
+      abortSubscription?.[SymbolDispose]();
+      unsubscribe();
     }
   }
 
diff --git a/test/fixtures/bench-runner/diagnostic.cjs b/test/fixtures/bench-runner/diagnostic.cjs
index 018b8a31de42..9e413e943dd7 100644
--- a/test/fixtures/bench-runner/diagnostic.cjs
+++ b/test/fixtures/bench-runner/diagnostic.cjs
@@ -1,11 +1,17 @@
 'use strict';
 
 const { bench } = require('node:bench');
+const { channel } = require('diagnostics_channel');
 
-bench('diagnostic relay', { samples: 1 }, (b) => {
-  b.diagnostic('relayed warning', {
-    detail: { value: 42n },
-    level: 'warning',
-  });
+const channelName = 'node:bench:test:diagnostic';
+const diagnosticChannel = channel(channelName);
+
+bench('diagnostic relay', {
+  diagnosticChannels: [channelName],
+  samples: 1,
+}, (b) => {
+  const message = { value: 42n };
+  diagnosticChannel.publish(message);
+  message.value = 0n;
   b.record({ duration_ns: 1n, operations: 1 });
 });
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index d0f9629ad9a3..21090814f867 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -399,11 +399,14 @@ for (const isolation of ['process', 'none']) {
     ({ type }) => type === 'bench:diagnostic').data;
   const completion = records.find(
     ({ type }) => type === 'bench:complete').data;
-  assert.strictEqual(diagnostic.message, 'relayed warning');
-  assert.strictEqual(diagnostic.level, 'warning');
+  assert.deepStrictEqual(diagnostic.message, {
+    name: 'node:bench:test:diagnostic',
+    message: { value: '42' },
+  });
+  assert.strictEqual(diagnostic.level, 'info');
   assert.strictEqual(diagnostic.phase, 'measurement');
   assert.strictEqual(diagnostic.index, 0);
-  assert.deepStrictEqual(diagnostic.detail, { value: '42' });
+  assert.strictEqual(diagnostic.detail, undefined);
   assert.strictEqual(diagnostic.benchId, completion.benchId);
   assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
   assert.strictEqual(completion.error, undefined);
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
index ad2be4aa1274..9ba104443ad6 100644
--- a/test/parallel/test-bench-context-errors.js
+++ b/test/parallel/test-bench-context-errors.js
@@ -59,8 +59,8 @@ runner.bench('reentrant record', { samples: 1 }, (b) => {
 runner.bench('uncloneable detail', { samples: 1 }, (b) => {
   b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
 });
-runner.bench('invalid diagnostic message', { samples: 1 }, (b) => {
-  b.diagnostic(1);
+runner.bench('uncloneable diagnostic message', { samples: 1 }, (b) => {
+  b.diagnostic(() => {});
 });
 runner.bench('invalid diagnostic level', { samples: 1 }, (b) => {
   b.diagnostic('invalid', { level: 'error' });
@@ -113,8 +113,8 @@ runner.bench('caught diagnostic violation', { samples: 1 },
                      'ERR_INVALID_STATE');
   assert.strictEqual(byName.get('uncloneable detail').error.name,
                      'DataCloneError');
-  assert.strictEqual(byName.get('invalid diagnostic message').error.code,
-                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('uncloneable diagnostic message').error.name,
+                     'DataCloneError');
   assert.strictEqual(byName.get('invalid diagnostic level').error.code,
                      'ERR_INVALID_ARG_VALUE');
   assert.strictEqual(byName.get('uncloneable diagnostic detail').error.name,
diff --git a/test/parallel/test-bench-diagnostic-channels.js b/test/parallel/test-bench-diagnostic-channels.js
new file mode 100644
index 000000000000..9e1bb2a07024
--- /dev/null
+++ b/test/parallel/test-bench-diagnostic-channels.js
@@ -0,0 +1,119 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const dc = require('diagnostics_channel');
+const { createRunner } = require('node:bench');
+
+const prefix = `node:bench:test:${process.pid}`;
+const inheritedName = `${prefix}:inherited`;
+const nestedName = `${prefix}:nested`;
+const benchmarkName = `${prefix}:benchmark`;
+const unlistedName = `${prefix}:unlisted`;
+const symbolName = Symbol(`${prefix}:symbol`);
+const inheritedChannel = dc.channel(inheritedName);
+const nestedChannel = dc.channel(nestedName);
+const benchmarkChannel = dc.channel(benchmarkName);
+const unlistedChannel = dc.channel(unlistedName);
+const symbolChannel = dc.channel(symbolName);
+
+function recordSample(context) {
+  context.record({ duration_ns: 1n, operations: 1 });
+}
+
+async function testCapture() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.suite('outer', {
+    diagnosticChannels: [inheritedName, symbolName, inheritedName],
+  }, common.mustCall(() => {
+    runner.suite('inner', {
+      diagnosticChannels: [nestedName],
+    }, common.mustCall(() => {
+      runner.bench('captured', {
+        diagnosticChannels: [benchmarkName, nestedName],
+        samples: 1,
+      }, common.mustCall((context) => {
+        const message = { value: 1 };
+        inheritedChannel.publish(message);
+        message.value = 0;
+        nestedChannel.publish({ value: 2 });
+        benchmarkChannel.publish({ value: 3 });
+        unlistedChannel.publish({ value: 4 });
+        symbolChannel.publish({ value: 5 });
+        recordSample(context);
+      }));
+    }));
+  }));
+  runner.bench('not captured', { samples: 1 }, common.mustCall((context) => {
+    inheritedChannel.publish({ value: 6 });
+    recordSample(context);
+  }));
+
+  const records = await runner.run().toArray();
+  const plan = records.find(
+    ({ type, data }) => type === 'bench:plan' && data.name === 'captured').data;
+  assert.deepStrictEqual(plan.diagnosticChannels, [
+    inheritedName,
+    nestedName,
+    benchmarkName,
+  ]);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic').map(({ data }) => data);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { name: inheritedName, message: { value: 1 } },
+    { name: nestedName, message: { value: 2 } },
+    { name: benchmarkName, message: { value: 3 } },
+  ]);
+  assert(diagnostics.every(({ level }) => level === 'info'));
+  assert.strictEqual(inheritedChannel.hasSubscribers, false);
+  assert.strictEqual(nestedChannel.hasSubscribers, false);
+  assert.strictEqual(benchmarkChannel.hasSubscribers, false);
+  assert.strictEqual(symbolChannel.hasSubscribers, false);
+}
+
+async function testUncloneableMessage() {
+  const name = `${prefix}:uncloneable`;
+  const channel = dc.channel(name);
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('uncloneable', {
+    diagnosticChannels: [name],
+    samples: 1,
+  }, common.mustCall((context) => {
+    channel.publish(() => {});
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.name, 'DataCloneError');
+  assert.strictEqual(channel.hasSubscribers, false);
+}
+
+async function testAbortCleanup() {
+  const name = `${prefix}:abort`;
+  const channel = dc.channel(name);
+  const controller = new AbortController();
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('abort', {
+    diagnosticChannels: [name],
+    samples: 1,
+    signal: controller.signal,
+  }, common.mustCall((context) => {
+    controller.abort(new Error('stop'));
+    assert.strictEqual(channel.hasSubscribers, false);
+    channel.publish({ ignored: true });
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:diagnostic'),
+    false,
+  );
+}
+
+(async () => {
+  await testCapture();
+  await testUncloneableMessage();
+  await testAbortCleanup();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostics.js b/test/parallel/test-bench-diagnostics.js
index 9f8facbcb16f..9e33fd56323f 100644
--- a/test/parallel/test-bench-diagnostics.js
+++ b/test/parallel/test-bench-diagnostics.js
@@ -99,12 +99,14 @@ async function testAfterEachFailurePrecedence() {
   }, common.mustCall((b) => {
     finalContext = b;
     const detail = { index: b.index };
+    const message = { index: b.index, phase: b.phase };
     const level = b.phase === 'warmup' ? 'info' : 'warning';
-    assert.strictEqual(b.diagnostic(`${b.phase} ${b.index}`, {
+    assert.strictEqual(b.diagnostic(message, {
       detail,
       level,
     }), undefined);
     detail.index = -1;
+    message.index = -1;
     recordSample(b);
   }, 3));
   const expectedError = new Error('benchmark failed');
@@ -135,9 +137,9 @@ async function testAfterEachFailurePrecedence() {
   assert.strictEqual(diagnostics.length, 4);
   assert.strictEqual(namedDiagnostics.length, diagnostics.length);
   assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
-    'warmup 0',
-    'measurement 0',
-    'measurement 1',
+    { index: 0, phase: 'warmup' },
+    { index: 0, phase: 'measurement' },
+    { index: 1, phase: 'measurement' },
     'before failure',
   ]);
   assert.deepStrictEqual(diagnostics.map(({ phase, index, level }) => ({
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
index 7071dd2d915f..fa7a579aa60c 100644
--- a/test/parallel/test-bench-validation.js
+++ b/test/parallel/test-bench-validation.js
@@ -34,6 +34,10 @@ assert.throws(() => bench('name', { timeout: -1 }, noop),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => bench('name', { signal: {} }, noop),
               { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: 'channel' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: [1] }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => bench('name', { tags: 'fast' }, noop),
               { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => bench('name', { tags: [''] }, noop),

From dd70a25c202336be9b39f6d5947c825c522a9889 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sat, 29 Aug 2026 19:22:02 +0000
Subject: [PATCH 093/202] lib,benchmark: address multiple review issues

Refs: https://github.com/nodejs/node/pull/65606#discussion_r3887305271
Refs: https://github.com/nodejs/node/pull/65606#discussion_r3887305272
Refs: https://github.com/nodejs/node/pull/65606#discussion_r3887305275
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 benchmark/README.md                           |  6 +-
 benchmark/_node-bench-analysis.js             | 41 ++++++++++---
 benchmark/compare-node-bench.js               |  6 +-
 doc/api/bench.md                              |  5 ++
 .../writing-and-running-benchmarks.md         |  5 +-
 lib/internal/bench_runner/harness.js          | 34 ++++++++++-
 test/parallel/test-bench-errors.js            | 40 +++++++++----
 .../test-benchmark-node-bench-tools.js        | 57 +++++++++++++++++--
 8 files changed, 164 insertions(+), 30 deletions(-)

diff --git a/benchmark/README.md b/benchmark/README.md
index d2d1ac6a0f7c..78a55fba453f 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -80,9 +80,9 @@ Rscript benchmark/compare.R < compare-node-bench.csv
 
 Pass `--analyze` to run the same Welch analysis inline. `--max-regression N`
 implies `--analyze` and makes the command fail only when the Holm-Bonferroni
-adjusted p-value is below 0.05 and the full 95% confidence interval is worse
-than `-N%`. Requiring both conditions prevents a noisy point estimate from
-failing a regression gate.
+adjusted one-sided p-value against the `N%` threshold is below 0.05 and the full
+95% confidence interval is worse than `-N%`. Requiring both conditions prevents
+a noisy point estimate from failing a regression gate.
 
 ```console
 ./node benchmark/compare-node-bench.js \
diff --git a/benchmark/_node-bench-analysis.js b/benchmark/_node-bench-analysis.js
index 5fa3c34d3976..bf0f7402b791 100644
--- a/benchmark/_node-bench-analysis.js
+++ b/benchmark/_node-bench-analysis.js
@@ -31,8 +31,19 @@ function holmAdjust(pValues) {
   return adjusted;
 }
 
+function thresholdPValue(oldRates, newHistogram, scale, maxRegression) {
+  const factor = 1 - maxRegression / 100;
+  if (factor <= 0) return 1;
+  const thresholdHistogram = createRateHistogram(
+    oldRates.map((rate) => rate * factor), scale, 3);
+  const result = thresholdHistogram.welchTest(newHistogram);
+  if (Number.isNaN(result.pValue)) return 1;
+  return result.tStatistic > 0 ?
+    result.pValue / 2 : 1 - result.pValue / 2;
+}
+
 function isRegressionFailure(row, maxRegression) {
-  return row.pAdjusted < 0.05 &&
+  return row.pThresholdAdjusted < 0.05 &&
          row.improvement + row.ci95 < -maxRegression;
 }
 
@@ -80,7 +91,7 @@ function analyzeCompare(samples, scale, maxRegression) {
                     result.confidenceInterval.lower) / 2;
       return (half / (oldMean * scale)) * 100;
     };
-    rows.push({
+    const row = {
       ci95: ciPercent(w95),
       ci99: ciPercent(w99),
       ci999: ciPercent(w999),
@@ -88,14 +99,24 @@ function analyzeCompare(samples, scale, maxRegression) {
       name,
       pValue: Number.isNaN(w95.pValue) ? 1 : w95.pValue,
       stars,
-    });
+    };
+    if (maxRegression !== undefined) {
+      row.pThreshold = thresholdPValue(
+        oldRates, newHistogram, scale, maxRegression);
+    }
+    rows.push(row);
   }
 
   const adjusted = holmAdjust(rows.map(({ pValue }) => pValue));
+  const thresholdAdjusted = maxRegression === undefined ? null :
+    holmAdjust(rows.map(({ pThreshold }) => pThreshold));
   let underpowered = 0;
   for (let index = 0; index < rows.length; index++) {
     const row = rows[index];
     row.pAdjusted = adjusted[index];
+    if (thresholdAdjusted !== null) {
+      row.pThresholdAdjusted = thresholdAdjusted[index];
+    }
     row.inconclusive = maxRegression > 0 &&
                        row.stars.trim() === '' &&
                        row.ci95 > maxRegression;
@@ -146,8 +167,13 @@ function analyzeCompare(samples, scale, maxRegression) {
     `After Holm-Bonferroni correction across ${rows.length} comparison` +
     `${rows.length === 1 ? '' : 's'}, ${significant} remain` +
     `${significant === 1 ? 's' : ''} significant at 5%.`,
-    '--max-regression uses the corrected values.',
   );
+  if (maxRegression !== undefined) {
+    output.push(
+      `For --max-regression, one-sided p-values against the ` +
+      `${maxRegression}% threshold were corrected separately.`,
+    );
+  }
 
   if (maxRegression > 0 && underpowered > 0) {
     output.push('');
@@ -159,21 +185,22 @@ function analyzeCompare(samples, scale, maxRegression) {
     );
   }
 
-  const failures = maxRegression > 0 ?
+  const failures = maxRegression !== undefined ?
     rows.filter((row) => isRegressionFailure(row, maxRegression)) : [];
   if (failures.length > 0) {
     output.push('');
     output.push(
       `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
       ` regressed by more than ${maxRegression}% (the 95% interval excludes ` +
-      `the threshold and significance is family-wise corrected across ` +
+      `the threshold and its one-sided test is family-wise corrected across ` +
       `${rows.length} comparisons):`,
     );
     for (const failure of failures) {
       output.push(
         `  ${failure.name}  ${failure.improvement.toFixed(2)}% ` +
         `(95% CI up to ${(failure.improvement + failure.ci95).toFixed(2)}%, ` +
-        `adjusted p=${failure.pAdjusted.toExponential(2)})`,
+        `adjusted threshold p=` +
+        `${failure.pThresholdAdjusted.toExponential(2)})`,
       );
     }
   }
diff --git a/benchmark/compare-node-bench.js b/benchmark/compare-node-bench.js
index d2bc6071bed7..295f15f0fdc1 100644
--- a/benchmark/compare-node-bench.js
+++ b/benchmark/compare-node-bench.js
@@ -36,9 +36,10 @@ async function main() {
   const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
   const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
   const scale = parseInteger(cli.optional.scale, 1000, '--scale', 1);
+  const hasMaxRegression = cli.optional['max-regression'] !== undefined;
   const maxRegression = parseNumber(
     cli.optional['max-regression'], 0, '--max-regression', 0);
-  const analyze = !!cli.optional.analyze || maxRegression > 0;
+  const analyze = !!cli.optional.analyze || hasMaxRegression;
   const options = {
     namePattern: cli.optional['name-pattern'],
     nodeArgs: cli.optional['node-arg'],
@@ -96,7 +97,8 @@ async function main() {
   }
 
   if (analyze) {
-    const result = analyzeCompare(rows, scale, maxRegression);
+    const result = analyzeCompare(
+      rows, scale, hasMaxRegression ? maxRegression : undefined);
     process.stdout.write(result.output);
     if (result.failed) process.exitCode = 1;
     return;
diff --git a/doc/api/bench.md b/doc/api/bench.md
index 842e8a59264b..b25503830f2c 100644
--- a/doc/api/bench.md
+++ b/doc/api/bench.md
@@ -349,6 +349,11 @@ samples, but their samples are discarded. An exception, rejection, timeout,
 abort, missing timing call, or duplicate timing call stops the current
 benchmark. Later benchmarks continue to run.
 
+After a timeout or abort, the runner briefly waits for asynchronous benchmark
+work to settle before continuing. If it remains pending, all later benchmarks
+that were selected to run fail without running so that their measurements
+cannot overlap with that work.
+
 For each warmup and measured callback, the runner subscribes to the configured
 diagnostics channels. Each publication queues a context diagnostic whose
 `message` is `{ name, message }`, containing the string channel name and the
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index 26d42dc17594..a4c8e20244cd 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -721,8 +721,9 @@ Both parallel tools support inline analysis. `scatter-node-bench.js --analyze`
 uses the same `--xaxis`, `--category`, and `--no-chart` interface described for
 `scatter.js`. `compare-node-bench.js --analyze` performs Welch's t-test, while
 `--max-regression N` adds a corrected regression gate. The gate requires both a
-Holm-Bonferroni-adjusted p-value below 0.05 and a 95% confidence interval lying
-entirely beyond `-N%`; the point estimate alone cannot fail the command.
+Holm-Bonferroni-adjusted one-sided p-value against the `N%` threshold below 0.05
+and a 95% confidence interval lying entirely beyond `-N%`; the point estimate
+alone cannot fail the command.
 Scatter analysis reduces aggregated configurations to one value per outer
 process and uses disjoint process sets for consecutive Mann-Whitney comparisons
 so configurations sharing a process are not treated as independent samples.
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
index c18f439f6719..985440634217 100644
--- a/lib/internal/bench_runner/harness.js
+++ b/lib/internal/bench_runner/harness.js
@@ -64,6 +64,7 @@ const {
 } = require('internal/bench_runner/benchmarks_stream');
 
 const { bigint: hrtime } = process.hrtime;
+const kCancellationGracePeriod = 100;
 const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
 const kIsCliRunner = getOptionValue('--bench');
 let nextRunId = 0;
@@ -76,6 +77,20 @@ function eventLoopTurn() {
   return new Promise((resolve) => setImmediate(resolve));
 }
 
+async function settlesPromptly(work) {
+  const timeout = PromiseWithResolvers();
+  const timer = setTimeout(
+    () => timeout.resolve(false), kCancellationGracePeriod);
+  try {
+    return await SafePromiseRace([
+      PromisePrototypeThen(work, () => true, () => true),
+      timeout.promise,
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 function createAbortError(signal) {
   return new AbortError(undefined, { __proto__: null, cause: signal.reason });
 }
@@ -86,6 +101,7 @@ function createTimeoutError(benchmark) {
 }
 
 class Harness {
+  #abortReason = null;
   #autoRun;
   #buildPromises = [];
   #duplicateErrors = new SafeMap();
@@ -581,6 +597,14 @@ class Harness {
   }
 
   async #executeSuite(suite) {
+    if (this.#abortReason !== null) {
+      await this.#completeSubtree(suite, this.#abortReason);
+      suite.finished = true;
+      suite.completion.resolve();
+      if (!suite.isRoot) suite.emitDestroy();
+      return;
+    }
+
     if (suite.buildError !== null) {
       await this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
       await this.#completeSubtree(suite, suite.buildError);
@@ -614,7 +638,7 @@ class Harness {
       }
     }
 
-    if (active) {
+    if (active && this.#abortReason === null) {
       const failure = await this.#runSuiteHooks(suite, 'after');
       if (failure !== null) {
         await this.#diagnostic(
@@ -711,6 +735,13 @@ class Harness {
       } catch {
         // Preserve the error that stopped benchmark execution.
       }
+      if (!await settlesPromptly(work) && this.#abortReason === null) {
+        this.#abortReason = new AbortError(
+          'The benchmark run was aborted because asynchronous work did not ' +
+          'settle after cancellation',
+          { __proto__: null, cause: error },
+        );
+      }
       throw error;
     } finally {
       if (timer !== undefined) clearTimeout(timer);
@@ -833,6 +864,7 @@ class Harness {
       return;
     }
 
+    if (this.#abortReason !== null) forcedError = this.#abortReason;
     if (forcedError !== undefined) {
       this.success = false;
       this.counts.failed++;
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
index b0774965a26f..891048d23881 100644
--- a/test/parallel/test-bench-errors.js
+++ b/test/parallel/test-bench-errors.js
@@ -27,14 +27,21 @@ bench('invalid operations', options, (b) => {
 bench('throws', options, () => {
   throw new Error('benchmark failure');
 });
-bench('timeout', { samples: 1, timeout: 10 }, async () => {
-  await new Promise(() => {});
-});
+let lateTimeoutActive = false;
 bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
-  b.start();
-  await setTimeout(30);
-  b.end(1);
+  lateTimeoutActive = true;
+  try {
+    b.start();
+    await setTimeout(30);
+    b.end(1);
+  } finally {
+    lateTimeoutActive = false;
+  }
 });
+bench('after late timeout', options, common.mustCall((b) => {
+  assert.strictEqual(lateTimeoutActive, false);
+  complete(b);
+}));
 
 const signal = AbortSignal.abort(new Error('stop'));
 bench('aborted', { samples: 1, signal }, () => {});
@@ -48,6 +55,11 @@ function complete(b) {
 bench('duplicate', { samples: 1, params: { value: 1 } }, complete);
 bench('duplicate', { samples: 1, params: { value: 1 } }, complete);
 bench('continues', options, complete);
+bench('timeout', { samples: 1, timeout: 10 }, async () => {
+  await new Promise(() => {});
+});
+bench('after unsettled timeout', options, common.mustNotCall());
+bench.skip('skipped after unsettled timeout', options, common.mustNotCall());
 
 const completions = [];
 const sampleNames = [];
@@ -57,13 +69,13 @@ stream.on('bench:complete', (result) => completions.push(result));
 stream.on('bench:sample', (sample) => sampleNames.push(sample.name));
 stream.on('bench:summary', (result) => { summary = result; });
 stream.on('end', common.mustCall(() => {
-  assert.strictEqual(completions.length, 13);
+  assert.strictEqual(completions.length, 16);
   assert.deepStrictEqual(summary.counts, {
     __proto__: null,
-    completed: 2,
-    failed: 11,
-    skipped: 0,
-    total: 13,
+    completed: 3,
+    failed: 12,
+    skipped: 1,
+    total: 16,
   });
   assert.strictEqual(summary.success, false);
 
@@ -92,12 +104,18 @@ stream.on('end', common.mustCall(() => {
                      'ERR_OPERATION_FAILED');
   assert.strictEqual(byName.get('late timeout')[0].error.code,
                      'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('after late timeout')[0].error, undefined);
   assert.strictEqual(byName.get('aborted')[0].error.code, 'ABORT_ERR');
 
   const duplicates = byName.get('duplicate');
   assert.strictEqual(duplicates[0].error, undefined);
   assert.match(duplicates[1].error.message, /duplicate benchmark identity/);
   assert.strictEqual(byName.get('continues')[0].error, undefined);
+  const unsettled = byName.get('after unsettled timeout')[0].error;
+  assert.strictEqual(unsettled.code, 'ABORT_ERR');
+  assert.strictEqual(unsettled.cause.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(
+    byName.get('skipped after unsettled timeout')[0].skip, true);
   setTimeout(40).then(common.mustCall(() => {
     assert.strictEqual(sampleNames.includes('late timeout'), false);
   }));
diff --git a/test/parallel/test-benchmark-node-bench-tools.js b/test/parallel/test-benchmark-node-bench-tools.js
index 90dd02028de3..3d248b45c0e3 100644
--- a/test/parallel/test-benchmark-node-bench-tools.js
+++ b/test/parallel/test-benchmark-node-bench-tools.js
@@ -9,6 +9,7 @@ const path = require('path');
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const {
+  analyzeCompare,
   analyzeScatter,
   holmAdjust,
   isRegressionFailure,
@@ -27,18 +28,51 @@ assert.deepStrictEqual(holmAdjust([0.01, 0.03, 0.04]), [0.03, 0.06, 0.06]);
 assert.strictEqual(isRegressionFailure({
   ci95: 3,
   improvement: -12,
-  pAdjusted: 0.01,
+  pThresholdAdjusted: 0.01,
 }, 10), false);
 assert.strictEqual(isRegressionFailure({
   ci95: 1,
   improvement: -12,
-  pAdjusted: 0.06,
+  pThresholdAdjusted: 0.06,
 }, 10), false);
 assert.strictEqual(isRegressionFailure({
   ci95: 1,
   improvement: -12,
-  pAdjusted: 0.01,
+  pThresholdAdjusted: 0.01,
 }, 10), true);
+
+function comparisonSamples(oldRates, newRates) {
+  const create = (binary, rate) => ({
+    binary,
+    configuration: '',
+    identity: 'comparison',
+    name: 'comparison',
+    rate,
+  });
+  return [
+    ...oldRates.map((rate) => create('old', rate)),
+    ...newRates.map((rate) => create('new', rate)),
+  ];
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [48, 49, 50, 50, 51, 52],
+  ), 1000, 0);
+  assert.strictEqual(result.failed, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted < 0.05, true);
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [93, 94, 95, 95, 96, 97],
+  ), 1000, 10);
+  assert.strictEqual(result.rows[0].pAdjusted < 0.05, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted > 0.05, true);
+  assert.strictEqual(result.failed, false);
+}
 assert.throws(
   () => analyzeScatter([{
     observation: 0,
@@ -221,7 +255,22 @@ function run(script, args, options = undefined) {
   assert.strictEqual(result.stderr, '');
   assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
   assert.match(result.stdout, /Holm-Bonferroni correction/);
-  assert.match(result.stdout, /--max-regression uses the corrected values/);
+  assert.match(result.stdout, /one-sided p-values against the 100% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--max-regression', '0',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /one-sided p-values against the 0% threshold/);
   assert.doesNotMatch(result.stdout, /"binary","filename"/);
 }
 

From d011d0a7017c73ce6dbd675bb45325d2f35ab77f Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Thu, 3 Sep 2026 18:25:38 +0000
Subject: [PATCH 094/202] lib: fixup node:bench handling of --require option

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 lib/internal/bench_runner/cli.js | 4 +++-
 test/parallel/test-bench-cli.js  | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
index 0cc4dc5210a1..5eaf0a317147 100644
--- a/lib/internal/bench_runner/cli.js
+++ b/lib/internal/bench_runner/cli.js
@@ -649,7 +649,9 @@ function filterExecArgv(arg, index, args) {
     !ArrayPrototypeSome(kFilterArgValues, (option) => {
       return name === option ||
         (option !== '--experimental-config-file' &&
-         index > 0 && getOptionName(args[index - 1]) === option);
+         index > 0 &&
+         StringPrototypeIndexOf(args[index - 1], '=') === -1 &&
+         getOptionName(args[index - 1]) === option);
     });
 }
 
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index 21090814f867..a2ac88eefbcf 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -570,9 +570,9 @@ for (const mode of ['callback', 'throw']) {
 
 {
   const result = spawnBench([
-    '--stack-trace-limit=17',
-    '--random-seed=17',
     '--bench-reporter=json',
+    '--random-seed=17',
+    '--stack-trace-limit=17',
     fixtures.path('bench-runner/v8-option.cjs'),
   ]);
   assert.strictEqual(result.status, 0);

From 57860ef5d4922aa830bea8e4f101f9e2d20d9351 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Thu, 3 Sep 2026 19:40:01 +0000
Subject: [PATCH 095/202] test: expand test coverage of node:bench

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65631
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 .../bench-runner/malformed-record.cjs         | 12 ++++
 test/fixtures/bench-runner/run-file.cjs       |  1 +
 test/parallel/test-bench-cli.js               | 18 ++++++
 test/parallel/test-bench-errors.js            |  9 ++-
 test/parallel/test-bench-harness-errors.js    | 45 ++++++++++++---
 test/parallel/test-bench-run-file.js          | 37 ++++++++++--
 test/parallel/test-bench-stream.js            | 56 ++++++++++++++++++-
 7 files changed, 161 insertions(+), 17 deletions(-)

diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
index 61de7d9b567a..3550694532f5 100644
--- a/test/fixtures/bench-runner/malformed-record.cjs
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -41,12 +41,24 @@ const record = kind === 'summary' ? {
     runId: process.env.NODE_BENCH_RUN_ID,
     success: true,
   },
+} : kind === 'name-path' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    namePath: [1],
+  },
 } : kind === 'plan' ? {
   ...plan,
   data: {
     ...plan.data,
     samples: 0,
   },
+} : kind === 'timeout' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    timeout: -1,
+  },
 } : kind === 'identity' ? {
   type: 'bench:complete',
   data: {
diff --git a/test/fixtures/bench-runner/run-file.cjs b/test/fixtures/bench-runner/run-file.cjs
index 382af4cc42f1..436665074b6b 100644
--- a/test/fixtures/bench-runner/run-file.cjs
+++ b/test/fixtures/bench-runner/run-file.cjs
@@ -7,6 +7,7 @@ bench('run file', {
   params: {
     context: process.env.NODE_BENCH_CONTEXT,
     exposed: typeof globalThis.gc === 'function',
+    omitted: process.env.NODE_BENCH_OMITTED === undefined,
     value: process.env.NODE_BENCH_RUN_FILE ?? 'unset',
   },
 }, (b) => {
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
index a2ac88eefbcf..8fd05375bb07 100644
--- a/test/parallel/test-bench-cli.js
+++ b/test/parallel/test-bench-cli.js
@@ -488,7 +488,9 @@ for (const { kind, message } of [
   { kind: 'sequence', message: /valid record sequence/ },
   { kind: 'record', message: /not a valid benchmark record/ },
   { kind: 'identity', message: /not a valid benchmark record/ },
+  { kind: 'name-path', message: /not a valid benchmark record/ },
   { kind: 'plan', message: /not a valid benchmark plan/ },
+  { kind: 'timeout', message: /not a valid benchmark plan/ },
   { kind: 'diagnostic', message: /not a valid benchmark diagnostic/ },
   { kind: 'diagnostic-order', message: /valid lifecycle sequence/ },
   { kind: 'summary', message: /not a valid benchmark summary/ },
@@ -525,6 +527,22 @@ for (const { kind, message } of [
   assert.strictEqual(records.at(-1).data.success, false);
 }
 
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)).data;
+  assert.strictEqual(diagnostic.entryFile, null);
+  assert.strictEqual(diagnostic.fileRunId, null);
+  assert.strictEqual(diagnostic.file, null);
+}
+
 for (const { mode, message } of [
   { mode: 'code', message: /failed with exit code 2/ },
   { mode: 'late', message: /failed with exit code 2/ },
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
index 891048d23881..2124720fee63 100644
--- a/test/parallel/test-bench-errors.js
+++ b/test/parallel/test-bench-errors.js
@@ -3,7 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { bench, run } = require('node:bench');
+const { bench, run, suite } = require('node:bench');
 const { setTimeout } = require('timers/promises');
 
 const options = { samples: 1 };
@@ -58,8 +58,11 @@ bench('continues', options, complete);
 bench('timeout', { samples: 1, timeout: 10 }, async () => {
   await new Promise(() => {});
 });
-bench('after unsettled timeout', options, common.mustNotCall());
-bench.skip('skipped after unsettled timeout', options, common.mustNotCall());
+const suiteCompletion = suite('after unsettled timeout suite', () => {
+  bench('after unsettled timeout', options, common.mustNotCall());
+  bench.skip('skipped after unsettled timeout', options, common.mustNotCall());
+});
+suiteCompletion.then(common.mustCall());
 
 const completions = [];
 const sampleNames = [];
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
index a5e01894c640..1cb0b505689f 100644
--- a/test/parallel/test-bench-harness-errors.js
+++ b/test/parallel/test-bench-harness-errors.js
@@ -62,17 +62,20 @@ async function testRunSignal() {
 async function testRunSignalAfterSample() {
   const runner = createRunner({ yieldBetweenSamples: false });
   const controller = new AbortController();
+  const reason = new Error('sample aborted');
   const completion = runner.bench('aborted after sample', {
-    samples: 1,
-  }, (b) => {
-    complete(b);
-    controller.abort(new Error('sample aborted'));
-  });
-  await runner.run({ signal: controller.signal }).toArray();
+    samples: 2,
+  }, complete);
+  const stream = runner.run({ signal: controller.signal });
+  stream.once('bench:sample', common.mustCall(() => {
+    controller.abort(reason);
+  }));
+  const records = await stream.toArray();
   const result = await completion;
-  await setImmediate();
   assert.strictEqual(result.error.code, 'ABORT_ERR');
-  assert.strictEqual(result.error.cause.message, 'sample aborted');
+  assert.strictEqual(result.error.cause, reason);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
 }
 
 async function testStringNamePattern() {
@@ -93,12 +96,15 @@ async function testStringNamePattern() {
 
 async function testTopLevelRecovery() {
   const runner = createRunner({ yieldBetweenSamples: false });
-  runner.bench('listener failure', { samples: 1 }, complete);
+  const suiteCompletion = runner.suite('nested', () => {
+    runner.bench('listener failure', { samples: 1 }, complete);
+  });
   const stream = runner.run();
   const failure = new Error();
   failure.message = undefined;
   stream.on('bench:start', common.mustCall(() => { throw failure; }));
   const records = await stream.toArray();
+  await suiteCompletion;
   const diagnostic = records.find(
     ({ type }) => type === 'bench:diagnostic').data;
   const summary = records.find(({ type }) => type === 'bench:summary').data;
@@ -110,10 +116,31 @@ async function testTopLevelRecovery() {
   assert.strictEqual(summary.success, false);
 }
 
+async function testRepeatedReportingFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const original = new Error('start listener failed');
+  const diagnostic = new Error('diagnostic listener failed');
+  const summary = new Error('summary listener failed');
+  const completion = runner.bench('reporting failures', {
+    samples: 1,
+  }, complete);
+  const stream = runner.run();
+  stream.on('bench:start', common.mustCall(() => { throw original; }));
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw diagnostic;
+  }, 2));
+  stream.on('bench:summary', common.mustCall(() => { throw summary; }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+  await ended;
+  assert.strictEqual((await completion).error, original);
+}
+
 (async () => {
   await testSynchronousSuiteFailure();
   await testRunSignal();
   await testRunSignalAfterSample();
   await testStringNamePattern();
   await testTopLevelRecovery();
+  await testRepeatedReportingFailure();
 })().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-file.js b/test/parallel/test-bench-run-file.js
index 600f1a212ae5..ec0265ab162c 100644
--- a/test/parallel/test-bench-run-file.js
+++ b/test/parallel/test-bench-run-file.js
@@ -29,9 +29,15 @@ assert.throws(() => runFile(fixture, { execArgv: [fixture] }), {
 assert.throws(() => runFile(fixture, { execArgv: ['-e', '0'] }), {
   code: 'ERR_INVALID_ARG_VALUE',
 });
+assert.throws(() => runFile(fixture, { execArgv: ['-e0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
 assert.throws(() => runFile(fixture, { execArgv: ['--require'] }), {
   code: 'ERR_INVALID_ARG_VALUE',
 });
+assert.throws(() => runFile(fixture, { execArgv: ['--require', ''] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
 assert.throws(() => runFile(fixture, { execArgv: ['--require='] }), {
   code: 'ERR_INVALID_ARG_VALUE',
 });
@@ -73,11 +79,12 @@ assert.throws(() => runFile(fixture, { signal: { aborted: false } }), {
 });
 
 async function testRunFile() {
-  const execArgv = ['--expose-gc', '-r', 'fs'];
+  const execArgv = ['--expose-gc', '--no-warnings', '-r', 'fs'];
   const env = {
     __proto__: null,
     ...process.env,
     NODE_BENCH_CONTEXT: 'not-a-child',
+    NODE_BENCH_OMITTED: undefined,
     NODE_BENCH_RUN_FILE: 'original',
     NODE_CHANNEL_FD: '999',
     NODE_CHANNEL_SERIALIZATION_MODE: 'json',
@@ -93,12 +100,14 @@ async function testRunFile() {
   assert.strictEqual(records.at(-1).type, 'bench:summary');
   assert.strictEqual(plan.params.context, 'child');
   assert.strictEqual(plan.params.exposed, true);
+  assert.strictEqual(plan.params.omitted, true);
   assert.strictEqual(plan.params.value, 'original');
   assert.strictEqual(result.error, undefined);
   assert.strictEqual(result.samples.length, 1);
   assert.strictEqual(typeof result.samples[0].duration_ns, 'bigint');
   assert.notStrictEqual(result.samples[0].detail.pid, process.pid);
   assert(result.samples[0].detail.execArgv.includes('--expose-gc'));
+  assert(result.samples[0].detail.execArgv.includes('--no-warnings'));
   assert(result.samples[0].detail.execArgv.includes('-r'));
   assert.strictEqual(summary.success, true);
   assert.strictEqual(summary.file, fixture);
@@ -258,13 +267,16 @@ async function testParentExitCode() {
 }
 
 async function testDefaultExecArgvSnapshot() {
-  const stream = runFile(fixture);
-  process.execArgv.push('--require=/does/not/exist.cjs');
+  const original = Array.from(process.execArgv);
   try {
+    process.execArgv.push('--bench', '--eval', 'throw new Error()');
+    const stream = runFile(fixture);
+    process.execArgv.push('--require=/does/not/exist.cjs');
     const records = await stream.toArray();
     assert.strictEqual(records.at(-1).data.success, true);
   } finally {
-    process.execArgv.pop();
+    process.execArgv.length = 0;
+    process.execArgv.push(...original);
   }
 }
 
@@ -280,6 +292,22 @@ async function testExecPathSnapshot() {
   }
 }
 
+async function testSpawnFailure() {
+  const execPath = process.execPath;
+  let stream;
+  try {
+    process.execPath = fixtures.path('does-not-exist-node');
+    stream = runFile(fixture);
+  } finally {
+    process.execPath = execPath;
+  }
+  const records = await stream.toArray();
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.error.code, 'ENOENT');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
 function testEvalParent() {
   const script = `
     require('node:bench').runFile(${JSON.stringify(fixture)})
@@ -394,6 +422,7 @@ async function testDestroy() {
   await testParentExitCode();
   await testDefaultExecArgvSnapshot();
   await testExecPathSnapshot();
+  await testSpawnFailure();
   await testPreAborted();
   await testDestroy();
   testEvalParent();
diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
index 11a7e0184a54..9a9eff7b2369 100644
--- a/test/parallel/test-bench-stream.js
+++ b/test/parallel/test-bench-stream.js
@@ -81,6 +81,34 @@ async function testPlanBackpressure() {
   );
 }
 
+async function testDestroyWhileBlocked() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completions = [];
+  for (let i = 0; i < 32; i++) {
+    completions.push(runner.bench(`destroyed ${i}`, {
+      samples: 1,
+    }, recordSample));
+  }
+  const stream = runner.run();
+  const unblocked = stream.waitForDrain();
+  const iterator = stream[Symbol.asyncIterator]();
+  await iterator.next();
+  await unblocked;
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+
+  const draining = stream.waitForDrain();
+  const closed = new Promise((resolve) => stream.once('close', resolve));
+  stream.destroy();
+  await assert.rejects(draining, { code: 'ERR_INVALID_STATE' });
+  await assert.rejects(stream.waitForDrain(), { code: 'ERR_INVALID_STATE' });
+  await closed;
+  await Promise.all(completions);
+}
+
 async function testNamedEventsWithoutReading() {
   const runner = createRunner();
   const sampleCount = 64;
@@ -192,7 +220,13 @@ async function testRecordOwnership() {
   expectedError.context = {
     note: 'preserved',
     callback() {},
+    get accessor() { return 'value'; },
+  };
+  expectedError.customContext = {
+    __proto__: {},
+    note: 'preserved',
   };
+  expectedError.arrayPayload = [new WeakMap()];
   const innerError = new Error('inner failure');
   innerError.code = 'ERR_INNER';
   const aggregate = new AggregateError([innerError], 'aggregate failure');
@@ -217,6 +251,16 @@ async function testRecordOwnership() {
   const caused = runner.bench('owned cause', { samples: 1 }, () => {
     throw causedError;
   });
+  const throwingNameError = new Error('throwing name');
+  Object.defineProperty(throwingNameError, 'name', {
+    configurable: true,
+    get() { throw new Error('name getter'); },
+  });
+  const throwingName = runner.bench('throwing name', {
+    samples: 1,
+  }, () => {
+    throw throwingNameError;
+  });
   const thrownValue = new WeakMap();
   const uncloneable = runner.bench('uncloneable error', {
     samples: 1,
@@ -265,6 +309,7 @@ async function testRecordOwnership() {
   const measuredResult = await measured;
   const failedResult = await failed;
   await caused;
+  const throwingNameResult = await throwingName;
   const uncloneableResult = await uncloneable;
   const trappedResult = await trapped;
   const afterTrapResult = await afterTrap;
@@ -278,6 +323,8 @@ async function testRecordOwnership() {
     ({ name }) => name === 'owned error');
   const streamCaused = streamResults.find(
     ({ name }) => name === 'owned cause');
+  const streamThrowingName = streamResults.find(
+    ({ name }) => name === 'throwing name');
   const streamSummary = records.find(
     ({ type }) => type === 'bench:summary').data;
 
@@ -299,12 +346,18 @@ async function testRecordOwnership() {
   assert.strictEqual(streamFailed.error.cause, streamFailed.error);
   assert.strictEqual(streamFailed.error.context.note, 'preserved');
   assert.strictEqual(streamFailed.error.context.callback, undefined);
+  assert.strictEqual(streamFailed.error.context.accessor, undefined);
+  assert.strictEqual(streamFailed.error.customContext.note, 'preserved');
+  assert.deepStrictEqual(streamFailed.error.arrayPayload, [undefined]);
   assert.strictEqual(failedResult.error, expectedError);
   assert.strictEqual(failedResult.error.code, 'ERR_EXPECTED');
   assert.strictEqual(failedResult.error.cause, failedResult.error);
   assert.strictEqual(uncloneableResult.error, thrownValue);
   assert.strictEqual(trappedResult.error, proxyError);
   assert.strictEqual(afterTrapResult.error, undefined);
+  assert.strictEqual(throwingNameResult.error, throwingNameError);
+  assert.strictEqual(streamThrowingName.error.name, 'Error');
+  assert.strictEqual(streamThrowingName.error.message, 'throwing name');
   assert(streamCaused.error.cause instanceof AggregateError);
   assert.strictEqual(streamCaused.error.cause.name, 'AggregateError');
   assert.strictEqual(streamCaused.error.cause.code, 'ERR_AGGREGATE');
@@ -313,12 +366,13 @@ async function testRecordOwnership() {
     streamCaused.error.references.get('self'), streamCaused.error);
   assert.strictEqual(streamCaused.error.members.has(streamCaused.error), true);
   assert.notStrictEqual(eventSummary, streamSummary);
-  assert.strictEqual(streamSummary.counts.total, 6);
+  assert.strictEqual(streamSummary.counts.total, 7);
 }
 
 (async () => {
   await testReadableBackpressure();
   await testPlanBackpressure();
+  await testDestroyWhileBlocked();
   await testNamedEventsWithoutReading();
   await testCancellationCompletesBenchmarks();
   await testDeliveryDoesNotConsumeTimeout();

From ad67159bea7202eac85440dafac98fad5cdd175d Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Sat, 5 Sep 2026 02:44:06 -0300
Subject: [PATCH 096/202] test: zero-fill buffers before the string length
 limit check

The test allocates a buffer one byte longer than MAX_STRING_LENGTH and
expects toString('utf8') to throw ERR_STRING_TOO_LONG. MAX_STRING_LENGTH
counts UTF-16 units rather than bytes, so that only holds if every byte
decodes to a single unit. For the two Buffer.allocUnsafe variants the
contents are whatever the allocator hands back, and a single multi-byte
UTF-8 sequence anywhere in the buffer decodes to fewer units than it
occupies bytes, bringing the result down to MAX_STRING_LENGTH or less
so that nothing is thrown.

This goes unnoticed when the allocator returns zeroed pages, which is
why the test passes elsewhere. The AIX builders expose non-zero
contents and fail with "Missing expected exception (Error)".

Refs: https://github.com/nodejs/reliability/issues/1649

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65755
Refs: https://github.com/nodejs/reliability/issues/1648
Refs: https://github.com/nodejs/reliability/issues/1649
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 test/parallel/test-buffer-tostring-rangeerror.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/parallel/test-buffer-tostring-rangeerror.js b/test/parallel/test-buffer-tostring-rangeerror.js
index b34f4c612618..856ed84d21cd 100644
--- a/test/parallel/test-buffer-tostring-rangeerror.js
+++ b/test/parallel/test-buffer-tostring-rangeerror.js
@@ -34,6 +34,12 @@ function test(getBuffer) {
       return;
     }
   }
+  // MAX_STRING_LENGTH counts UTF-16 units, not bytes. Uninitialized memory can
+  // hold multi-byte UTF-8 sequences, which decode to fewer units than they
+  // occupy bytes, and a single one of them is enough to bring the result down
+  // to MAX_STRING_LENGTH or less. ASCII bytes keep the decoded length equal to
+  // the buffer length.
+  buf.fill(0);
   assert.throws(() => { buf.toString('utf8'); }, message);
 }
 

From f344c8231122fc1c5d4f16faf84969ad9be5f047 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 5 Sep 2026 09:44:49 +0000
Subject: [PATCH 097/202] tools: bump browserslist from 4.28.4 to 4.28.8 in
 /tools/eslint

Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.4 to 4.28.8.
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.28.4...4.28.8)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.28.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65758
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 tools/eslint/package-lock.json | 46 +++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index 21d2d96163c7..6bcf29007668 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -744,9 +744,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.40",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
-      "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -768,9 +768,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
-      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "funding": [
         {
           "type": "opencollective",
@@ -787,11 +787,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.38",
-        "caniuse-lite": "^1.0.30001799",
-        "electron-to-chromium": "^1.5.376",
-        "node-releases": "^2.0.48",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -801,9 +801,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001800",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
-      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "funding": [
         {
           "type": "opencollective",
@@ -937,9 +937,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.383",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.383.tgz",
-      "integrity": "sha512-I2484/KkAvl8lm9VyjH2JnbOIV0d/UCqT7gbzs6l+o6Vmn9wgB66uVcKX+Vk6HrXtY6fbWTOEXuv8waDTuFNCw==",
+      "version": "1.5.420",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
+      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
       "license": "ISC"
     },
     "node_modules/empathic": {
@@ -2475,9 +2475,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.50",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
-      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -2828,9 +2828,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "funding": [
         {
           "type": "opencollective",

From 10516a80080e270f21513c939bc703e094daa16d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 5 Sep 2026 09:45:04 +0000
Subject: [PATCH 098/202] tools: bump @humanfs/node from 0.16.7 to 0.16.8 in
 /tools/eslint

Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8.
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/65757
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 tools/eslint/package-lock.json | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index 6bcf29007668..d9f1b6c5e682 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -459,27 +459,40 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",

From 2d2250529d88060464f90e552b7939d6d318b079 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 5 Sep 2026 12:42:52 +0200
Subject: [PATCH 099/202] crypto: add Hybrid KEMs to Web Cryptography

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65759
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 doc/api/webcrypto.md                          |   50 +-
 lib/internal/crypto/kem_hybrids.js            | 1173 +++++++++++++++++
 lib/internal/crypto/keys.js                   |   67 +-
 lib/internal/crypto/util.js                   |   40 +
 lib/internal/crypto/webcrypto.js              |   84 ++
 lib/internal/util/comparisons.js              |   18 +-
 src/crypto/README.md                          |    6 +-
 src/crypto/crypto_keys.cc                     |   99 +-
 src/crypto/crypto_keys.h                      |   38 +-
 src/crypto/crypto_util.h                      |    9 +
 .../webcrypto/supports-modern-algorithms.mjs  |   26 +
 .../test-crypto-key-objects-to-crypto-key.js  |    6 +-
 .../test-webcrypto-get-public-key.mjs         |    8 +
 test/parallel/test-webcrypto-kem-hybrids.js   |  689 ++++++++++
 ...-webcrypto-promise-prototype-pollution.mjs |   13 +
 test/parallel/test-webcrypto-supports.mjs     |    3 +
 typings/internalBinding/crypto.d.ts           |    6 +
 17 files changed, 2300 insertions(+), 35 deletions(-)
 create mode 100644 lib/internal/crypto/kem_hybrids.js
 create mode 100644 test/parallel/test-webcrypto-kem-hybrids.js

diff --git a/doc/api/webcrypto.md b/doc/api/webcrypto.md
index 6e2acacd5854..1d94af41363c 100644
--- a/doc/api/webcrypto.md
+++ b/doc/api/webcrypto.md
@@ -2,6 +2,9 @@
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
      - v25.9.0
      - v24.18.0
@@ -136,6 +139,9 @@ Algorithms:
 * `'ML-KEM-512'`[^openssl35]
 * `'ML-KEM-768'`[^openssl35]
 * `'ML-KEM-1024'`[^openssl35]
+* `'MLKEM768-P256'`[^openssl35]
+* `'MLKEM768-X25519'`[^openssl35]
+* `'MLKEM1024-P384'`[^openssl35]
 * `'SHA3-256'`
 * `'SHA3-384'`
 * `'SHA3-512'`
@@ -531,9 +537,10 @@ Crypto API implementation and the APIs supported for each:
   `'ECDSA'`, `'Ed25519'`, `'Ed448'`[^secure-curves],
   `'ML-DSA-44'`[^modern-algos], `'ML-DSA-65'`[^modern-algos],
   `'ML-DSA-87'`[^modern-algos], `'ML-KEM-512'`[^modern-algos],
-  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos], `'RSA-OAEP'`,
-  `'RSA-PSS'`, `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and
-  `'X448'`[^secure-curves].
+  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos],
+  `'MLKEM768-P256'`[^modern-algos], `'MLKEM768-X25519'`[^modern-algos],
+  `'MLKEM1024-P384'`[^modern-algos], `'RSA-OAEP'`, `'RSA-PSS'`,
+  `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and `'X448'`[^secure-curves].
 
 ### Crypto Operation APIs
 
@@ -553,8 +560,10 @@ Crypto API implementation and the APIs supported for each:
   `'ChaCha20-Poly1305'`[^modern-algos], and `'RSA-OAEP'`.
 * [`subtle.encapsulateBits()`][], [`subtle.decapsulateBits()`][],
   [`subtle.encapsulateKey()`][], and [`subtle.decapsulateKey()`][] support
-  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos], and
-  `'ML-KEM-1024'`[^modern-algos].
+  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos],
+  `'ML-KEM-1024'`[^modern-algos], `'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos].
 * [`subtle.digest()`][] supports `'cSHAKE128'`[^modern-algos],
   `'cSHAKE256'`[^modern-algos], `'KT128'`[^modern-algos],
   `'KT256'`[^modern-algos], `'SHA-1'`, `'SHA-256'`, `'SHA-384'`, `'SHA-512'`,
@@ -586,6 +595,10 @@ and [`subtle.exportKey()`][].
   `'ML-KEM-768'`[^modern-algos], and `'ML-KEM-1024'`[^modern-algos]** can be
   imported and exported using `'spki'`, `'pkcs8'`, `'jwk'`,
   `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
+* **`'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos]** can be imported and exported using
+  `'jwk'`, `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
 * **`'RSA-OAEP'`, `'RSA-PSS'`, and `'RSASSA-PKCS1-v1_5'`** can be imported
   and exported using `'spki'`, `'pkcs8'`, and `'jwk'`.
 
@@ -790,6 +803,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decapsulateKey(decapsulationAlgorithm, decapsulationKey, ciphertext, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -816,6 +832,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decrypt(algorithm, key, data)`
 
@@ -1014,6 +1033,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encapsulateKey(encapsulationAlgorithm, encapsulationKey, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -1038,6 +1060,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encrypt(algorithm, key, data)`
 
@@ -1076,6 +1101,9 @@ The algorithms currently supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
     - v26.1.0
     - v24.18.0
@@ -1142,6 +1170,9 @@ Derives the public key from a given private key.
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.8.0
     pr-url: https://github.com/nodejs/node/pull/59647
     description: KMAC algorithms are now supported.
@@ -1183,6 +1214,9 @@ include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
@@ -1206,6 +1240,9 @@ The {CryptoKey} (secret key) generating algorithms supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
     - v26.1.0
     - v24.18.0
@@ -1379,6 +1416,9 @@ The unwrapped key algorithms supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
diff --git a/lib/internal/crypto/kem_hybrids.js b/lib/internal/crypto/kem_hybrids.js
new file mode 100644
index 000000000000..6565b8dcae0a
--- /dev/null
+++ b/lib/internal/crypto/kem_hybrids.js
@@ -0,0 +1,1173 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  BigInt,
+  PromiseWithResolvers,
+  SafeSet,
+  TypedArrayOf,
+  TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeGetByteLength,
+  TypedArrayPrototypeGetLength,
+  TypedArrayPrototypeSet,
+  TypedArrayPrototypeSubarray,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+
+const {
+  getCryptoKeyExtractable,
+  getCryptoKeyAlgorithm,
+  getCryptoKeyHandle,
+  getCryptoKeySeedData,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeyType,
+  getCryptoKeyUsages,
+  InternalCryptoKey,
+} = require('internal/crypto/keys');
+
+const {
+  DHBitsJob,
+  KEMDecapsulateJob,
+  KEMEncapsulateJob,
+  KeyObjectHandle,
+  kCryptoJobWebCrypto,
+  kKeyFormatRawPrivate,
+  kKeyFormatRawPublic,
+  kKeyFormatRawSeed,
+  kKeyTypePrivate,
+  kKeyTypePublic,
+  timingSafeEqual,
+} = internalBinding('crypto');
+
+const {
+  crypto: {
+    POINT_CONVERSION_UNCOMPRESSED,
+  },
+} = internalBinding('constants');
+
+const {
+  getBufferSourceBytes,
+  getUsagesMask,
+  jobPromise,
+  jobPromiseThen,
+  resolveWebCryptoResult,
+} = require('internal/crypto/util');
+
+const {
+  lazyDOMException,
+  setOwnProperty,
+} = require('internal/util');
+
+const {
+  hash,
+} = require('internal/crypto/hash');
+
+const {
+  randomBytes,
+} = require('internal/crypto/random');
+
+const {
+  createKeyUsages,
+  getKeyPairUsages,
+  validateJwk,
+  validateKeyUsages,
+  validateUsagesNotEmpty,
+  verifyAcceptableKeyUse,
+} = require('internal/crypto/webcrypto_util');
+
+// Concrete PQ/T Hybrid KEM instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4
+// CG framework used by those instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.5
+
+const kKemPqSeedLength = 64;
+const kSeedLength = 32;
+const kX25519KeyLength = 32;
+const kP256KeyLength = 32;
+const kP384KeyLength = 48;
+const kEcPointPrefixLength = 1;
+const kEcUncompressedPointPrefix = 0x04;
+const kKemPq768EncapsulationKeyLength = 1184;
+const kKemPq768CiphertextLength = 1088;
+const kKemPq1024EncapsulationKeyLength = 1568;
+const kKemPq1024CiphertextLength = 1568;
+const kKemPq768Name = 'ML-KEM-768';
+const kKemPq1024Name = 'ML-KEM-1024';
+const kX25519Name = 'X25519';
+const kEcdhName = 'ECDH';
+const kEcKeyType = 'ec';
+const kP256Name = 'P-256';
+const kP384Name = 'P-384';
+// P-256 and P-384 group order constants are used by RandomScalar.
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-3.1.1
+// https://www.rfc-editor.org/rfc/rfc8017#section-4.2
+const kP256Order = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+const kP384Order = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973n;
+
+const kEncapsulationUsages = ['encapsulateKey', 'encapsulateBits'];
+const kDecapsulationUsages = ['decapsulateKey', 'decapsulateBits'];
+const kUsages = createKeyUsages(kEncapsulationUsages, kDecapsulationUsages);
+
+/**
+ * Adds lengths that are the concatenation of the PQ KEM component and the
+ * traditional group component.
+ * @param {object} config
+ * @returns {object}
+ */
+function withHybridLengths(config) {
+  return {
+    __proto__: null,
+    ...config,
+    encapsulationKeyLength:
+      config.kemPqEncapsulationKeyLength + config.groupElementLength,
+    ciphertextLength:
+      config.kemPqCiphertextLength + config.groupElementLength,
+  };
+}
+
+const kAlgorithms = {
+  '__proto__': null,
+  'MLKEM768-P256': withHybridLengths({
+    name: 'MLKEM768-P256',
+    kemPqName: kKemPq768Name,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP256Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP256KeyLength,
+    groupScalarLength: kP256KeyLength,
+    groupSeedLength: 4 * kP256KeyLength,
+    groupOrder: kP256Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36,
+      0x38, 0x2d, 0x50, 0x32, 0x35, 0x36, // "MLKEM768-P256"
+    ),
+  }),
+  'MLKEM768-X25519': withHybridLengths({
+    name: 'MLKEM768-X25519',
+    kemPqName: kKemPq768Name,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kX25519Name,
+    groupKeyType: kX25519Name,
+    // Curve25519 RandomScalar is identity and Exp is X25519.
+    // https://www.rfc-editor.org/rfc/rfc7748#section-5
+    groupElementLength: kX25519KeyLength,
+    groupScalarLength: kX25519KeyLength,
+    groupSeedLength: kX25519KeyLength,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c, // "\\.//^\\"
+    ),
+  }),
+  'MLKEM1024-P384': withHybridLengths({
+    name: 'MLKEM1024-P384',
+    kemPqName: kKemPq1024Name,
+    kemPqEncapsulationKeyLength: kKemPq1024EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq1024CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP384Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP384KeyLength,
+    groupScalarLength: kP384KeyLength,
+    groupSeedLength: kP384KeyLength,
+    groupOrder: kP384Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30,
+      0x32, 0x34, 0x2d, 0x50, 0x33, 0x38, 0x34, // "MLKEM1024-P384"
+    ),
+  }),
+};
+
+/**
+ * Wraps native or lower-level failures as WebCrypto OperationError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function operationFailure(cause) {
+  return lazyDOMException(
+    'The operation failed for an operation-specific reason',
+    { name: 'OperationError', cause });
+}
+
+/**
+ * Wraps native or lower-level failures as WebCrypto DataError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function dataFailure(cause) {
+  return lazyDOMException('Invalid keyData', { name: 'DataError', cause });
+}
+
+/**
+ * Copies supported BufferSource-like data into a new Uint8Array.
+ * @param {ArrayBuffer | ArrayBufferView} data
+ * @returns {Uint8Array}
+ */
+function copyBytes(data) {
+  return new Uint8Array(getBufferSourceBytes(data));
+}
+
+/**
+ * Concatenates byte arrays into a new Uint8Array of the expected length.
+ * @param {Uint8Array[]} chunks
+ * @param {number} length
+ * @returns {Uint8Array}
+ */
+function concatBytes(chunks, length) {
+  const output = new Uint8Array(length);
+  let offset = 0;
+  for (let n = 0; n < chunks.length; n++) {
+    const chunk = chunks[n];
+    TypedArrayPrototypeSet(output, chunk, offset);
+    offset += TypedArrayPrototypeGetByteLength(chunk);
+  }
+  return output;
+}
+
+/**
+ * Compares byte arrays by value.
+ * @param {Uint8Array} a
+ * @param {Uint8Array} b
+ * @returns {boolean}
+ */
+function bytesEqual(a, b) {
+  return TypedArrayPrototypeGetByteLength(a) === TypedArrayPrototypeGetByteLength(b) &&
+    timingSafeEqual(a, b);
+}
+
+/**
+ * Decodes a JWK base64url member.
+ * @param {string} input
+ * @returns {Uint8Array}
+ */
+function decodeJwkBase64Url(input) {
+  return Buffer.from(input, 'base64url');
+}
+
+/**
+ * Encodes JWK key material as unpadded base64url.
+ * @param {Uint8Array} input
+ * @returns {string}
+ */
+function base64urlEncode(input) {
+  return Buffer.from(input).toString('base64url');
+}
+
+/**
+ * Copies a Uint8Array's represented bytes into an ArrayBuffer result.
+ * @param {Uint8Array} data
+ * @returns {ArrayBuffer}
+ */
+function toArrayBuffer(data) {
+  return TypedArrayPrototypeGetBuffer(copyBytes(data));
+}
+
+/**
+ * Validates fixed-size key material.
+ * @param {Uint8Array} data
+ * @param {number} length
+ */
+function validateLength(data, length) {
+  if (TypedArrayPrototypeGetByteLength(data) !== length) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+}
+
+/**
+ * Splits bytes into the PQ KEM and traditional group portions.
+ * @param {Uint8Array} data
+ * @param {number} offset
+ * @returns {{ head: Uint8Array, tail: Uint8Array }}
+ */
+function splitAt(data, offset) {
+  return {
+    __proto__: null,
+    head: TypedArrayPrototypeSubarray(data, 0, offset),
+    tail: TypedArrayPrototypeSubarray(data, offset),
+  };
+}
+
+/**
+ * Splits a Hybrid KEM raw-public key into its PQ and group public-key parts.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitEncapsulationKey(rawEncapsulationKey, config) {
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  const { head, tail } = splitAt(
+    rawEncapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  return { __proto__: null, kemPq: head, group: tail };
+}
+
+/**
+ * Copies and splits a Hybrid KEM ciphertext into its PQ and group parts.
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitCiphertext(ciphertext, config) {
+  const ciphertextBuffer = copyBytes(ciphertext);
+  if (TypedArrayPrototypeGetByteLength(ciphertextBuffer) !==
+      config.ciphertextLength) {
+    throw operationFailure();
+  }
+  const { head, tail } = splitAt(
+    ciphertextBuffer,
+    config.kemPqCiphertextLength);
+  return { __proto__: null, kemPq: head, group: copyBytes(tail) };
+}
+
+/**
+ * Converts an octet string to a non-negative integer.
+ * @param {Uint8Array} data
+ * @returns {bigint}
+ */
+function os2ip(data) {
+  let value = 0n;
+  for (let n = 0; n < TypedArrayPrototypeGetLength(data); n++)
+    value = (value << 8n) | BigInt(data[n]);
+  return value;
+}
+
+/**
+ * Derives a valid traditional group scalar from expanded seed bytes.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function randomScalar(seed, config) {
+  if (config.groupOrder === undefined)
+    return copyBytes(seed);
+
+  const { groupOrder, groupScalarLength } = config;
+  for (let offset = 0;
+    offset + groupScalarLength <= TypedArrayPrototypeGetLength(seed);
+    offset += groupScalarLength) {
+    const scalar = copyBytes(
+      TypedArrayPrototypeSubarray(seed, offset, offset + groupScalarLength));
+    const value = os2ip(scalar);
+    if (value !== 0n && value < groupOrder)
+      return scalar;
+  }
+
+  throw operationFailure();
+}
+
+/**
+ * Imports raw key material into a native KeyObjectHandle.
+ * @param {number} keyType
+ * @param {Uint8Array} keyData
+ * @param {number} format
+ * @param {string} asymmetricKeyType
+ * @param {string} [namedCurve]
+ * @returns {KeyObjectHandle}
+ */
+function importRawKeyHandle(
+  keyType,
+  keyData,
+  format,
+  asymmetricKeyType,
+  namedCurve) {
+  const handle = new KeyObjectHandle();
+  handle.init(
+    keyType,
+    keyData,
+    format,
+    asymmetricKeyType,
+    null,
+    namedCurve ?? null);
+  if (asymmetricKeyType === kEcKeyType && !handle.checkEcKeyData())
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return handle;
+}
+
+/**
+ * Imports the PQ KEM decapsulation seed.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqDecapsulationHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawSeed,
+    config.kemPqName);
+}
+
+/**
+ * Imports the PQ KEM encapsulation key.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqEncapsulationHandle(rawEncapsulationKey, config) {
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    rawEncapsulationKey,
+    kKeyFormatRawPublic,
+    config.kemPqName);
+}
+
+/**
+ * Imports the traditional group private scalar.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupPrivateHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawPrivate,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Imports the traditional group public element.
+ * @param {Uint8Array} groupElement
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupElementHandle(groupElement, config) {
+  if (config.groupKeyType === kEcKeyType &&
+      groupElement[0] !== kEcUncompressedPointPrefix) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    groupElement,
+    kKeyFormatRawPublic,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Exports the raw public key bytes from the PQ KEM handle.
+ * @param {KeyObjectHandle} handle
+ * @returns {Uint8Array}
+ */
+function rawKemPqEncapsulationKey(handle) {
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Exports the raw public element from the traditional group handle.
+ * @param {KeyObjectHandle} handle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawGroupElement(handle, config) {
+  if (config.groupKeyType === kEcKeyType) {
+    return copyBytes(
+      handle.exportECPublicRaw(POINT_CONVERSION_UNCOMPRESSED));
+  }
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Builds the Hybrid KEM raw-public key from component public handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config) {
+  return concatBytes([
+    rawKemPqEncapsulationKey(kemPqHandle),
+    rawGroupElement(groupHandle, config),
+  ], config.encapsulationKeyLength);
+}
+
+/**
+ * Imports both components of a Hybrid KEM public key.
+ * @param {Uint8Array} kemPq
+ * @param {Uint8Array} group
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPublicKeyHandles(kemPq, group, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqEncapsulationHandle(kemPq, config),
+      groupHandle: importGroupElementHandle(group, config),
+    };
+  } catch (err) {
+    throw dataFailure(err);
+  }
+}
+
+/**
+ * Imports both components of a Hybrid KEM private key.
+ * @param {Uint8Array} seedPq
+ * @param {Uint8Array} groupSeed
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPrivateKeyHandles(seedPq, groupSeed, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqDecapsulationHandle(seedPq, config),
+      groupHandle: importGroupPrivateHandle(groupSeed, config),
+    };
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from imported component handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle);
+}
+
+/**
+ * Creates a Hybrid KEM private CryptoKey from imported component handles and seed.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPrivateKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  seed,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle,
+    seed);
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from concatenated raw-public bytes.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromRaw(
+  rawEncapsulationKey,
+  config,
+  extractable,
+  keyUsages) {
+  const { kemPq, group } = splitEncapsulationKey(rawEncapsulationKey, config);
+  const { kemPqHandle, groupHandle } =
+    importPublicKeyHandles(kemPq, group, config);
+
+  return createPublicKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    config,
+    extractable,
+    keyUsages);
+}
+
+/**
+ * Expands the 32-byte Hybrid KEM seed into PQ KEM seed and group seed material.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {{ seedPq: Uint8Array, groupSeed: Uint8Array }}
+ */
+function expandSeed(seed, config) {
+  validateLength(seed, kSeedLength);
+
+  // DeriveKeyPair(seed) expands seed into seed_PQ and seed_T.
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4.1
+  const expanded = copyBytes(hash('shake256', seed, {
+    outputEncoding: 'buffer',
+    outputLength: kKemPqSeedLength + config.groupSeedLength,
+  }));
+
+  const { head, tail } = splitAt(expanded, kKemPqSeedLength);
+  return {
+    __proto__: null,
+    seedPq: copyBytes(head),
+    groupSeed: randomScalar(tail, config),
+  };
+}
+
+/**
+ * Derives the Hybrid KEM private key and, when requested, the matching public key.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} decapsulationKeyUsages
+ * @param {Set<string> | string[]} [encapsulationKeyUsages]
+ * @returns {{ privateKey: InternalCryptoKey, publicKey?: InternalCryptoKey }}
+ */
+function deriveKeyPair(
+  seed,
+  config,
+  extractable,
+  decapsulationKeyUsages,
+  encapsulationKeyUsages) {
+  const { seedPq, groupSeed } = expandSeed(seed, config);
+  const { kemPqHandle, groupHandle } =
+    importPrivateKeyHandles(seedPq, groupSeed, config);
+
+  const privateKey = createPrivateKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    seed,
+    config,
+    extractable,
+    decapsulationKeyUsages);
+
+  if (encapsulationKeyUsages === undefined)
+    return { __proto__: null, privateKey };
+
+  const publicKey = createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(
+      kemPqHandle,
+      groupHandle,
+      config),
+    config,
+    true,
+    encapsulationKeyUsages);
+  return { __proto__: null, privateKey, publicKey };
+}
+
+/**
+ * Extracts both component handles stored in a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function getHybridKeyHandles(key) {
+  const kemPqHandle = getCryptoKeyHandle(key);
+  const groupHandle = getCryptoKeySecondaryHandle(key);
+  if (groupHandle === undefined) {
+    throw operationFailure();
+  }
+  return { __proto__: null, kemPqHandle, groupHandle };
+}
+
+/**
+ * Extracts and copies the stored 32-byte Hybrid KEM seed from a private key.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array}
+ */
+function getHybridSeed(key) {
+  const seed = getCryptoKeySeedData(key);
+  if (seed === undefined) {
+    throw operationFailure();
+  }
+  return copyBytes(seed);
+}
+
+/**
+ * Returns the algorithm config and component handles for a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {object}
+ */
+function getHybridKeyContext(key) {
+  const config = kAlgorithms[getCryptoKeyAlgorithm(key).name];
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(key);
+  return { __proto__: null, config, kemPqHandle, groupHandle };
+}
+
+/**
+ * Validates the CryptoKey type and returns its Hybrid KEM key context.
+ * @param {CryptoKey} key
+ * @param {'public' | 'private'} type
+ * @param {string} message
+ * @returns {object}
+ */
+function requireHybridKeyContext(key, type, message) {
+  if (getCryptoKeyType(key) !== type)
+    throw lazyDOMException(message, 'InvalidAccessError');
+  return getHybridKeyContext(key);
+}
+
+/**
+ * Runs ECDH/X25519 over the traditional group component.
+ * @param {KeyObjectHandle} publicHandle
+ * @param {KeyObjectHandle} privateHandle
+ * @returns {Promise<Uint8Array>}
+ */
+function deriveGroupBits(publicHandle, privateHandle) {
+  const bits = jobPromise(() => new DHBitsJob(
+    kCryptoJobWebCrypto,
+    publicHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    privateHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  return jobPromiseThen(
+    bits,
+    (bits) => copyBytes(bits),
+    (err) => { throw operationFailure(err); });
+}
+
+/**
+ * Applies the C2PRI combiner to the PQ and traditional shared secrets.
+ * @param {Uint8Array} sharedSecretPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {Uint8Array} ciphertextT
+ * @param {Uint8Array} encapsulationKey
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function combineSharedSecret(
+  sharedSecretPq,
+  sharedSecretT,
+  ciphertextT,
+  encapsulationKey,
+  config) {
+  // C2PRICombiner(ss_PQ, ss_T, ct_T, ek_T, Label).
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.1.3
+  const encapsulationKeyT = TypedArrayPrototypeSubarray(
+    encapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  const inputLength =
+    TypedArrayPrototypeGetByteLength(sharedSecretPq) +
+    TypedArrayPrototypeGetByteLength(sharedSecretT) +
+    TypedArrayPrototypeGetByteLength(ciphertextT) +
+    TypedArrayPrototypeGetByteLength(encapsulationKeyT) +
+    TypedArrayPrototypeGetByteLength(config.label);
+
+  const input = concatBytes([
+    sharedSecretPq,
+    sharedSecretT,
+    ciphertextT,
+    encapsulationKeyT,
+    config.label,
+  ], inputLength);
+
+  return copyBytes(hash('sha3-256', input, {
+    outputEncoding: 'buffer',
+  }));
+}
+
+/**
+ * Splits requested Hybrid KEM key usages into private and public key usages.
+ * @param {string} name
+ * @param {string[]} keyUsages
+ * @returns {{ privateUsages: Set<string>, publicUsages: Set<string> }}
+ */
+function getGenerateKeyUsages(name, keyUsages) {
+  const usageSet = validateKeyUsages(keyUsages, kUsages.keygen, name);
+  const usages = getKeyPairUsages(usageSet, kUsages);
+  validateUsagesNotEmpty(usages.private);
+
+  return {
+    __proto__: null,
+    privateUsages: usages.private,
+    publicUsages: usages.public,
+  };
+}
+
+/**
+ * Imports a Hybrid KEM JWK, validating public/private consistency when `priv`
+ * is present.
+ * @param {object} input
+ * @param {string} name
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string>} usagesSet
+ * @returns {InternalCryptoKey}
+ */
+function importJwkKey(input, name, config, extractable, usagesSet) {
+  const isPublic = input.priv === undefined;
+  verifyAcceptableKeyUse(
+    name,
+    usagesSet,
+    isPublic ? kUsages.public : kUsages.private);
+  validateJwk(input, 'AKP', extractable, usagesSet, 'enc');
+  if (input.alg !== name) {
+    throw lazyDOMException(
+      'JWK "alg" Parameter and algorithm name mismatch',
+      'DataError');
+  }
+
+  const rawEncapsulationKey = decodeJwkBase64Url(input.pub);
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  if (isPublic) {
+    return createPublicKeyFromRaw(
+      rawEncapsulationKey,
+      config,
+      extractable,
+      usagesSet);
+  }
+
+  const { privateKey } = deriveKeyPair(
+    decodeJwkBase64Url(input.priv),
+    config,
+    extractable,
+    usagesSet);
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(privateKey);
+  const derivedRawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  if (!bytesEqual(derivedRawEncapsulationKey, rawEncapsulationKey))
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return privateKey;
+}
+
+/**
+ * Exports a Hybrid KEM key as an AKP JWK.
+ * @param {CryptoKey} key
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {object}
+ */
+function exportJwkKey(key, rawEncapsulationKey, config) {
+  const jwk = {
+    kty: 'AKP',
+    alg: config.name,
+    pub: base64urlEncode(rawEncapsulationKey),
+    key_ops: ArrayPrototypeSlice(getCryptoKeyUsages(key), 0),
+    ext: getCryptoKeyExtractable(key),
+  };
+  if (getCryptoKeyType(key) === 'private')
+    setOwnProperty(jwk, 'priv', base64urlEncode(getHybridSeed(key)));
+  return jwk;
+}
+
+/**
+ * Implements generateKey for Hybrid KEM algorithms.
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {{ publicKey: InternalCryptoKey, privateKey: InternalCryptoKey }}
+ */
+function kemHybridGenerateKey(algorithm, extractable, keyUsages) {
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const { privateUsages, publicUsages } =
+    getGenerateKeyUsages(name, keyUsages);
+
+  const keyPair = deriveKeyPair(
+    copyBytes(randomBytes(kSeedLength)),
+    config,
+    extractable,
+    privateUsages,
+    publicUsages);
+  return { publicKey: keyPair.publicKey, privateKey: keyPair.privateKey };
+}
+
+/**
+ * Implements importKey for Hybrid KEM algorithms.
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @param {ArrayBuffer | ArrayBufferView | object} input
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey | undefined}
+ */
+function kemHybridImportKey(
+  format,
+  input,
+  algorithm,
+  extractable,
+  keyUsages) {
+
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const usagesSet = new SafeSet(keyUsages);
+
+  switch (format) {
+    case 'raw-public': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.public);
+      return createPublicKeyFromRaw(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet);
+    }
+    case 'raw-seed': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.private);
+      return deriveKeyPair(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet).privateKey;
+    }
+    case 'jwk':
+      return importJwkKey(input, name, config, extractable, usagesSet);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements exportKey for Hybrid KEM algorithms.
+ * @param {CryptoKey} key
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @returns {ArrayBuffer | object | undefined}
+ */
+function kemHybridExportKey(key, format) {
+  const { config, kemPqHandle, groupHandle } = getHybridKeyContext(key);
+  const rawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  switch (format) {
+    case 'raw-public':
+      return toArrayBuffer(rawEncapsulationKey);
+    case 'raw-seed':
+      if (getCryptoKeyType(key) === 'private') {
+        return toArrayBuffer(getHybridSeed(key));
+      }
+      return undefined;
+    case 'jwk':
+      return exportJwkKey(key, rawEncapsulationKey, config);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements getPublicKey for Hybrid KEM private keys.
+ * @param {CryptoKey} privateKey
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function kemHybridGetPublicKey(privateKey, keyUsages) {
+  const { config, kemPqHandle, groupHandle } =
+    getHybridKeyContext(privateKey);
+  const usageSet = new SafeSet(keyUsages);
+  verifyAcceptableKeyUse(config.name, usageSet, kUsages.public);
+  return createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+    config,
+    true,
+    usageSet);
+}
+
+/**
+ * Generates the ephemeral traditional group private key for encapsulation.
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function generateEphemeralGroupScalar(config) {
+  const seed = randomScalar(
+    copyBytes(randomBytes(config.groupSeedLength)),
+    config);
+  return importGroupPrivateHandle(seed, config);
+}
+
+/**
+ * Continues a WebCrypto job promise and routes synchronous continuation
+ * failures to the provided reject callback.
+ * @param {Promise} promise
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function continueJob(promise, reject, onFulfilled) {
+  jobPromiseThen(promise, (value) => {
+    try {
+      onFulfilled(value);
+    } catch (err) {
+      reject(err);
+    }
+  }, reject);
+}
+
+/**
+ * Continues a WebCrypto job promise and resolves with WebCrypto result
+ * shielding for object results.
+ * @param {Promise} promise
+ * @param {Function} resolve
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function resolveJob(promise, resolve, reject, onFulfilled) {
+  continueJob(promise, reject, (value) => {
+    resolveWebCryptoResult(resolve, onFulfilled(value));
+  });
+}
+
+/**
+ * Prepares the traditional group side of encapsulation and starts its derive job.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {object}
+ */
+function prepareEncapsulationGroup(kemPqHandle, groupHandle, config) {
+  const ephemeralGroupHandle = generateEphemeralGroupScalar(config);
+  const ciphertextT = rawGroupElement(ephemeralGroupHandle, config);
+  const sharedSecretT = deriveGroupBits(
+    groupHandle,
+    ephemeralGroupHandle);
+  return {
+    __proto__: null,
+    ciphertextT,
+    sharedSecretT,
+    rawEncapsulationKey:
+      rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+  };
+}
+
+/**
+ * Combines the PQ and traditional encapsulation outputs into WebCrypto's
+ * encapsulation result object.
+ * @param {object} encapsPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {object} group
+ * @param {object} config
+ * @returns {{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }}
+ */
+function hybridEncapsulationResult(encapsPq, sharedSecretT, group, config) {
+  const sharedKey = combineSharedSecret(
+    copyBytes(encapsPq.sharedKey),
+    sharedSecretT,
+    group.ciphertextT,
+    group.rawEncapsulationKey,
+    config);
+  const ciphertext = concatBytes([
+    copyBytes(encapsPq.ciphertext),
+    group.ciphertextT,
+  ], config.ciphertextLength);
+
+  return {
+    sharedKey: toArrayBuffer(sharedKey),
+    ciphertext: toArrayBuffer(ciphertext),
+  };
+}
+
+/**
+ * Imports the traditional group ciphertext component as a public key handle.
+ * @param {Uint8Array} ciphertextT
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importCiphertextGroupHandle(ciphertextT, config) {
+  try {
+    return importGroupElementHandle(ciphertextT, config);
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Implements encapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} encapsulationKey
+ * @returns {Promise<{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }>}
+ */
+function kemHybridEncaps(encapsulationKey) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    encapsulationKey,
+    'public',
+    'Key must be a public key');
+  const encapsPq = jobPromise(() => new KEMEncapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(encapsPq, reject, (encapsPq) => {
+    const group = prepareEncapsulationGroup(
+      kemPqHandle,
+      groupHandle,
+      config);
+    resolveJob(group.sharedSecretT, resolve, reject, (sharedSecretT) =>
+      hybridEncapsulationResult(encapsPq, sharedSecretT, group, config));
+  });
+
+  return promise;
+}
+
+/**
+ * Implements decapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} decapsulationKey
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @returns {Promise<ArrayBuffer>}
+ */
+function kemHybridDecaps(decapsulationKey, ciphertext) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    decapsulationKey,
+    'private',
+    'Key must be a private key');
+  const { kemPq: ciphertextPq, group: ciphertextT } =
+    splitCiphertext(ciphertext, config);
+  const groupPublicHandle =
+    importCiphertextGroupHandle(ciphertextT, config);
+
+  const sharedSecretPq = jobPromise(() => new KEMDecapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    ciphertextPq));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(sharedSecretPq, reject, (sharedSecretPq) => {
+    const sharedSecretT = deriveGroupBits(
+      groupPublicHandle,
+      groupHandle);
+    resolveJob(sharedSecretT, resolve, reject, (sharedSecretT) =>
+      toArrayBuffer(combineSharedSecret(
+        copyBytes(sharedSecretPq),
+        sharedSecretT,
+        ciphertextT,
+        rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+        config)));
+  });
+
+  return promise;
+}
+
+module.exports = {
+  kemHybridDecaps,
+  kemHybridEncaps,
+  kemHybridExportKey,
+  kemHybridGenerateKey,
+  kemHybridGetPublicKey,
+  kemHybridImportKey,
+};
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 1623825b5273..152db0a5f5d1 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -202,6 +202,12 @@ const {
           key,
           'must be an extractable CryptoKey');
       }
+      if (getCryptoKeySecondaryHandle(key) !== undefined) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'key',
+          key,
+          'cannot be represented by a single KeyObject');
+      }
       const handle = getCryptoKeyHandle(key);
       switch (getCryptoKeyType(key)) {
         /* eslint-disable no-use-before-define */
@@ -1045,7 +1051,9 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 
 // CryptoKey is a plain JS class whose prototype's [[Prototype]] is
 // Object.prototype, as Web Crypto requires. Instance storage (type enum,
-// extractable, algorithm, usages mask, and the KeyObject handle) lives
+// extractable, algorithm, usages mask, the primary KeyObject handle, an
+// optional Hybrid KEM-only secondary KeyObject handle, and optional Hybrid
+// KEM-only seed data) lives
 // on a C++ class, NativeCryptoKey, created by createCryptoKeyClass.
 // InternalCryptoKey is the only constructor we expose to internal
 // code; it extends NativeCryptoKey to get that storage and then has
@@ -1054,12 +1062,12 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 //            -> CryptoKey.prototype
 //            -> Object.prototype
 //
-// Normal construction caches all five internal slots in a private class
+// Normal construction caches all native internal slots in a private class
 // field on `InternalCryptoKey`. Partially initialized transferred keys read
 // them from C++ in a single `getCryptoKeySlots` call on first access. The
 // cache is invisible to reflection (`Object.getOwnPropertySymbols` etc.) and
-// leaves each CryptoKey's hidden class pristine. The `getCryptoKey{Type,
-// Extractable,Algorithm,Usages,Handle}` helpers index into that
+// CryptoKey's hidden class pristine. The `getCryptoKey{Type,Extractable,
+// Algorithm,Usages,Handle,SecondaryHandle,SeedData}` helpers index into that
 // array and convert native enums/masks back to Web Crypto strings.
 // The internal algorithm object is stored as a null-prototype clone
 // so it cannot observe polluted Object.prototype properties.
@@ -1075,9 +1083,11 @@ const kSlotExtractable = 1;
 const kSlotAlgorithm = 2;
 const kSlotUsagesMask = 3;
 const kSlotHandle = 4;
-const kSlotClonedAlgorithm = 5;
-const kSlotClonedUsages = 6;
-const kSlotUsages = 7;
+const kSlotSecondaryHandle = 5;
+const kSlotSeedData = 6;
+const kSlotClonedAlgorithm = 7;
+const kSlotClonedUsages = 8;
+const kSlotUsages = 9;
 
 function cloneAlgorithm(raw) {
   const cloned = { ...raw };
@@ -1163,10 +1173,24 @@ const {
   class InternalCryptoKey extends NativeCryptoKey {
     #slots;
 
-    constructor(handle, algorithm, usagesMask, extractable) {
+    constructor(
+      handle,
+      algorithm,
+      usagesMask,
+      extractable,
+      secondaryHandle,
+      seedData) {
       if (algorithm !== undefined)
         algorithm = cloneInternalAlgorithm(algorithm);
-      super(handle, algorithm, usagesMask, extractable);
+      if (seedData !== undefined)
+        seedData = new Uint8Array(seedData);
+      super(
+        handle,
+        algorithm,
+        usagesMask,
+        extractable,
+        secondaryHandle,
+        seedData);
       if (algorithm !== undefined) {
         this.#slots = [
           handle.getKeyType(),
@@ -1174,6 +1198,8 @@ const {
           algorithm,
           usagesMask,
           handle,
+          secondaryHandle,
+          seedData,
         ];
       }
     }
@@ -1192,6 +1218,8 @@ const {
         }
         const slots = nativeGetCryptoKeySlots(key);
         slots[kSlotAlgorithm] = cloneInternalAlgorithm(slots[kSlotAlgorithm]);
+        if (slots[kSlotSeedData] !== undefined)
+          slots[kSlotSeedData] = new Uint8Array(slots[kSlotSeedData]);
         key.#slots = slots;
         return slots;
       };
@@ -1312,6 +1340,25 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
+/**
+ * Returns the optional Hybrid KEM-only secondary KeyObjectHandle wrapping a
+ * CryptoKey's other underlying key material.
+ * @param {CryptoKey} key
+ * @returns {KeyObjectHandle | undefined}
+ */
+function getCryptoKeySecondaryHandle(key) {
+  return getSlots(key)[kSlotSecondaryHandle];
+}
+
+/**
+ * Returns the optional Hybrid KEM-only seed data stored with a CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array | undefined}
+ */
+function getCryptoKeySeedData(key) {
+  return getSlots(key)[kSlotSeedData];
+}
+
 function importGenericSecretKey(
   algorithm,
   format,
@@ -1387,5 +1434,7 @@ module.exports = {
   getCryptoKeyUsagesMask,
   hasCryptoKeyUsage,
   getCryptoKeyHandle,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeySeedData,
   importGenericSecretKey,
 };
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index c408f26e5a9f..ca1d68b5127b 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -429,6 +429,30 @@ const kAlgorithmDefinitions = {
     'decapsulate': null,
     'get shared key length': null,
   },
+  'MLKEM768-P256': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM768-X25519': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM1024-P384': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
   'PBKDF2': {
     'importKey': null,
     'deriveBits': 'Pbkdf2Params',
@@ -499,6 +523,18 @@ const conditionalAlgorithms = {
   'ML-KEM-512': !!EVP_PKEY_ML_KEM_512,
   'ML-KEM-768': !!EVP_PKEY_ML_KEM_768,
   'ML-KEM-1024': !!EVP_PKEY_ML_KEM_1024,
+  'MLKEM768-P256': !isFips && !!EVP_PKEY_ML_KEM_768 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM768-X25519': !isFips && !!EVP_PKEY_ML_KEM_768 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM1024-P384': !isFips && !!EVP_PKEY_ML_KEM_1024 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
   'SHA3-256': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-256'),
   'SHA3-384': !process.features.openssl_is_boringssl ||
@@ -528,6 +564,9 @@ const experimentalAlgorithms = [
   'ML-KEM-512',
   'ML-KEM-768',
   'ML-KEM-1024',
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
   'SHA3-256',
   'SHA3-384',
   'SHA3-512',
@@ -1173,6 +1212,7 @@ module.exports = {
   cleanupWebCryptoResult,
   prepareWebCryptoResult,
   validateKmacKeyLength,
+  resolveWebCryptoResult,
   validateMaxBufferLength,
   numBitsToBytes,
   truncateToBitLength,
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index f8a1ef8d00e7..e61ff3d47dd4 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -239,6 +239,13 @@ function generateKeyImpl(
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemGenerateKey(normalizedAlgorithm, extractable, usages);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGenerateKey(normalizedAlgorithm, extractable, usages);
     case 'KMAC128':
       // Fall through
     case 'KMAC256':
@@ -355,6 +362,12 @@ function getSharedKeyLength({ name }) {
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
+      // Fall through
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
       return 256;
     /* c8 ignore start */
     default: {
@@ -617,6 +630,17 @@ function exportKeyRawPublic(key, format) {
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
     }
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384': {
+      if (format !== 'raw-public') {
+        return undefined;
+      }
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, format);
+    }
     default:
       return undefined;
   }
@@ -638,6 +662,13 @@ function exportKeyRawSeed(key) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'raw-seed');
     default:
       return undefined;
   }
@@ -713,6 +744,13 @@ function exportKeyJWK(key) {
       // Fall through
     case 'ML-KEM-1024':
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'jwk');
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -1032,6 +1070,14 @@ function importKeySync(format, keyData, algorithm, extractable, usages) {
           extractable,
           usages);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      result = require('internal/crypto/kem_hybrids')
+        .kemHybridImportKey(format, keyData, algorithm, extractable, usages);
+      break;
   }
 
   if (!result) {
@@ -1412,6 +1458,14 @@ function getPublicKeyImpl(key, keyUsages) {
     throw lazyDOMException('key must be a private key',
                            type === 'secret' ? 'NotSupportedError' : 'InvalidAccessError');
 
+  switch (getCryptoKeyAlgorithm(key).name) {
+    case 'MLKEM768-P256':
+    case 'MLKEM768-X25519':
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGetPublicKey(key, usages);
+  }
+
   return toPublicCryptoKey(key, usages);
 }
 
@@ -1451,6 +1505,13 @@ function encapsulateBitsImpl(encapsulationAlgorithm, encapsulationKey) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1515,6 +1576,14 @@ function encapsulateKeyImpl(
       encapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      encapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1578,6 +1647,13 @@ function decapsulateBitsImpl(decapsulationAlgorithm, decapsulationKey, ciphertex
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1645,6 +1721,14 @@ function decapsulateKeyImpl(
       decapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      decapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 92594e8994fb..3fa6081cb366 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -129,6 +129,8 @@ let getCryptoKeyType;
 let getCryptoKeyExtractable;
 let getCryptoKeyAlgorithm;
 let getCryptoKeyUsagesMask;
+let getCryptoKeySecondaryHandle;
+let getCryptoKeySeedData;
 let getKeyObjectHandle;
 let getKeyObjectType;
 
@@ -429,14 +431,28 @@ function objectComparisonStart(val1, val2, mode, memos) {
         getCryptoKeyExtractable,
         getCryptoKeyAlgorithm,
         getCryptoKeyUsagesMask,
+        getCryptoKeySecondaryHandle,
+        getCryptoKeySeedData,
       } = require('internal/crypto/keys'));
     }
+    const val1SecondaryHandle = getCryptoKeySecondaryHandle(val1);
+    const val2SecondaryHandle = isCryptoKey(val2) ?
+      getCryptoKeySecondaryHandle(val2) : undefined;
+    const val1SeedData = getCryptoKeySeedData(val1);
+    const val2SeedData = isCryptoKey(val2) ?
+      getCryptoKeySeedData(val2) : undefined;
     if (!isCryptoKey(val2) ||
       getCryptoKeyType(val1) !== getCryptoKeyType(val2) ||
       getCryptoKeyExtractable(val1) !== getCryptoKeyExtractable(val2) ||
       !innerDeepEqual(getCryptoKeyAlgorithm(val1), getCryptoKeyAlgorithm(val2), mode, memos) ||
       getCryptoKeyUsagesMask(val1) !== getCryptoKeyUsagesMask(val2) ||
-      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2))
+      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2)) ||
+      (val1SecondaryHandle === undefined) !== (val2SecondaryHandle === undefined) ||
+      (val1SecondaryHandle !== undefined &&
+        !val1SecondaryHandle.equals(val2SecondaryHandle)) ||
+      (val1SeedData === undefined) !== (val2SeedData === undefined) ||
+      (val1SeedData !== undefined &&
+        !innerDeepEqual(val1SeedData, val2SeedData, mode, memos))
     ) {
       return false;
     }
diff --git a/src/crypto/README.md b/src/crypto/README.md
index d3c1016e94a5..7bc4dbe4e148 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -184,12 +184,14 @@ cache.
 
 A `CryptoKey` is the Web Crypto API key type. In the Node.js implementation,
 public `CryptoKey` instances are backed by a native `NativeCryptoKey`, not by
-a `KeyObject`. `NativeCryptoKey` stores the same `KeyObjectData`
+a `KeyObject`. `NativeCryptoKey` stores the same primary `KeyObjectData`
 representation as `KeyObject`, plus the Web Crypto internal slots
 (`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`). Normal construction
 primes a private JavaScript slot cache from the constructor arguments.
 Partially initialized transferred keys populate that cache from the native
-slots on first access.
+slots on first access. For Hybrid KEM `CryptoKey` instances only,
+`NativeCryptoKey` may also store a secondary `KeyObjectData` and `seed_data`
+used to reconstruct the hybrid key material.
 
 ### X.509 certificates
 
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index 2d80caf76661..49f3128f1fa0 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -1913,11 +1913,15 @@ MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
 
 void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 4);
+  CHECK_GE(args.Length(), 4);
+  CHECK_LE(args.Length(), 6);
   // args[0] is a KeyObjectHandle; we keep its KeyObjectData directly.
   // args[1] is the algorithm dictionary object.
   // args[2] is the usages mask.
   // args[3] is the extractable boolean.
+  // args[4], when present, is an optional secondary KeyObjectHandle for
+  // Hybrid KEM CryptoKeys.
+  // args[5], when present, is optional seed_data for Hybrid KEM CryptoKeys.
   //
   // args[1] is undefined only when called from
   // CryptoKeyTransferData::Deserialize for a partially-initialized
@@ -1931,7 +1935,24 @@ void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   KeyObjectHandle* handle = Unwrap<KeyObjectHandle>(args[0].As<Object>());
   CHECK_NOT_NULL(handle);
 
-  auto* native = new NativeCryptoKey(env, args.This(), handle->Data());
+  KeyObjectData secondary_data;
+  if (args.Length() >= 5 && !args[4]->IsUndefined()) {
+    CHECK(KeyObjectHandle::HasInstance(env, args[4]));
+    KeyObjectHandle* secondary_handle =
+        Unwrap<KeyObjectHandle>(args[4].As<Object>());
+    CHECK_NOT_NULL(secondary_handle);
+    secondary_data = secondary_handle->Data();
+  }
+
+  ByteSource seed_data;
+  if (args.Length() == 6 && !args[5]->IsUndefined()) {
+    CHECK(IsAnyBufferSource(args[5]));
+    ArrayBufferOrViewContents<char> buf(args[5]);
+    seed_data = buf.ToCopy();
+  }
+
+  auto* native = new NativeCryptoKey(
+      env, args.This(), handle->Data(), secondary_data, std::move(seed_data));
 
   if (!args[1]->IsUndefined()) {
     CHECK(args[1]->IsObject());
@@ -1979,9 +2000,10 @@ void NativeCryptoKey::CreateCryptoKeyClass(
 }
 
 // Returns all of the key's internal slot values as a single Array:
-// [type enum, extractable, algorithm, usages mask, handle]. JS-side helpers
-// call this once per key to prime a per-instance cache, so subsequent
-// reads don't need to cross into C++ at all.
+// [type enum, extractable, algorithm, usages mask, handle, secondary handle,
+// seed data]. JS-side helpers call this once per key to prime a per-instance
+// cache, so subsequent reads don't need to cross into C++ at all. The
+// secondary handle and seed data slots are only used by Hybrid KEM CryptoKeys.
 void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -1998,15 +2020,38 @@ void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (native->secondary_handle_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, native->secondary_handle_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return;
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (native->seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(
+             env, native->seed_data_.data<char>(), native->seed_data_.size())
+             .ToLocal(&buf)) {
+      return;
+    }
+    seed_data = buf;
+  }
+
   Local<Value> algorithm = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm->IsObject());
-  Isolate* isolate = env->isolate();
   Local<Value> slots[] = {
       Uint32::NewFromUnsigned(isolate, native->handle_data_.GetKeyType()),
       v8::Boolean::New(isolate, native->extractable_),
       algorithm,
       Uint32::NewFromUnsigned(isolate, native->usages_mask_),
       handle,
+      secondary_handle,
+      seed_data,
   };
   args.GetReturnValue().Set(Array::New(isolate, slots, arraysize(slots)));
 }
@@ -2022,8 +2067,12 @@ std::unique_ptr<worker::TransferData> NativeCryptoKey::CloneForMessaging()
   Local<Value> algorithm_v = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm_v->IsObject());
   v8::Global<Object> algorithm_copy(isolate, algorithm_v.As<Object>());
-  return std::make_unique<CryptoKeyTransferData>(
-      handle_data_, std::move(algorithm_copy), usages_mask_, extractable_);
+  return std::make_unique<CryptoKeyTransferData>(handle_data_,
+                                                 secondary_handle_data_,
+                                                 seed_data_.ToCopy(),
+                                                 std::move(algorithm_copy),
+                                                 usages_mask_,
+                                                 extractable_);
 }
 
 Maybe<void> NativeCryptoKey::FinalizeTransferRead(
@@ -2103,9 +2152,29 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
   Local<Object> handle;
   if (!KeyObjectHandle::Create(env, data_).ToLocal(&handle)) return {};
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (secondary_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, secondary_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return {};
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(env, seed_data_.data<char>(), seed_data_.size())
+             .ToLocal(&buf)) {
+      return {};
+    }
+    seed_data = buf;
+  }
+
   // Make sure internal/crypto/keys has been loaded so that the
   // CryptoKey constructor is registered with the Environment.
-  Isolate* isolate = env->isolate();
   Local<Value> arg = env->internal_crypto_keys_string();
   if (env->builtin_module_require()
           ->Call(context, Null(isolate), 1, &arg)
@@ -2122,9 +2191,11 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
       Undefined(isolate),
       Undefined(isolate),
       Undefined(isolate),
+      secondary_handle,
+      seed_data,
   };
   Local<Value> cryptokey;
-  if (!cryptokey_ctor->NewInstance(context, 4, ctor_args).ToLocal(&cryptokey)) {
+  if (!cryptokey_ctor->NewInstance(context, 6, ctor_args).ToLocal(&cryptokey)) {
     return {};
   }
 
@@ -2134,11 +2205,19 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
 
 void NativeCryptoKey::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("handle_data", handle_data_);
+  if (secondary_handle_data_) {
+    tracker->TrackField("secondary_handle_data", secondary_handle_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
 }
 
 void NativeCryptoKey::CryptoKeyTransferData::MemoryInfo(
     MemoryTracker* tracker) const {
   tracker->TrackField("data", data_);
+  if (secondary_data_) {
+    tracker->TrackField("secondary_data", secondary_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
   tracker->TrackField("algorithm", algorithm_);
 }
 
diff --git a/src/crypto/crypto_keys.h b/src/crypto/crypto_keys.h
index 8fffbec60467..9f3b1cce091c 100644
--- a/src/crypto/crypto_keys.h
+++ b/src/crypto/crypto_keys.h
@@ -258,9 +258,12 @@ class NativeKeyObject : public BaseObject {
 
 // NativeCryptoKey is the native base class for the Web Crypto
 // `CryptoKey`. It holds the internal slots - `[[type]]` as an enum,
-// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, and the
-// underlying KeyObjectData. The public `type`, `extractable`,
-// `algorithm`, and `usages` accessors on `CryptoKey.prototype` are
+// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, the
+// primary underlying KeyObjectData. Hybrid KEM CryptoKeys may also store an
+// optional secondary KeyObjectData and optional seed_data, both of which are
+// only used to reconstruct their hybrid key material. The public `type`,
+// `extractable`, `algorithm`, and `usages` accessors on `CryptoKey.prototype`
+// are
 // user-configurable per Web IDL, so internal consumers read these
 // values directly from the C++ side via a single `GetSlots` call
 // which returns all slots at once; JS primes a per-instance cache
@@ -291,8 +294,10 @@ class NativeCryptoKey : public BaseObject {
   // Used by `GetSlots` to validate its receiver.
   static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
 
-  // Returns [type, extractable, algorithm, usages mask, handle] in one call
-  // so JS can prime a per-instance cache on first access.
+  // Returns [type, extractable, algorithm, usages mask, handle,
+  // secondary handle, seed data] in one call so JS can prime a per-instance
+  // cache on first access. The secondary handle and seed data slots are only
+  // used by Hybrid KEM CryptoKeys.
   static void GetSlots(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -302,10 +307,15 @@ class NativeCryptoKey : public BaseObject {
   class CryptoKeyTransferData : public worker::TransferData {
    public:
     CryptoKeyTransferData(const KeyObjectData& data,
+                          const KeyObjectData& secondary_data,
+                          ByteSource&& seed_data,
                           v8::Global<v8::Object>&& algorithm,
                           uint32_t usages_mask,
                           bool extractable)
         : data_(data.addRef()),
+          secondary_data_(secondary_data ? secondary_data.addRef()
+                                         : KeyObjectData()),
+          seed_data_(std::move(seed_data)),
           algorithm_(std::move(algorithm)),
           usages_mask_(usages_mask),
           extractable_(extractable) {}
@@ -325,6 +335,8 @@ class NativeCryptoKey : public BaseObject {
 
    private:
     KeyObjectData data_;
+    KeyObjectData secondary_data_;
+    ByteSource seed_data_;
     v8::Global<v8::Object> algorithm_;
     uint32_t usages_mask_;
     bool extractable_;
@@ -337,16 +349,28 @@ class NativeCryptoKey : public BaseObject {
       v8::ValueDeserializer* deserializer) override;
 
   const KeyObjectData& handle_data() const { return handle_data_; }
+  const KeyObjectData& secondary_handle_data() const {
+    return secondary_handle_data_;
+  }
 
  private:
   NativeCryptoKey(Environment* env,
                   v8::Local<v8::Object> wrap,
-                  const KeyObjectData& handle_data)
-      : BaseObject(env, wrap), handle_data_(handle_data.addRef()) {
+                  const KeyObjectData& handle_data,
+                  const KeyObjectData& secondary_handle_data,
+                  ByteSource&& seed_data)
+      : BaseObject(env, wrap),
+        handle_data_(handle_data.addRef()),
+        secondary_handle_data_(secondary_handle_data
+                                   ? secondary_handle_data.addRef()
+                                   : KeyObjectData()),
+        seed_data_(std::move(seed_data)) {
     MakeWeak();
   }
 
   KeyObjectData handle_data_;
+  KeyObjectData secondary_handle_data_;
+  ByteSource seed_data_;
   uint32_t usages_mask_ = 0;
   bool extractable_ = false;
 };
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index aafdd3bf273b..00ac9f6703aa 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -227,6 +227,15 @@ class ByteSource final {
     return ncrypto::BignumPointer(data<unsigned char>(), size());
   }
 
+  inline ByteSource ToCopy() const {
+    if (empty()) return {};
+    CHECK_NOT_NULL(data_);
+    auto data = MallocOpenSSL<char>(size());
+    CHECK_NOT_NULL(data);
+    memcpy(data, data_, size());
+    return ByteSource::Allocated(data, size());
+  }
+
   // Creates a v8::BackingStore that takes over responsibility for
   // any allocated data. The ByteSource will be reset with size = 0
   // after being called.
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index 4b44e02d479d..8ca6ee5908e7 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -7,8 +7,10 @@ const pqc = hasOpenSSL(3, 5) || boringSSL;
 const argon2 = hasOpenSSL(3, 2);
 const shake128 = crypto.getHashes().includes('shake128');
 const shake256 = crypto.getHashes().includes('shake256');
+const sha3 = crypto.getHashes().includes('sha3-256');
 const ocb = hasOpenSSL(3);
 const kmac = hasOpenSSL(3);
+const hybridKems = pqc && (!boringSSL || (sha3 && shake256));
 
 const { subtle } = globalThis.crypto;
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
@@ -94,6 +96,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -115,6 +120,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [argon2, 'Argon2d'],
     [argon2, 'Argon2i'],
@@ -136,6 +144,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, 'AES-OCB'],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -159,6 +170,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [false, 'AES-CTR'],
     [false, 'AES-CBC'],
     [false, 'AES-GCM'],
@@ -218,6 +232,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'encapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -233,6 +250,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
@@ -244,6 +264,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'decapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -259,6 +282,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
diff --git a/test/parallel/test-crypto-key-objects-to-crypto-key.js b/test/parallel/test-crypto-key-objects-to-crypto-key.js
index 9d42b7719722..f699ec5462c8 100644
--- a/test/parallel/test-crypto-key-objects-to-crypto-key.js
+++ b/test/parallel/test-crypto-key-objects-to-crypto-key.js
@@ -404,7 +404,11 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   }
 }
 
-const unsupportedToCryptoKeyAlgorithms = new Set();
+const unsupportedToCryptoKeyAlgorithms = new Set([
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]);
 
 for (const name of Object.keys(kSupportedAlgorithms.importKey)) {
   const vectors = tests[name];
diff --git a/test/parallel/test-webcrypto-get-public-key.mjs b/test/parallel/test-webcrypto-get-public-key.mjs
index 65e3cb5334d9..6c03492cfbf9 100644
--- a/test/parallel/test-webcrypto-get-public-key.mjs
+++ b/test/parallel/test-webcrypto-get-public-key.mjs
@@ -56,6 +56,14 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
+}
+
 const unsupportedGetPublicKeyAlgorithms = new Set([
   'AES-CBC',
   'AES-CTR',
diff --git a/test/parallel/test-webcrypto-kem-hybrids.js b/test/parallel/test-webcrypto-kem-hybrids.js
new file mode 100644
index 000000000000..0d1ec410c160
--- /dev/null
+++ b/test/parallel/test-webcrypto-kem-hybrids.js
@@ -0,0 +1,689 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3, 5))
+  common.skip('requires OpenSSL >= 3.5');
+
+const assert = require('assert');
+const { once } = require('events');
+const { KeyObject } = require('crypto');
+const { MessageChannel } = require('worker_threads');
+const { subtle } = globalThis.crypto;
+const { SubtleCrypto } = globalThis;
+
+if (hasFIPS()) {
+  (async () => {
+    for (const name of [
+      'MLKEM768-P256',
+      'MLKEM768-X25519',
+      'MLKEM1024-P384',
+    ]) {
+      for (const operation of [
+        'generateKey',
+        'importKey',
+        'exportKey',
+        'getPublicKey',
+        'encapsulateBits',
+        'decapsulateBits',
+      ]) {
+        assert.strictEqual(SubtleCrypto.supports(operation, name), false);
+      }
+      assert.strictEqual(
+        SubtleCrypto.supports('encapsulateKey', name, 'HKDF'),
+        false);
+      assert.strictEqual(
+        SubtleCrypto.supports('decapsulateKey', name, 'HKDF'),
+        false);
+      await assert.rejects(
+        subtle.generateKey(
+          name,
+          true,
+          ['encapsulateBits', 'decapsulateBits']),
+        { name: 'NotSupportedError', message: 'Unrecognized algorithm name' });
+    }
+  })().then(common.mustCall());
+  return;
+}
+
+const vectors = [
+  {
+    name: 'MLKEM768-P256',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220' +
+               'd422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc04428a824ea7cf56ad2a64ed368b' +
+                '71315d80cee846007cff1d2eea2c3f0f921537304ae598f98dd10d1f102811a4e2d161c3fd8b' +
+                'bb193d4b25bee950ac839c0f9d',
+    sharedSecret: '9bd018e869bb01b63fb8f5da374a73d347ea14cb2bc570b13d0908e2288ec456',
+  },
+  {
+    name: 'MLKEM768-X25519',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc6b3d57762f8badb69433f9c6d060' +
+                'f85f5e5c6b6803a816d141c075f63541ad10',
+    sharedSecret: 'e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a',
+  },
+  {
+    name: 'MLKEM1024-P384',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: 'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d6' +
+               '77d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c74' +
+               '9c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b0' +
+               '4d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2' +
+               'c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee' +
+               '5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918' +
+               'b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab' +
+               '25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e68534' +
+               '53b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0' +
+               'ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4' +
+               '713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e29' +
+               '8c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c' +
+               '43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cb' +
+               'aa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c59382' +
+               '58c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c' +
+               '2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816' +
+               '714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f' +
+               '8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec067467494' +
+               '73e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed7' +
+               '7cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865a' +
+               'b22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db65' +
+               '7460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c' +
+               '48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b51' +
+               '0b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e785448' +
+               '87f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924' +
+               'b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b38872575' +
+               '8a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1ad' +
+               'de369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a8' +
+               '75d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80' +
+               'a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049' +
+               '063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a73726' +
+               '32ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722' +
+               'b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421' +
+               'e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809' +
+               '983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef' +
+               '760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a30' +
+               '6e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e3' +
+               '70941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da89613' +
+               '3272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf' +
+               '8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97' +
+               '576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c' +
+               '5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa70' +
+               '2265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5' +
+               'ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f',
+    ciphertext: 'dc63d18bb9715fb6e3ba71cb439fcd3377a75305cc9b144e6758bf5794a272e6b4a0da33234c' +
+                '0ac1bb5b4e60e4c82eb1fb780d59e4e4616641a0595ba031e3ae69d971dcd5fff14e21731a8e' +
+                '1a221f46c7820d214630b707fa1b0de3a484698f3d49e0a75f1212b8c42d330dd909f15eac04' +
+                '02f19ee77fba9447e1c44304b0d8c371c17c5549fdbdec1e0a2e7be9f577d7a4b5b2618d9ba6' +
+                '7ab95a0297cd5c5a13c89cc5a57cbd9a8ae38d66455c9a3d2bc55b498775fee2f6dc224d376d' +
+                '5f526a8354c8ed724f60337e900b85627972383e1fd987d407a8834005814a4fdc94c947e5f3' +
+                '471459288cfb127952b3208f10c914200bbaac5fcebd2bc9e2848492bab17b9288ca8b81d1c2' +
+                'ac9522dcc0b6d5f51e10f3afbb5d65fbf919edef6323c4e92c6b0690c10db25a9182de9e919e' +
+                'a1b3e65ae6150635d5180ebd7d23a2264828bc3ee1fd34dba1924ad0db30c747e05baa9148f1' +
+                'a032769c685e04665fd802a79c4624f69a9198a426eac1b217d903cdacf8844e73365f3a219a' +
+                '700dda27edf6bea33602617c5fd105b301b884bfaaa1163b791ec09f82523fef65c87b75ed06' +
+                '3ceb127729b82c8712e1f41b547d095f55ee71f3f8b47a306cb5d9bdd817854c74a42eebf934' +
+                'a1136dea3fbc546ad8ce51b3171913722f08b0261d197590342bfe4108dcb08c62a98610cbfb' +
+                '8d3b2831f56dcac2220e29a5811f38f0824f21a6cbebc64fd89a09b110dffbe03799ffc74fe5' +
+                '65c80dbf6a66acd7bfd14cb90acba03405a7982d4c1c68caa75f8b72e4dd6401d7dce4db4f6b' +
+                '820a7886a604b66b4e5b9eea5e5eddc2bca458a25977bd1f02874c5d9daf2baf56b3040f24ce' +
+                '7fe14cc14d61c7960db4decb37d9779c8e36d69a7763066d8c1149312d26887a693dc222daa8' +
+                '92dd00cd8f3a558cf605e4c65c011c2e9f0d671ba10af2bb90ee0351ae5078eb7878399ec9eb' +
+                '4ace87a68269618bda12a7aed6fda0385496c5d10ac36b35255f4a31edfa8a2c516b65c63431' +
+                '013ed4909ec7a787a5efb9d3c3887b80ac18a44934b6559bd8a84b18e86fa1b0b9e1d9f92ba4' +
+                '95ba5595d82e5095612b79e805154bf428a7071662c7cefb6450165c6f8f6954c37219bff4a4' +
+                '9894a8aa37f940a40f4ec942c281e6c47ea408199927a724ff1c7460fc8fd47a98d0c9d4d1f0' +
+                '7994d8084f6e084935ad7c2985282fabd5ca13b942e10d35278f4ff4cb1cb96f3c862410e791' +
+                '44a46b4db1a3c3d4d63018ec5c01ca48cb67081482e7d434b4abe5fa3071f2fbb533f745602b' +
+                '0da6183b28e6c5dfa42dab7ae0bbbf7638e106be1bd7312cba399e08c96dbd69a128a2face2d' +
+                '4a02951533a25e82fe63d0aaaa2e8c75150215c93ab06c22f9cab8d1cae7424f8baa09b3260e' +
+                'cfa3c7c8d55a276b4b317f72ec86b1b145a63aca83ef8c1204d8ab0c96ea3f742de39db47020' +
+                '616e139285814f188029ace4587f14cf12b5ed81086d8213cf8cb578341e04e16f519b77ff4c' +
+                '2644a5732639d658d0c4eaf992bd7dbd5011b700a5fa63dc1b24a84a3c80656bab5705dc3a74' +
+                '312c80e8bdb24a7ac6e27bcb8c07ece62c6e5777dd3dc0657181f440c7524d907dd27950bcb2' +
+                '52aef7f8cbf453cee3fe3143a665072c787cea76de323aa41537df2f3a40a518a694b918953b' +
+                'de8d57084e32d3b1fdcf9d153e73f02624beaf6ebe23e6828a6a489583494f3cd790fc96bb6f' +
+                '5d8b198402965e2e668e6581e7cf1c8a47a92198388f2b4cd38df660f0ddd48ad126819c4435' +
+                'af3a12c89113d778ac544fd8079cb8aaa97d2ff1b608da574c4dcd87f4979390de3be405f0e4' +
+                '7788dd0b01662805079fd73c64e9278c036544add3694c838bfcfb08c8a5efb09549442123ea' +
+                'a59fa30fbb9198105f6be00163bac076193f6721c539714108bbfae167f5db8085c5838618f3' +
+                '2a968bbb25c40645a17c17b9bec64aea45832eec5adc25b53e677f67566fbf5ce2d9193a06bd' +
+                '9b477e601d589b25f422defc49105252cd9ca6adcbb36be8a01a8472b4d463f655be14ccff9b' +
+                '0571a2048e31c14b9b23e2d43fafa3f85ece6fd41896cc5c68993dbaa926f285ec94c72887de' +
+                '9564881d735c05f83aa474b3d4cd133a630ac63850771cb5270f6cb7a391170d66af3e4901b6' +
+                'eb0253f3f34ef57d6babd97aa99ce718c3bcb53ff13d4028a0c943bb9681106ce176242cccb7' +
+                '5df1d3f8d3706e5b068b042c3154d5e6292581b36499e6b069b9a490aa67f0675390539da855' +
+                '5e6a4e8a35a86fdfea83e1387bf4acc650ec1edae7c99aa3a48306ee1d1a5e513c0c6901f64d' +
+                '0a3ee285de3c11d49f90cd4323dafda14832f0d8b760c0e5a48633c967cfaf',
+    sharedSecret: '8c028c6ea72a1c59408e2b15dd8fed8008517e861cd2329b159bda1919ea656c',
+  },
+];
+
+const lengths = {
+  'MLKEM768-P256': { publicKey: 1249, ciphertext: 1153, groupElement: 65 },
+  'MLKEM768-X25519': { publicKey: 1216, ciphertext: 1120, groupElement: 32 },
+  'MLKEM1024-P384': { publicKey: 1665, ciphertext: 1665, groupElement: 97 },
+};
+
+async function roundTripViaMessageChannel(key) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(key);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function buffers(vector) {
+  return {
+    seed: Buffer.from(vector.seed, 'hex'),
+    publicKey: Buffer.from(vector.publicKey, 'hex'),
+    ciphertext: Buffer.from(vector.ciphertext, 'hex'),
+    sharedSecret: Buffer.from(vector.sharedSecret, 'hex'),
+  };
+}
+
+async function testAlgorithmConfigPrototypePollution() {
+  const properties = [
+    'encapsulationKeyLength',
+    'ciphertextLength',
+    'groupOrder',
+    'namedCurve',
+  ];
+  const descriptors = new Map();
+
+  for (const property of properties) {
+    descriptors.set(
+      property,
+      Object.getOwnPropertyDescriptor(Object.prototype, property));
+    Object.defineProperty(Object.prototype, property, {
+      __proto__: null,
+      configurable: true,
+      get: common.mustNotCall(`Object.prototype.${property} getter`),
+      set: common.mustNotCall(`Object.prototype.${property} setter`),
+    });
+  }
+
+  try {
+    await subtle.generateKey(
+      'MLKEM768-X25519',
+      true,
+      ['encapsulateBits', 'decapsulateBits']);
+  } finally {
+    for (const property of properties) {
+      const descriptor = descriptors.get(property);
+      if (descriptor === undefined) {
+        delete Object.prototype[property];
+      } else {
+        Object.defineProperty(Object.prototype, property, descriptor);
+      }
+    }
+  }
+}
+
+async function testGeneratedRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { ciphertext } = buffers(vector);
+  const keyPair = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits']);
+  assert.strictEqual(Object.getPrototypeOf(keyPair), Object.prototype);
+  assert.deepStrictEqual(Object.keys(keyPair), ['publicKey', 'privateKey']);
+  const { privateKey, publicKey } = keyPair;
+
+  assert.strictEqual(publicKey.type, 'public');
+  assert.strictEqual(privateKey.type, 'private');
+  assert.strictEqual(publicKey.algorithm.name, algorithm.name);
+  assert.strictEqual(privateKey.algorithm.name, algorithm.name);
+  assert.deepStrictEqual(publicKey.usages, ['encapsulateKey', 'encapsulateBits']);
+  assert.deepStrictEqual(privateKey.usages, ['decapsulateKey', 'decapsulateBits']);
+
+  for (const key of [publicKey, privateKey]) {
+    assert.throws(() => KeyObject.from(key), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /cannot be represented by a single KeyObject/,
+    });
+  }
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKey);
+  assert.strictEqual(encapsulated.sharedKey.byteLength, 32);
+  assert.strictEqual(encapsulated.ciphertext.byteLength, ciphertext.byteLength);
+
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const encapsulatedKey = await subtle.encapsulateKey(
+    algorithm,
+    publicKey,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  const decapsulatedKey = await subtle.decapsulateKey(
+    algorithm,
+    privateKey,
+    encapsulatedKey.ciphertext,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  assert(KeyObject.from(encapsulatedKey.sharedKey)
+    .export()
+    .equals(KeyObject.from(decapsulatedKey).export()));
+}
+
+async function testVectorRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext, sharedSecret } = buffers(vector);
+  assert.strictEqual(seed.byteLength, 32);
+  assert.strictEqual(publicKey.byteLength, lengths[vector.name].publicKey);
+  assert.strictEqual(ciphertext.byteLength, lengths[vector.name].ciphertext);
+  assert.strictEqual(sharedSecret.byteLength, 32);
+
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyFromPrivate = await subtle.getPublicKey(
+    privateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', publicKeyFromPrivate))
+    .equals(publicKey));
+
+  const jwk = await subtle.exportKey('jwk', privateKey);
+  assert.strictEqual(jwk.kty, 'AKP');
+  assert.strictEqual(jwk.alg, algorithm.name);
+  assert(Buffer.from(jwk.pub, 'base64url').equals(publicKey));
+  assert(Buffer.from(jwk.priv, 'base64url').equals(seed));
+
+  const publicJwk = await subtle.exportKey('jwk', publicKeyFromPrivate);
+  assert.deepStrictEqual(publicJwk, {
+    kty: 'AKP',
+    alg: algorithm.name,
+    pub: jwk.pub,
+    key_ops: ['encapsulateBits'],
+    ext: true,
+  });
+  const jwkPublicKey = await subtle.importKey(
+    'jwk',
+    publicJwk,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', jwkPublicKey))
+    .equals(publicKey));
+
+  const jwkPrivateKey = await subtle.importKey(
+    'jwk',
+    jwk,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const vectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    jwkPrivateKey,
+    ciphertext);
+  assert(Buffer.from(vectorSharedSecret).equals(sharedSecret));
+
+  const implicitRejectionCiphertext = Buffer.from(ciphertext);
+  const pqCiphertextLength =
+    ciphertext.byteLength - lengths[vector.name].groupElement;
+  implicitRejectionCiphertext.fill(0, 0, pqCiphertextLength);
+  // Preserve the valid traditional group element so this only exercises
+  // ML-KEM implicit rejection.
+  assert(implicitRejectionCiphertext.subarray(pqCiphertextLength)
+    .equals(ciphertext.subarray(pqCiphertextLength)));
+
+  const implicitRejectionSharedSecret = Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext));
+  assert.strictEqual(implicitRejectionSharedSecret.byteLength, 32);
+  assert(!implicitRejectionSharedSecret.equals(sharedSecret));
+  assert(implicitRejectionSharedSecret.equals(Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext))));
+
+  const publicKeyOnly = await subtle.importKey(
+    'raw-public',
+    publicKey,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  const clonedPrivateKey = structuredClone(privateKey);
+  const clonedPublicKey = structuredClone(publicKeyOnly);
+  const portPrivateKey = await roundTripViaMessageChannel(privateKey);
+  const portPublicKey = await roundTripViaMessageChannel(publicKeyOnly);
+  assert.deepStrictEqual(clonedPrivateKey, privateKey);
+  assert.deepStrictEqual(clonedPublicKey, publicKeyOnly);
+  assert.deepStrictEqual(portPrivateKey, privateKey);
+  assert.deepStrictEqual(portPublicKey, publicKeyOnly);
+  assert(Buffer.from(await subtle.exportKey('raw-seed', clonedPrivateKey))
+    .equals(seed));
+  assert(Buffer.from(await subtle.exportKey('raw-seed', portPrivateKey))
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', clonedPrivateKey)).priv, 'base64url')
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', portPrivateKey)).priv, 'base64url')
+    .equals(seed));
+
+  const clonedPublicKeyFromPrivate = await subtle.getPublicKey(
+    clonedPrivateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', clonedPublicKeyFromPrivate))
+    .equals(publicKey));
+
+  const clonedVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    ciphertext);
+  assert(Buffer.from(clonedVectorSharedSecret).equals(sharedSecret));
+  const portVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    portPrivateKey,
+    ciphertext);
+  assert(Buffer.from(portVectorSharedSecret).equals(sharedSecret));
+
+  const { publicKey: differentPublicKey } = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateBits', 'decapsulateBits']);
+  assert.notDeepStrictEqual(publicKeyOnly, differentPublicKey);
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKeyOnly);
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+  const clonedDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(clonedDecapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const clonedEncapsulated = await subtle.encapsulateBits(algorithm, clonedPublicKey);
+  const originalDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    clonedEncapsulated.ciphertext);
+  assert(Buffer.from(originalDecapsulated).equals(Buffer.from(clonedEncapsulated.sharedKey)));
+
+  const portEncapsulated = await subtle.encapsulateBits(algorithm, portPublicKey);
+  const portDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    portEncapsulated.ciphertext);
+  assert(Buffer.from(portDecapsulated).equals(Buffer.from(portEncapsulated.sharedKey)));
+}
+
+async function testFailures(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext } = buffers(vector);
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyOnly = await subtle.getPublicKey(privateKey, ['encapsulateBits']);
+  const jwk = await subtle.exportKey('jwk', privateKey);
+
+  // JWK key usage validation precedes `key_ops` validation.
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['encapsulateBits', 'encapsulateBits'] },
+      algorithm,
+      true,
+      ['encapsulateBits']),
+    {
+      name: 'SyntaxError',
+      message: `Unsupported key usage for ${vector.name} key`,
+    });
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['decapsulateBits', 'decapsulateBits'] },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError', message: 'Duplicate key operation' });
+
+  await assert.rejects(
+    subtle.importKey('raw-public', Buffer.alloc(publicKey.byteLength - 1), algorithm, true, ['encapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', Buffer.alloc(seed.byteLength - 1), algorithm, true, ['decapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-public', publicKey, algorithm, true, ['decapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', seed, algorithm, true, ['encapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw', publicKey, algorithm, true, ['encapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.importKey('raw-private', seed, algorithm, true, ['decapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('spki', publicKeyOnly),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('pkcs8', privateKey),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, Buffer.alloc(ciphertext.byteLength - 1)),
+    { name: 'OperationError' });
+
+  const badCiphertext = Buffer.from(ciphertext);
+  badCiphertext.fill(
+    0,
+    badCiphertext.byteLength - lengths[vector.name].groupElement);
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, badCiphertext),
+    { name: 'OperationError' });
+
+  if (vector.name !== 'MLKEM768-X25519') {
+    const groupElementLength = lengths[vector.name].groupElement;
+    const nonCanonicalPublicKey = Buffer.from(publicKey);
+    const publicKeyPointOffset =
+      nonCanonicalPublicKey.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalPublicKey[publicKeyPointOffset], 0x04);
+    nonCanonicalPublicKey[publicKeyPointOffset] =
+      0x06 | (nonCanonicalPublicKey[nonCanonicalPublicKey.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.importKey(
+        'raw-public',
+        nonCanonicalPublicKey,
+        algorithm,
+        true,
+        ['encapsulateBits']),
+      { name: 'DataError' });
+
+    const nonCanonicalCiphertext = Buffer.from(ciphertext);
+    const ciphertextPointOffset =
+      nonCanonicalCiphertext.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalCiphertext[ciphertextPointOffset], 0x04);
+    nonCanonicalCiphertext[ciphertextPointOffset] =
+      0x06 | (nonCanonicalCiphertext[nonCanonicalCiphertext.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.decapsulateBits(algorithm, privateKey, nonCanonicalCiphertext),
+      { name: 'OperationError' });
+  }
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, alg: 'ML-KEM-768' },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+
+  const badPublicKey = Buffer.from(publicKey);
+  badPublicKey[0] ^= 1;
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, pub: badPublicKey.toString('base64url') },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+}
+
+function testSupports(vector) {
+  const algorithm = { name: vector.name };
+  assert(SubtleCrypto.supports('generateKey', algorithm));
+  assert(SubtleCrypto.supports('importKey', algorithm));
+  assert(SubtleCrypto.supports('exportKey', algorithm));
+  assert(SubtleCrypto.supports('getPublicKey', algorithm));
+  assert(SubtleCrypto.supports('encapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('decapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('encapsulateKey', algorithm, 'HKDF'));
+  assert(SubtleCrypto.supports('decapsulateKey', algorithm, 'HKDF'));
+  assert(!SubtleCrypto.supports('sign', algorithm));
+}
+
+(async () => {
+  await testAlgorithmConfigPrototypePollution();
+  for (const vector of vectors) {
+    testSupports(vector);
+    await testGeneratedRoundTrip(vector);
+    await testVectorRoundTrip(vector);
+    await testFailures(vector);
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
index f25acd356e33..712b2745c078 100644
--- a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
@@ -878,6 +878,19 @@ for (const name of [
   }));
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  addFixture(name, kemFixture({
+    name,
+    generateAlgorithm: algorithm(name),
+    importAlgorithm: algorithm(name),
+    spki: false,
+  }));
+}
+
 for (const name of ['HKDF', 'PBKDF2']) {
   addFixture(name, kdfFixture({
     name,
diff --git a/test/parallel/test-webcrypto-supports.mjs b/test/parallel/test-webcrypto-supports.mjs
index 6c3b2c640fd7..15874102a22b 100644
--- a/test/parallel/test-webcrypto-supports.mjs
+++ b/test/parallel/test-webcrypto-supports.mjs
@@ -71,6 +71,9 @@ function getSharedKeyLength(alg) {
     case 'ml-kem-512':
     case 'ml-kem-768':
     case 'ml-kem-1024':
+    case 'mlkem768-p256':
+    case 'mlkem768-x25519':
+    case 'mlkem1024-p384':
       return 256;
   }
 }
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index eb40d33c513c..e45a45ea7193 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -125,6 +125,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
   interface CryptoKeyPair {
@@ -605,6 +607,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
 
@@ -619,6 +623,8 @@ declare namespace InternalCryptoBinding {
     algorithm: object,
     usagesMask: number,
     handle: KeyObjectHandle,
+    secondaryHandle: KeyObjectHandle | undefined,
+    seedData: Buffer | undefined,
   ];
 
   type CreateNativeKeyObjectClassCallback =

From b0d56c73289e32e3e25d522e28f5c6f91d4cc706 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 5 Sep 2026 15:31:22 +0200
Subject: [PATCH 100/202] test,benchmark: use OpenSSL feature helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add isBoringSSL to the test crypto helpers and use it in tests and
benchmarks. Replace hasOpenSSL3 call sites with hasOpenSSL(3).

Assisted-by: Codex
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65762
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/crypto/create-keyobject.js          |  4 +--
 benchmark/crypto/kem.js                       |  4 +--
 benchmark/crypto/mac.js                       |  4 +--
 benchmark/crypto/oneshot-sign.js              |  4 +--
 benchmark/crypto/oneshot-verify.js            |  4 +--
 test/addons/openssl-providers/providers.cjs   |  4 +--
 test/common/crypto.js                         |  3 ++
 test/fixtures/crypto/ecdsa.js                 | 10 ++++---
 test/fixtures/crypto/eddsa.js                 |  4 ++-
 test/fixtures/crypto/hmac.js                  |  6 ++--
 test/fixtures/crypto/rsa_pkcs.js              |  6 ++--
 test/fixtures/crypto/rsa_pss.js               |  6 ++--
 test/fixtures/webcrypto/supports-level-2.mjs  |  2 --
 .../webcrypto/supports-modern-algorithms.mjs  |  4 +--
 .../webcrypto/supports-secure-curves.mjs      |  4 +--
 test/fixtures/webcrypto/supports-sha3.mjs     |  4 ++-
 test/parallel/test-cli-node-options.js        |  4 +--
 test/parallel/test-config-json-schema.js      |  4 +--
 .../parallel/test-crypto-async-sign-verify.js |  6 ++--
 test/parallel/test-crypto-authenticated.js    | 10 +++----
 .../test-crypto-boringssl-evp-list.js         |  4 ++-
 test/parallel/test-crypto-certificate.js      |  6 ++--
 test/parallel/test-crypto-dh-curves.js        |  8 +++---
 test/parallel/test-crypto-dh-errors.js        |  4 +--
 test/parallel/test-crypto-dh-group-setters.js |  4 ++-
 test/parallel/test-crypto-dh-modp2-views.js   |  4 +--
 test/parallel/test-crypto-dh-modp2.js         |  4 +--
 test/parallel/test-crypto-dh-stateless.js     |  7 +++--
 test/parallel/test-crypto-dh.js               |  5 ++--
 test/parallel/test-crypto-ecb.js              |  4 +--
 test/parallel/test-crypto-eddsa-variants.js   |  3 +-
 test/parallel/test-crypto-encap-decap.js      |  8 ++++--
 .../test-crypto-fips-indicator-strict.js      |  9 ++++--
 test/parallel/test-crypto-fips.js             | 15 +++++-----
 test/parallel/test-crypto-getcipherinfo.js    | 12 ++++----
 test/parallel/test-crypto-hash-stream-pipe.js |  6 ++--
 test/parallel/test-crypto-hash.js             |  4 ++-
 test/parallel/test-crypto-hkdf.js             |  4 +--
 test/parallel/test-crypto-key-objects-raw.js  | 28 +++++++++----------
 test/parallel/test-crypto-key-objects.js      | 11 ++++----
 ...test-crypto-keygen-async-dsa-key-object.js | 12 ++++----
 test/parallel/test-crypto-keygen-async-dsa.js | 17 +++++------
 ...ypto-keygen-async-elliptic-curve-jwk-ec.js |  4 +--
 ...-crypto-keygen-async-elliptic-curve-jwk.js |  4 +--
 ...-explicit-elliptic-curve-encrypted-p256.js | 19 +++++++------
 ...nc-explicit-elliptic-curve-encrypted.js.js | 16 ++++++-----
 ...to-keygen-async-explicit-elliptic-curve.js | 14 ++++++----
 ...ync-named-elliptic-curve-encrypted-p256.js |  4 +--
 .../parallel/test-crypto-keygen-bit-length.js |  9 ++++--
 .../parallel/test-crypto-keygen-dh-classic.js |  5 ++--
 test/parallel/test-crypto-keygen-eddsa.js     |  4 +--
 ...o-keygen-invalid-parameter-encoding-dsa.js |  5 ++--
 ...test-crypto-keygen-no-rsassa-pss-params.js |  5 ++--
 test/parallel/test-crypto-keygen-raw.js       | 16 +++++------
 .../test-crypto-keygen-rfc8017-9-1.js         |  5 ++--
 .../test-crypto-keygen-rfc8017-a-2-3.js       |  5 ++--
 test/parallel/test-crypto-keygen-rsa-pss.js   | 14 ++++++----
 test/parallel/test-crypto-keygen.js           |  9 ++++--
 .../test-crypto-mac-cache-snapshot.js         |  4 +--
 test/parallel/test-crypto-mac-cache.js        |  4 +--
 test/parallel/test-crypto-mac-errors.js       |  4 +--
 test/parallel/test-crypto-mac-unsupported.js  |  4 +--
 test/parallel/test-crypto-mac-vectors.js      |  4 +--
 test/parallel/test-crypto-mac.js              |  4 +--
 test/parallel/test-crypto-negative-zero.js    |  4 +--
 test/parallel/test-crypto-no-algorithm.js     |  4 +--
 test/parallel/test-crypto-oneshot-hash-xof.js |  4 ++-
 test/parallel/test-crypto-padding.js          |  4 +--
 .../test-crypto-pqc-encrypted-pkcs8.js        |  6 ++--
 .../test-crypto-pqc-key-objects-ml-dsa.js     |  6 ++--
 .../test-crypto-pqc-key-objects-ml-kem.js     |  8 +++---
 .../parallel/test-crypto-pqc-keygen-ml-dsa.js |  4 +--
 .../parallel/test-crypto-pqc-keygen-ml-kem.js |  8 +++---
 .../test-crypto-pqc-sign-verify-ml-dsa.js     | 10 +++----
 ...t-crypto-provider-cipher-cache-snapshot.js |  4 +--
 .../test-crypto-provider-cipher-cache.js      |  4 +--
 .../test-crypto-provider-hash-options.js      |  4 ++-
 test/parallel/test-crypto-provider-hashes.js  |  4 +--
 test/parallel/test-crypto-rsa-dsa.js          | 13 +++++----
 test/parallel/test-crypto-scrypt.js           |  4 +--
 test/parallel/test-crypto-sec-level.js        |  4 ++-
 test/parallel/test-crypto-secure-heap.js      |  9 ++++--
 test/parallel/test-crypto-sign-verify.js      | 15 +++++-----
 test/parallel/test-crypto-stream.js           |  4 +--
 test/parallel/test-crypto-x509.js             | 18 ++++++------
 test/parallel/test-crypto.js                  |  8 +++---
 .../test-https-agent-additional-options.js    |  6 ++--
 .../test-https-agent-session-eviction.js      |  4 +--
 .../test-https-agent-session-reuse.js         |  4 ++-
 .../test-https-client-renegotiation-limit.js  |  4 ++-
 .../test-https-options-boolean-check.js       |  4 ++-
 .../parallel/test-permission-openssl-store.js |  4 +--
 ...rocess-env-allowed-flags-are-documented.js |  8 +++---
 test/parallel/test-process-versions.js        |  4 +--
 test/parallel/test-tls-alert-handling.js      |  7 +++--
 test/parallel/test-tls-alert.js               |  3 +-
 test/parallel/test-tls-cert-ext-encoding.js   |  4 +--
 test/parallel/test-tls-client-auth.js         |  4 +--
 .../test-tls-client-getephemeralkeyinfo.js    |  9 ++++--
 test/parallel/test-tls-client-mindhsize.js    |  6 ++--
 test/parallel/test-tls-client-reject.js       | 12 ++++----
 .../test-tls-client-renegotiation-13.js       |  6 ++--
 .../test-tls-client-renegotiation-limit.js    |  4 +--
 test/parallel/test-tls-dhe.js                 |  4 ++-
 .../test-tls-dhparam-auto-boringssl.js        |  4 ++-
 .../test-tls-disable-renegotiation.js         |  4 ++-
 test/parallel/test-tls-ecdh-multiple.js       |  5 ++--
 test/parallel/test-tls-empty-sni-context.js   |  4 +--
 test/parallel/test-tls-finished.js            |  6 ++--
 test/parallel/test-tls-getcipher.js           |  4 ++-
 test/parallel/test-tls-getprotocol.js         |  6 ++--
 test/parallel/test-tls-honorcipherorder.js    |  4 +--
 test/parallel/test-tls-key-mismatch.js        |  6 ++--
 test/parallel/test-tls-legacy-pfx.js          |  4 +--
 test/parallel/test-tls-max-send-fragment.js   |  4 ++-
 test/parallel/test-tls-min-max-version.js     | 12 ++++----
 test/parallel/test-tls-multi-key.js           |  5 ++--
 test/parallel/test-tls-multi-pfx.js           |  5 ++--
 test/parallel/test-tls-no-cert-required.js    |  4 ++-
 .../test-tls-options-boolean-check.js         |  4 ++-
 ...ls-psk-alpn-callback-exception-handling.js |  3 +-
 test/parallel/test-tls-psk-circuit.js         |  5 ++--
 test/parallel/test-tls-psk-server.js          |  4 ++-
 .../test-tls-reduced-SECLEVEL-in-cipher.js    |  4 ++-
 test/parallel/test-tls-server-verify.js       |  4 +--
 test/parallel/test-tls-session-cache.js       |  3 +-
 test/parallel/test-tls-set-ciphers-error.js   |  4 +--
 ...ls-set-default-ca-certificates-recovery.js |  3 +-
 test/parallel/test-tls-set-sigalgs.js         |  6 ++--
 test/parallel/test-tls-ticket-cluster.js      |  4 ++-
 test/parallel/test-tls-ticket.js              |  4 ++-
 test/parallel/test-tls-write-error.js         |  4 +--
 test/parallel/test-trace-env.js               |  4 +--
 .../test-webcrypto-crypto-job-mode.js         |  4 +--
 .../test-webcrypto-deduplicate-usages.js      |  8 +++---
 .../test-webcrypto-derivebits-cfrg.js         |  4 +--
 .../test-webcrypto-derivebits-hkdf.js         | 12 ++++----
 test/parallel/test-webcrypto-derivebits.js    |  4 +--
 .../parallel/test-webcrypto-derivekey-cfrg.js |  4 +--
 test/parallel/test-webcrypto-derivekey.js     | 12 ++++----
 test/parallel/test-webcrypto-digest.js        |  6 ++--
 .../test-webcrypto-encap-decap-ml-kem.js      |  6 ++--
 .../test-webcrypto-encrypt-decrypt.js         |  4 +--
 .../test-webcrypto-export-import-cfrg.js      |  4 +--
 .../test-webcrypto-export-import-ml-dsa.js    |  8 +++---
 .../test-webcrypto-export-import-ml-kem.js    | 10 +++----
 .../test-webcrypto-export-import-rsa.js       |  4 ++-
 test/parallel/test-webcrypto-export-import.js |  4 +--
 test/parallel/test-webcrypto-keygen.js        | 18 ++++++------
 .../test-webcrypto-sign-verify-eddsa.js       |  4 +--
 .../test-webcrypto-sign-verify-ml-dsa.js      |  4 +--
 .../test-webcrypto-sign-verify-rsa.js         |  4 +--
 test/parallel/test-webcrypto-sign-verify.js   |  6 ++--
 test/parallel/test-webcrypto-wrap-unwrap.js   |  6 ++--
 test/parallel/test-x509-escaping.js           | 26 ++++++++---------
 test/pummel/test-crypto-dh-hash.js            |  4 +--
 test/pummel/test-crypto-dh-keys.js            |  4 +--
 test/sequential/test-tls-psk-client.js        |  4 ++-
 test/wpt/status/WebCryptoAPI.cjs              |  7 +++--
 159 files changed, 561 insertions(+), 437 deletions(-)

diff --git a/benchmark/crypto/create-keyobject.js b/benchmark/crypto/create-keyobject.js
index 7cd6db2d567a..df95ad393234 100644
--- a/benchmark/crypto/create-keyobject.js
+++ b/benchmark/crypto/create-keyobject.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 
diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js
index a544fc2124af..a59a57b65956 100644
--- a/benchmark/crypto/kem.js
+++ b/benchmark/crypto/kem.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -24,7 +24,7 @@ if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-kem-512'] = readKeyPair('ml_kem_512_public', 'ml_kem_512_private');
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private_seed_only');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private_seed_only');
 }
diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
index d1028fa414e6..ea9d3a56e59f 100644
--- a/benchmark/crypto/mac.js
+++ b/benchmark/crypto/mac.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const assert = require('node:assert');
 const {
   createHmac,
@@ -10,7 +10,7 @@ const {
 } = require('node:crypto');
 
 if (!hasOpenSSL(3) ||
-    process.features.openssl_is_boringssl ||
+    isBoringSSL ||
     typeof createMac !== 'function' ||
     typeof getMacs !== 'function') {
   console.log('Skipping: generic MAC API requires OpenSSL >= 3');
diff --git a/benchmark/crypto/oneshot-sign.js b/benchmark/crypto/oneshot-sign.js
index 72e3726d9a53..78f0b5574aef 100644
--- a/benchmark/crypto/oneshot-sign.js
+++ b/benchmark/crypto/oneshot-sign.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -19,7 +19,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private_seed_only');
 }
 
diff --git a/benchmark/crypto/oneshot-verify.js b/benchmark/crypto/oneshot-verify.js
index 8b397b02dbf2..9aac91692dfc 100644
--- a/benchmark/crypto/oneshot-verify.js
+++ b/benchmark/crypto/oneshot-verify.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 
diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index fc0f93ef45c8..7e7a958b9005 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -4,9 +4,9 @@ const common = require('../../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../../common/crypto');
+const { hasOpenSSL } = require('../../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 const assert = require('node:assert');
diff --git a/test/common/crypto.js b/test/common/crypto.js
index 63f7487f15d3..49678e0de43a 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -123,6 +123,8 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
   return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
 };
 
+const isBoringSSL = process.features.openssl_is_boringssl;
+
 const hasFIPS = (major = 0, minor = 0, patch = 0) => {
   return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch);
 };
@@ -144,6 +146,7 @@ module.exports = {
   sec1EncExp,
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
   get hasOpenSSL3() {
     return hasOpenSSL(3);
   },
diff --git a/test/fixtures/crypto/ecdsa.js b/test/fixtures/crypto/ecdsa.js
index c3545fb20ec7..6da56a0601ff 100644
--- a/test/fixtures/crypto/ecdsa.js
+++ b/test/fixtures/crypto/ecdsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = {
     'P-256': Buffer.from(
@@ -72,7 +74,7 @@ module.exports = function() {
         'b6a0a14d7e4bc6dd2eda82c9234f174b670b60c8f7d101f68fdf5889e02373b025' +
         'dcbc4c82f2929b8e06c68535da98e38fe399c53a814b097935581ef21535eb',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' +
           '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103',
@@ -104,7 +106,7 @@ module.exports = function() {
         '72fbdb369fd34c1c54264d07f4facd69b02e4206f8a8bb259b882a305c56fde2d3' +
         '5107e493c53cd6b4af0b31306f4d03fd43cfc762a1030e17a3d775453a1212b142' +
         '9f7b3d93066a5f42a10b138cd177dc09616e827d598822d78d4627b754e6', 'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' +
           'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' +
@@ -144,7 +146,7 @@ module.exports = function() {
         '01f0071e6a32867fa70f695cd39c4e87e142b9e4134d38740bd6fee354a575167e' +
         '13524e94832637910fe11e53a85fb21b91adb81bb1779c4e2b8bc87c717dc35084',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' +
           '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' +
@@ -170,7 +172,7 @@ module.exports = function() {
   const curves = ['P-256', 'P-384', 'P-521'];
   const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     hashes.push('SHA3-256', 'SHA3-384', 'SHA3-512');
   }
 
diff --git a/test/fixtures/crypto/eddsa.js b/test/fixtures/crypto/eddsa.js
index a5382219f4f3..4c91b044d72f 100644
--- a/test/fixtures/crypto/eddsa.js
+++ b/test/fixtures/crypto/eddsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 const common = require('../../common');
 
 module.exports = function() {
@@ -46,7 +48,7 @@ module.exports = function() {
   const algorithms = ['Ed25519'];
   const contexts = [new Uint8Array(0), new Uint8Array(32), new Uint8Array(255)];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     algorithms.push('Ed448')
   } else {
     common.printSkipMessage(`Skipping unsupported Ed448 test cases`);
diff --git a/test/fixtures/crypto/hmac.js b/test/fixtures/crypto/hmac.js
index acdf3229a4bc..55376a1299d8 100644
--- a/test/fixtures/crypto/hmac.js
+++ b/test/fixtures/crypto/hmac.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const plaintext = Buffer.from(
     '5f4dba4f320c0ce876725afce5fbd25bf83e5a7125a08cafe73c3ebac421779df9d55d' +
@@ -22,7 +24,7 @@ module.exports = function () {
       '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
       '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8',
         'hex'),
@@ -48,7 +50,7 @@ module.exports = function () {
       '61fb278c3ffb0cce2bf1cf723ddfd8ef1f931c0c618c25907324605939e3f9a2' +
       'c6f4af690bda3407dc2f5770f6a0a44b954d64a332e3ee0821abf82b7f3e99c1',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b',
         'hex'),
diff --git a/test/fixtures/crypto/rsa_pkcs.js b/test/fixtures/crypto/rsa_pkcs.js
index d54c44b6d820..74a8c0512ef4 100644
--- a/test/fixtures/crypto/rsa_pkcs.js
+++ b/test/fixtures/crypto/rsa_pkcs.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a50201000282' +
@@ -97,7 +99,7 @@ module.exports = function () {
       '7a6335c70e193235dcda48add6858626bd96311e60f7e5ea4491b6c1e6248afe12b' +
       'bbd54f8869b043a5b0444562813f0a98b300356f306e6b783a29f3bec97ca40ea20' +
       '062cab8926ec5d96aa387cc84821a6d72b8ea126e7d', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-256': Buffer.from(
         'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' +
         'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' +
@@ -161,7 +163,7 @@ module.exports = function () {
       plaintext,
       signature: signatures['sha-512']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,
diff --git a/test/fixtures/crypto/rsa_pss.js b/test/fixtures/crypto/rsa_pss.js
index 423f2c4d77bf..4aeaf3330e78 100644
--- a/test/fixtures/crypto/rsa_pss.js
+++ b/test/fixtures/crypto/rsa_pss.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' +
@@ -150,7 +152,7 @@ module.exports = function() {
       'b68c04bfe452c3adc6c10066a915231b7b404727eb6201b4921eb96d9407de2b963' +
       '3879ceb71d759d9828d7b4d062f6ef100757d8328187caf57dfb859d1555345207c' +
       '1cce7905c3564c08fec78867a53d5a2cf84810e1ffa', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-512, no salt': Buffer.from(
         'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' +
         '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' +
@@ -255,7 +257,7 @@ module.exports = function() {
       plaintext,
       signature: signatures['sha-512, salted']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,
diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs
index 3d0f8a630394..61633ae95a12 100644
--- a/test/fixtures/webcrypto/supports-level-2.mjs
+++ b/test/fixtures/webcrypto/supports-level-2.mjs
@@ -13,8 +13,6 @@ const [ECDH, X25519] = await Promise.all([
   subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']),
 ]);
 
-const boringSSL = process.features.openssl_is_boringssl;
-
 export const vectors = {
   'encrypt': [
     [false, 'Invalid'],
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index 8ca6ee5908e7..67fad15f7f39 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -1,8 +1,8 @@
 import * as crypto from 'node:crypto'
 
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 const pqc = hasOpenSSL(3, 5) || boringSSL;
 const argon2 = hasOpenSSL(3, 2);
 const shake128 = crypto.getHashes().includes('shake128');
diff --git a/test/fixtures/webcrypto/supports-secure-curves.mjs b/test/fixtures/webcrypto/supports-secure-curves.mjs
index a3a84f6c9f9a..fa3f1d365213 100644
--- a/test/fixtures/webcrypto/supports-secure-curves.mjs
+++ b/test/fixtures/webcrypto/supports-secure-curves.mjs
@@ -1,10 +1,10 @@
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
 const supportsContext = hasOpenSSL(3, 2);
 
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
 let X448;
diff --git a/test/fixtures/webcrypto/supports-sha3.mjs b/test/fixtures/webcrypto/supports-sha3.mjs
index 73f5b778eeb9..fe256dcfb168 100644
--- a/test/fixtures/webcrypto/supports-sha3.mjs
+++ b/test/fixtures/webcrypto/supports-sha3.mjs
@@ -1,6 +1,8 @@
+import { isBoringSSL } from '../../common/crypto.js'
+
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 90c399790f65..375c46c11ab7 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!hasOpenSSL3)
+  if (!hasOpenSSL(3))
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
   if (common.isMacOS) {
     expect('--use-system-ca', 'B\n');
diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js
index 82679660a30f..08973bd17ee2 100644
--- a/test/parallel/test-config-json-schema.js
+++ b/test/parallel/test-config-json-schema.js
@@ -10,9 +10,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 
diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
index 96b4b5d90679..a60dc73d67b3 100644
--- a/test/parallel/test-crypto-async-sign-verify.js
+++ b/test/parallel/test-crypto-async-sign-verify.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
@@ -100,7 +100,7 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false,
 // ED25519
 test('ed25519_public.pem', 'ed25519_private.pem', undefined, true);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // ED448
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
@@ -173,7 +173,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 
   let expected = /no default digest/;
   let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
-  if (hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || isBoringSSL) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
     expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
   }
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index 3ad34729f871..f11778ee7708 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -29,7 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const isFipsEnabled = crypto.getFips() === 1;
 const fips3 = hasFIPS(3);
@@ -834,7 +834,7 @@ if (fips3) {
     }), {
     code: 'ERR_OSSL_EVP_UNSUPPORTED',
   });
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -852,7 +852,7 @@ if (fips3) {
 
 // ChaCha20-Poly1305 should respect the authTagLength option and should not
 // require the authentication tag before calls to update() during decryption.
-if (!fips3 && !process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -903,7 +903,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) {
 // shorter tags as long as their length was valid according to NIST SP 800-38D.
 // For ChaCha20-Poly1305, we intentionally deviate from that because there are
 // no recommended or approved authentication tag lengths below 16 bytes.
-if (!fips3 && !process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -942,7 +942,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) {
 }
 
 // https://github.com/nodejs/node/issues/45874
-if (!fips3 && !process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
diff --git a/test/parallel/test-crypto-boringssl-evp-list.js b/test/parallel/test-crypto-boringssl-evp-list.js
index 3f142c24f28a..f2d8fd4796c0 100644
--- a/test/parallel/test-crypto-boringssl-evp-list.js
+++ b/test/parallel/test-crypto-boringssl-evp-list.js
@@ -1,10 +1,12 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!process.features.openssl_is_boringssl)
+if (!isBoringSSL)
   common.skip('BoringSSL-only test');
 
 const assert = require('assert');
diff --git a/test/parallel/test-crypto-certificate.js b/test/parallel/test-crypto-certificate.js
index 6462654680ea..54f61d8a3f6e 100644
--- a/test/parallel/test-crypto-certificate.js
+++ b/test/parallel/test-crypto-certificate.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { Certificate } = crypto;
 const fixtures = require('../common/fixtures');
 
@@ -42,7 +42,7 @@ function copyArrayBuffer(buf) {
 
 function checkMethods(certificate) {
 
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     assert.strictEqual(certificate.verifySpkac(spkacValid), !hasFIPS(3));
   assert.strictEqual(certificate.verifySpkac(spkacFail), false);
 
@@ -58,7 +58,7 @@ function checkMethods(certificate) {
   );
   assert.strictEqual(certificate.exportChallenge(spkacFail), '');
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const ab = copyArrayBuffer(spkacValid);
     const expected = !hasFIPS(3);
     assert.strictEqual(certificate.verifySpkac(ab), expected);
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index f7530aecfc5d..22b05fb89609 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const {
   DH_CHECK_P_NOT_PRIME,
   DH_CHECK_P_NOT_SAFE_PRIME,
@@ -21,7 +21,7 @@ const p = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' +
           'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF';
 crypto.createDiffieHellman(p, 'hex');
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const notPrime = Buffer.from(p, 'hex');
   notPrime[notPrime.length - 1] = 0xfd;
   assert.strictEqual(
@@ -63,7 +63,7 @@ assert.throws(
   });
 
 // Confirm DH_check() results are exposed for optional examination.
-const bad_dh = process.features.openssl_is_boringssl ?
+const bad_dh = isBoringSSL ?
   crypto.createDiffieHellman('abcd', 'hex', 0) :
   crypto.createDiffieHellman('02', 'hex');
 assert.notStrictEqual(bad_dh.verifyError, 0);
@@ -77,7 +77,7 @@ if (hasOpenSSL(3)) {
     () => crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                      Buffer.from(p, 'hex')),
     { code: 'ERR_OSSL_DH_BAD_GENERATOR' });
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   assert.strictEqual(
     crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                Buffer.from(p, 'hex')).verifyError,
diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
index 3ff9b746e020..d9f7065655cb 100644
--- a/test/parallel/test-crypto-dh-errors.js
+++ b/test/parallel/test-crypto-dh-errors.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // https://github.com/nodejs/node/issues/32738
 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
 });
 
 for (const bits of [-1, 0, 1]) {
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     assert.throws(() => crypto.createDiffieHellman(bits), {
       code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
       name: 'Error',
diff --git a/test/parallel/test-crypto-dh-group-setters.js b/test/parallel/test-crypto-dh-group-setters.js
index 37d0a44d0e1e..ccc370e2352d 100644
--- a/test/parallel/test-crypto-dh-group-setters.js
+++ b/test/parallel/test-crypto-dh-group-setters.js
@@ -1,12 +1,14 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-modp2-views.js b/test/parallel/test-crypto-dh-modp2-views.js
index e32c515e1536..ce2d8823beec 100644
--- a/test/parallel/test-crypto-dh-modp2-views.js
+++ b/test/parallel/test-crypto-dh-modp2-views.js
@@ -5,9 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS, modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-modp2.js b/test/parallel/test-crypto-dh-modp2.js
index 0bf36f93a39a..a0ec31a1eb4f 100644
--- a/test/parallel/test-crypto-dh-modp2.js
+++ b/test/parallel/test-crypto-dh-modp2.js
@@ -5,9 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS, modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
index 0ade828eb234..9c0270304f2a 100644
--- a/test/parallel/test-crypto-dh-stateless.js
+++ b/test/parallel/test-crypto-dh-stateless.js
@@ -5,8 +5,11 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const {
+  hasOpenSSL,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
+const isBoringSSL = commonIsBoringSSL;
 
 // Error code for a key-type mismatch during (EC)DH. The underlying OpenSSL
 // error code varies by version, and in OpenSSL 4.0 by platform: some builds
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index f5d239f1d457..7b9a9d50d890 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -9,6 +9,7 @@ const crypto = require('crypto');
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 {
@@ -100,7 +101,7 @@ const {
 // Through a fluke of history, g=0 defaults to DH_GENERATOR (2).
 {
   const g = 0;
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman('abcdef', g), {
       code: 'ERR_CRYPTO_OPERATION_FAILED',
       name: 'Error'
@@ -112,7 +113,7 @@ const {
 }
 
 {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman('abcdef', Buffer.from([2])), {
       code: 'ERR_CRYPTO_OPERATION_FAILED',
       name: 'Error'
diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js
index 06c88272438a..65c373d35d25 100644
--- a/test/parallel/test-crypto-ecb.js
+++ b/test/parallel/test-crypto-ecb.js
@@ -25,14 +25,14 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 const crypto = require('crypto');
 
 if (crypto.getFips()) {
   common.skip('BF-ECB is not FIPS 140-2 compatible');
 }
 
-if (hasOpenSSL3) {
+if (hasOpenSSL(3)) {
   common.skip('Blowfish is only available with the legacy provider in ' +
     'OpenSSl 3.x');
 }
diff --git a/test/parallel/test-crypto-eddsa-variants.js b/test/parallel/test-crypto-eddsa-variants.js
index 3a75a7bf4f6f..10e9fba7e52c 100644
--- a/test/parallel/test-crypto-eddsa-variants.js
+++ b/test/parallel/test-crypto-eddsa-variants.js
@@ -8,6 +8,7 @@ const crypto = require('crypto');
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // RFC 8032 Section 7 test vectors for Ed25519, Ed25519ctx, and Ed448.
@@ -180,7 +181,7 @@ function createKeyPair(algorithm, secretKeyHex, publicKeyHex) {
 }
 
 for (const v of vectors) {
-  if (v.algorithm.startsWith('Ed448') && process.features.openssl_is_boringssl) continue;
+  if (v.algorithm.startsWith('Ed448') && isBoringSSL) continue;
   if (v.algorithm.endsWith('ctx') || v.context) {
     if (!hasOpenSSL(3, 2)) continue;
   }
diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js
index 7cafa0f2aa93..199ad68fa365 100644
--- a/test/parallel/test-crypto-encap-decap.js
+++ b/test/parallel/test-crypto-encap-decap.js
@@ -6,10 +6,14 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
 const { promisify } = require('util');
 
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 const isFips = hasFIPS(3);
 
 if (!hasOpenSSL(3) && !isBoringSSL) {
diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js
index cc65d0016269..5e003d7015b2 100644
--- a/test/parallel/test-crypto-fips-indicator-strict.js
+++ b/test/parallel/test-crypto-fips-indicator-strict.js
@@ -6,7 +6,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasFIPS,
+  hasOpenSSL,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   common.skip('BoringSSL does not support FIPS');
 }
 
@@ -18,7 +24,6 @@ const { Worker } = require('node:worker_threads');
 const {
   spawnSyncAndExitWithoutError,
 } = require('../common/child_process');
-const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 const channelName = 'crypto.fips.indicator';
 const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index ea20d895b1c8..ad67ec181c7e 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support FIPS');
 
 const assert = require('assert');
@@ -14,7 +16,6 @@ const { spawnSyncAndAssert } = require('../common/child_process');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
-const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -23,11 +24,11 @@ const FIPS_ERROR_STRING2 =
   '--force-fips at startup.';
 const FIPS_UNSUPPORTED_ERROR_STRING = 'fips mode not supported';
 const FIPS_ENABLE_ERROR_STRING =
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     '--enable-fips requires an active OpenSSL provider named "fips"' :
     'OpenSSL error when trying to enable FIPS:';
 const FIPS_FORCE_ERROR_STRING =
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     '--force-fips requires an active OpenSSL provider named "fips"' :
     'OpenSSL error when trying to enable FIPS:';
 
@@ -146,7 +147,7 @@ if (!sharedOpenSSL()) {
     'require("crypto").getFips()',
     { ...process.env, 'OPENSSL_CONF': ' ' });
 
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     // Disabling FIPS mode should not throw after OpenSSL updates the default
     // property query.
     testHelper(
@@ -191,7 +192,7 @@ assert.ok(test_result === 1 || test_result === 0);
 // ("Error: Cannot set FIPS mode in a non-FIPS build.").
 // Due to this uncertainty the following tests are skipped when configured
 // with --shared-openssl.
-if (!sharedOpenSSL() && !hasOpenSSL3) {
+if (!sharedOpenSSL() && !hasOpenSSL(3)) {
   // OpenSSL config file should be able to turn on FIPS mode
   testHelper(
     'stdout',
@@ -224,7 +225,7 @@ if (!sharedOpenSSL() && !hasOpenSSL3) {
 // will not work as expected with that version.
 // TODO(danbev) Revisit these test once FIPS support is available in
 // OpenSSL 3.x.
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_OFF}`],
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index 5afd2e5a4208..faf45c766c5c 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -10,7 +10,7 @@ const {
   getCiphers,
   getCipherInfo,
 } = require('crypto');
-const { hasFIPS, hasOpenSSL3 } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -18,7 +18,7 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
-if (hasOpenSSL3) {
+if (hasOpenSSL(3)) {
   assert.deepStrictEqual(
     ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
   for (const cipher of [
@@ -54,7 +54,7 @@ if (ciphers.includes('aes-128-wrap-inv')) {
 }
 assert(!ciphers.some((cipher) => /^\d+(?:\.\d+)+$/.test(cipher)));
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // A failed provider fetch must not contaminate the OpenSSL error queue.
   assert.throws(() => createHash('sha256', { outputLength: 28 }), {
     code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH',
@@ -63,7 +63,7 @@ if (!process.features.openssl_is_boringssl) {
 
 for (const cipher of ciphers) {
   const info = getCipherInfo(cipher);
-  if (process.features.openssl_is_boringssl && !info) {
+  if (isBoringSSL && !info) {
     // BoringSSL reports some legacy ciphers in getCiphers() but returns no
     // info for them (e.g. des-ede3, des-ede3-ecb, rc2-40-cbc).
     common.printSkipMessage(`Skipping unsupported ${cipher} test case`);
@@ -115,7 +115,7 @@ assert(getCipherInfo('aes-128-cbc', { ivLength: 16 }));
 
 assert(!getCipherInfo('aes-128-ccm', { ivLength: 1 }));
 assert(!getCipherInfo('aes-128-ccm', { ivLength: 14 }));
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   for (let n = 7; n <= 13; n++)
     assert(getCipherInfo('aes-128-ccm', { ivLength: n }));
 } else {
@@ -126,7 +126,7 @@ assert(!getCipherInfo('aes-128-ocb', { ivLength: 16 }));
 if (hasFIPS(3)) {
   assert.strictEqual(
     getCipherInfo('aes-128-ocb', { ivLength: 12 }), undefined);
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   for (let n = 1; n < 16; n++)
     assert(getCipherInfo('aes-128-ocb', { ivLength: n }));
 } else {
diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/parallel/test-crypto-hash-stream-pipe.js
index ac851646a918..c6b9433456ea 100644
--- a/test/parallel/test-crypto-hash-stream-pipe.js
+++ b/test/parallel/test-crypto-hash-stream-pipe.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -30,10 +32,10 @@ const crypto = require('crypto');
 
 const stream = require('stream');
 const s = new stream.PassThrough();
-const h = process.features.openssl_is_boringssl ?
+const h = isBoringSSL ?
   crypto.createHash('sha512') :
   crypto.createHash('sha3-512');
-const expect = process.features.openssl_is_boringssl ?
+const expect = isBoringSSL ?
   'fba055c6fd0c5b6645407749ed7a8b41' +
   'b8f629f2163c3ca3701d864adabda1f8' +
   '93c37bf82b22fdd151ba8e357f611da4' +
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index 44734e7aeb6f..7039b2c75d5c 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -1,5 +1,7 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
@@ -189,7 +191,7 @@ assert.throws(
 }
 
 // Test XOF hash functions and the outputLength option.
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const invalidXofLength = {
     code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH',
     name: 'Error',
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index bfde3b324331..80a0a5dea4af 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,7 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -125,7 +125,7 @@ const algorithms = [
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!hasOpenSSL(3) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3) && !isBoringSSL)
   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
 
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
diff --git a/test/parallel/test-crypto-key-objects-raw.js b/test/parallel/test-crypto-key-objects-raw.js
index 024d5f6f199f..4a129d1a6185 100644
--- a/test/parallel/test-crypto-key-objects-raw.js
+++ b/test/parallel/test-crypto-key-objects-raw.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 // EC: NIST and OpenSSL curve names are both recognized for raw-public and raw-private
 {
@@ -67,7 +67,7 @@ const { hasOpenSSL } = require('../common/crypto');
     ['x25519', 'x25519_public.pem'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     rawPublicKeys.push(
       ['ed448', 'ed448_public.pem'],
       ['x448', 'x448_public.pem'],
@@ -76,7 +76,7 @@ const { hasOpenSSL } = require('../common/crypto');
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     rawPublicKeys.push(
       ['ml-dsa-44', 'ml_dsa_44_public.pem'],
       ['ml-kem-768', 'ml_kem_768_public.pem'],
@@ -122,7 +122,7 @@ if (hasOpenSSL(3, 5)) {
   const unsupportedKeyTypes = [
     ['rsa', 'rsa_public_2048.pem', 'rsa_private_2048.pem'],
   ];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     unsupportedKeyTypes.push(['dsa', 'dsa_public.pem', 'dsa_private.pem']);
   } else {
     common.printSkipMessage('Skipping unsupported dsa test case');
@@ -148,7 +148,7 @@ if (hasOpenSSL(3, 5)) {
   }
 
   // DH keys also don't support raw formats
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const privKeyObj = crypto.createPrivateKey(
       fixtures.readKey('dh_private.pem', 'ascii'));
     assert.throws(() => privKeyObj.export({ format: 'raw-private' }),
@@ -170,7 +170,7 @@ if (hasOpenSSL(3, 5)) {
 
 // PQC import throws when PQC is not supported
 if (!hasOpenSSL(3, 5)) {
-  const unsupported = process.features.openssl_is_boringssl ?
+  const unsupported = isBoringSSL ?
     // BoringSSL supports ML-DSA and ML-KEM-{768,1024}, but not ML-KEM-512 or SLH-DSA.
     ['ml-kem-512', 'slh-dsa-sha2-128f', 'slh-dsa-shake-128f'] :
     [
@@ -232,7 +232,7 @@ if (!hasOpenSSL(3, 5)) {
 }
 
 // ML-KEM: public keys of different type cannot be imported as the other type
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   const mlKem768Pub = crypto.createPublicKey(
     fixtures.readKey('ml_kem_768_public.pem', 'ascii'));
   const mlKem1024Pub = crypto.createPublicKey(
@@ -251,7 +251,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 }
 
 // ML-DSA: -44 and -65 public keys cannot be imported as the other type
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   const mlDsa44Pub = crypto.createPublicKey(
     fixtures.readKey('ml_dsa_44_public.pem', 'ascii'));
   const mlDsa65Pub = crypto.createPublicKey(
@@ -333,10 +333,10 @@ if (hasOpenSSL(3, 5)) {
     namedCurve: 'P-256',
   }), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' });
 
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
-  for (const type of process.features.openssl_is_boringssl ?
+  for (const type of isBoringSSL ?
     ['ed25519', 'x25519'] :
     ['ed25519', 'ed448', 'x25519', 'x448']) {
     const priv = crypto.createPrivateKey(
@@ -364,7 +364,7 @@ if (hasOpenSSL(3, 5)) {
 }
 
 // raw-private cannot be used for ml-kem and ml-dsa
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   for (const type of ['ml-kem-768', 'ml-dsa-44']) {
     const priv = crypto.createPrivateKey(
       fixtures.readKey(`${type.replaceAll('-', '_')}_private_seed_only.pem`, 'ascii'));
@@ -472,7 +472,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
                 { code: 'ERR_INVALID_ARG_VALUE' });
 
   // PQC raw-seed -> createPublicKey
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     const mlDsaPriv = crypto.createPrivateKey(
       fixtures.readKey('ml_dsa_44_private_seed_only.pem', 'ascii'));
     const mlDsaPub = crypto.createPublicKey(
@@ -521,10 +521,10 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
 // x25519, ed25519, x448, and ed448 cannot be used as 'ec' namedCurve values
 {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
-  for (const type of process.features.openssl_is_boringssl ?
+  for (const type of isBoringSSL ?
     ['ed25519', 'x25519'] :
     ['ed25519', 'x25519', 'ed448', 'x448']) {
     const priv = crypto.createPrivateKey(
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index ba9a05387f21..fbd2ae6ff1c4 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -27,6 +27,7 @@ const {
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
@@ -351,7 +352,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
     createPrivateKey({ key: '' });
   }, hasOpenSSL(3) ? {
     message: 'error:1E08010C:DECODER routines::unsupported',
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
     code: 'ERR_OSSL_PEM_NO_START_LINE',
     reason: 'NO_START_LINE',
@@ -384,7 +385,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   }, hasOpenSSL(3) ? {
     message: /error:1E08010C:DECODER routines::unsupported/,
     library: 'DECODER routines'
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     library: 'public key routines',
     message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR'
   } : {
@@ -439,7 +440,7 @@ for (const info of [
   const fipsUnsupported =
     rejectsXCurves && keyType.startsWith('x');
 
-  if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
+  if (isBoringSSL && keyType.endsWith('448')) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
     continue;
   }
@@ -631,7 +632,7 @@ for (const info of [
   const { keyType, namedCurve } = info;
   const fipsUnsupported = fips3 && namedCurve === 'secp256k1';
 
-  if (process.features.openssl_is_boringssl && !getCurves().includes(namedCurve)) {
+  if (isBoringSSL && !getCurves().includes(namedCurve)) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
     continue;
   }
@@ -861,7 +862,7 @@ for (const info of [
     { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Test RSA-PSS.
   {
     // This key pair does not restrict the message digest algorithm or salt
diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
index ea35facbdc7e..52c82ea5725c 100644
--- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js
+++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('not supported by BoringSSL');
 
 const assert = require('assert');
@@ -12,25 +14,23 @@ const {
   generateKeyPair,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-
 // Test async DSA key object generation.
 {
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL(3) ? 2048 : 512,
     divisorLength: 256
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL(3) ? 2048 : 512,
       divisorLength: 256
     });
 
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL(3) ? 2048 : 512,
       divisorLength: 256
     });
   }));
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index 6c7129c7efba..5d0254491cd2 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -4,20 +4,21 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('not supported by BoringSSL');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   assertApproximateSize,
   testSignVerify,
   spkiExp,
+  hasOpenSSL,
 } = require('../common/crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('not supported by BoringSSL');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
 
 // Test async DSA key generation.
 {
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
index bde6dc1d694b..9b81c700a231 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
@@ -8,12 +8,12 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // Test async elliptic curve key generation with 'jwk' encoding and named
 // curve.
 for (const curve of ['P-384', 'P-256', 'P-521', 'secp256k1']) {
-  if (process.features.openssl_is_boringssl && curve === 'secp256k1') {
+  if (isBoringSSL && curve === 'secp256k1') {
     common.printSkipMessage(`Skipping unsupported ${curve} test case`);
     continue;
   }
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
index cfef18c889b6..9985631b4093 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
@@ -8,13 +8,13 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const rejectsXCurves = hasFIPS(3, 5);
 
 // Test async elliptic curve key generation with 'jwk' encoding.
 {
   for (const type of ['ed25519', 'ed448', 'x25519', 'x448']) {
-    if (process.features.openssl_is_boringssl && type.endsWith('448')) {
+    if (isBoringSSL && type.endsWith('448')) {
       common.printSkipMessage(`Skipping unsupported ${type} test case`);
       continue;
     }
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
index 246cbe5dd1ac..cd7e59be97fa 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
@@ -4,20 +4,21 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('BoringSSL does not support paramEncoding: explicit');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
+  hasOpenSSL,
 } = require('../common/crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('BoringSSL does not support paramEncoding: explicit');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
 // private key with paramEncoding explicit.
@@ -43,7 +44,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index 081e709f46ec..5c0878fc634f 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -4,14 +4,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('BoringSSL does not support paramEncoding: explicit');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   hasFIPS,
   testSignVerify,
   spkiExp,
@@ -19,6 +13,14 @@ const {
   hasOpenSSL,
 } = require('../common/crypto');
 
+if (isBoringSSL)
+  common.skip('BoringSSL does not support paramEncoding: explicit');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
+
 {
   // Test async explicit elliptic curve key generation with an encrypted
   // private key.
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
index 8084cdfc0b3b..e6209a09041d 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
@@ -4,18 +4,20 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  testSignVerify,
+  spkiExp,
+  sec1Exp,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support paramEncoding: explicit');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const {
-  testSignVerify,
-  spkiExp,
-  sec1Exp,
-} = require('../common/crypto');
 
 // Test async explicit elliptic curve key generation, e.g. for ECDSA,
 // with a SEC1 private key with paramEncoding explicit.
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
index 4c11401d0fc5..ba86fcdb94e3 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
@@ -12,7 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -39,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 52765f3d7fe7..90d32cd73bc4 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -4,7 +4,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support arbitrary RSA modulus length ' +
               'or RSA-PSS/DSA key generation');
 
@@ -12,7 +18,6 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
 
diff --git a/test/parallel/test-crypto-keygen-dh-classic.js b/test/parallel/test-crypto-keygen-dh-classic.js
index 13c5db2d0603..a78d068ef79d 100644
--- a/test/parallel/test-crypto-keygen-dh-classic.js
+++ b/test/parallel/test-crypto-keygen-dh-classic.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support DH key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // Test classic Diffie-Hellman key generation.
 {
diff --git a/test/parallel/test-crypto-keygen-eddsa.js b/test/parallel/test-crypto-keygen-eddsa.js
index 5dbdf9a7aeea..0f9f8421ce77 100644
--- a/test/parallel/test-crypto-keygen-eddsa.js
+++ b/test/parallel/test-crypto-keygen-eddsa.js
@@ -8,13 +8,13 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const rejectsXCurves = hasFIPS(3, 5);
 
 // Test EdDSA key generation.
 {
   for (const keyType of ['ed25519', 'ed448', 'x25519', 'x448']) {
-    if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
+    if (isBoringSSL && keyType.endsWith('448')) {
       common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
       continue;
     }
diff --git a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
index 9d1fdf23bc0b..91ace4caff67 100644
--- a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
+++ b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support DSA key pair generation');
 
 const assert = require('assert');
@@ -12,7 +14,6 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
 
diff --git a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
index 778899972863..44243791b38f 100644
--- a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
+++ b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // 'rsa-pss' should not add a RSASSA-PSS-params sequence by default.
 // Regression test for: https://github.com/nodejs/node/issues/39936
diff --git a/test/parallel/test-crypto-keygen-raw.js b/test/parallel/test-crypto-keygen-raw.js
index 41ef9362dcac..e748830757f8 100644
--- a/test/parallel/test-crypto-keygen-raw.js
+++ b/test/parallel/test-crypto-keygen-raw.js
@@ -11,14 +11,14 @@ const {
   createPublicKey,
   createPrivateKey,
 } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const rejectsXCurves = hasFIPS(3, 5);
 
 // Test generateKeyPairSync with raw encoding for EdDSA/ECDH key types.
 {
   const types = ['ed25519', 'x25519'];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     types.push('ed448', 'x448');
   }
   for (const type of types) {
@@ -59,7 +59,7 @@ const rejectsXCurves = hasFIPS(3, 5);
 // Test async generateKeyPair with raw encoding for EdDSA/ECDH key types.
 {
   const types = ['ed25519', 'x25519'];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     types.push('ed448', 'x448');
   }
   for (const type of types) {
@@ -174,7 +174,7 @@ const rejectsXCurves = hasFIPS(3, 5);
 }
 
 // Test error: raw with DSA.
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert.throws(() => generateKeyPairSync('dsa', {
     modulusLength: 2048,
     publicKeyEncoding: { format: 'raw-public' },
@@ -221,7 +221,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // PQC key types
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   // Test raw encoding for ML-DSA key types (raw-public + raw-seed only).
   {
     for (const type of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) {
@@ -248,7 +248,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   // Test raw encoding for ML-KEM key types (raw-public + raw-seed only).
   {
     for (const type of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
-      if (process.features.openssl_is_boringssl && type === 'ml-kem-512') {
+      if (isBoringSSL && type === 'ml-kem-512') {
         common.printSkipMessage(`Skipping unsupported ${type} test case`);
         continue;
       }
@@ -275,7 +275,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   // Test raw encoding for SLH-DSA key types.
   {
     for (const type of ['slh-dsa-sha2-128f', 'slh-dsa-shake-128f']) {
-      if (process.features.openssl_is_boringssl) {
+      if (isBoringSSL) {
         common.printSkipMessage(`Skipping unsupported ${type} test case`);
         continue;
       }
@@ -290,7 +290,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   }
 
   // Test error: raw-seed with SLH-DSA (not supported).
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.throws(() => generateKeyPairSync('slh-dsa-sha2-128f', {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-seed' },
diff --git a/test/parallel/test-crypto-keygen-rfc8017-9-1.js b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
index 3234084afe10..e1781093c0c2 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-9-1.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // RFC 8017, 9.1.: "Assuming that the mask generation function is based on a
 // hash function, it is RECOMMENDED that the hash function be the same as the
diff --git a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
index f7cb70560e7e..f1543462c394 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // RFC 8017, A.2.3.: "For a given hashAlgorithm, the default value of
 // saltLength is the octet length of the hash value."
diff --git a/test/parallel/test-crypto-keygen-rsa-pss.js b/test/parallel/test-crypto-keygen-rsa-pss.js
index 88d522a223b9..386db4fe0115 100644
--- a/test/parallel/test-crypto-keygen-rsa-pss.js
+++ b/test/parallel/test-crypto-keygen-rsa-pss.js
@@ -4,7 +4,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasFIPS,
+  testEncryptDecrypt,
+  testSignVerify,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
@@ -12,11 +19,6 @@ const {
   constants,
   generateKeyPair,
 } = require('crypto');
-const {
-  hasFIPS,
-  testEncryptDecrypt,
-  testSignVerify,
-} = require('../common/crypto');
 
 // Test RSA-PSS.
 {
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index c525a54aa434..a68c7c07c936 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -14,8 +14,11 @@ const {
 } = require('crypto');
 const { inspect } = require('util');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const {
+  hasOpenSSL,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
+const isBoringSSL = commonIsBoringSSL;
 
 // Test invalid parameter encoding.
 {
@@ -379,7 +382,7 @@ const isBoringSSL = process.features.openssl_is_boringssl;
   let invalidExponentError = /bad e value/;
   if (isBoringSSL) {
     invalidExponentError = /BAD_E_VALUE/;
-  } else if (hasOpenSSL3) {
+  } else if (hasOpenSSL(3)) {
     invalidExponentError = /exponent/;
   }
   for (const publicExponent of [1, 1 + 0x10001]) {
diff --git a/test/parallel/test-crypto-mac-cache-snapshot.js b/test/parallel/test-crypto-mac-cache-snapshot.js
index 1fd37367d2a8..024a4afe8c36 100644
--- a/test/parallel/test-crypto-mac-cache-snapshot.js
+++ b/test/parallel/test-crypto-mac-cache-snapshot.js
@@ -4,8 +4,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (!hasOpenSSL(3) || isBoringSSL)
   common.skip('this test requires OpenSSL 3 EVP_MAC support');
 
 const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-mac-cache.js b/test/parallel/test-crypto-mac-cache.js
index dfe99e943bb2..a836ef92657e 100644
--- a/test/parallel/test-crypto-mac-cache.js
+++ b/test/parallel/test-crypto-mac-cache.js
@@ -5,8 +5,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (!hasOpenSSL(3) || isBoringSSL)
   common.skip('this test requires OpenSSL 3 EVP_MAC support');
 
 const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js
index 43e464bb737e..8bc8cebfcf51 100644
--- a/test/parallel/test-crypto-mac-errors.js
+++ b/test/parallel/test-crypto-mac-errors.js
@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 EVP_MAC support is required');
 }
 
diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js
index 68bb79f301e5..1721e9d1c1a7 100644
--- a/test/parallel/test-crypto-mac-unsupported.js
+++ b/test/parallel/test-crypto-mac-unsupported.js
@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (hasOpenSSL3 && !process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3) && !isBoringSSL) {
   common.skip('this test requires a build without EVP_MAC support');
 }
 
diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js
index ec9f0cffe877..19544ccf4ec1 100644
--- a/test/parallel/test-crypto-mac-vectors.js
+++ b/test/parallel/test-crypto-mac-vectors.js
@@ -8,9 +8,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 EVP_MAC support is required');
 }
 
diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js
index f41bd86509eb..c275b87a0e6c 100644
--- a/test/parallel/test-crypto-mac.js
+++ b/test/parallel/test-crypto-mac.js
@@ -8,9 +8,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 EVP_MAC support is required');
 }
 
diff --git a/test/parallel/test-crypto-negative-zero.js b/test/parallel/test-crypto-negative-zero.js
index 0af9220569c3..0e9525fcaf6c 100644
--- a/test/parallel/test-crypto-negative-zero.js
+++ b/test/parallel/test-crypto-negative-zero.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 function getOutcome(fn) {
   try {
@@ -110,7 +110,7 @@ function assertSameErrorOrSuccess(actual, expected) {
                          }));
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert.strictEqual(
     crypto.createHash('shake128', { outputLength: -0 }).digest('hex'),
     '',
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index 90d19ff97fcb..06aab7614ff5 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('node:assert/strict');
diff --git a/test/parallel/test-crypto-oneshot-hash-xof.js b/test/parallel/test-crypto-oneshot-hash-xof.js
index 656e7944396e..46b60b22c755 100644
--- a/test/parallel/test-crypto-oneshot-hash-xof.js
+++ b/test/parallel/test-crypto-oneshot-hash-xof.js
@@ -1,13 +1,15 @@
 'use strict';
+
 // This tests crypto.hash() works.
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto) common.skip('missing crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('BoringSSL does not support XOF hash functions');
 }
 
diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
index 6e7a7fffee58..dce34409400a 100644
--- a/test/parallel/test-crypto-padding.js
+++ b/test/parallel/test-crypto-padding.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // Input data.
 const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -83,7 +83,7 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
 assert.throws(function() {
   // Input must have block length %.
   enc(ODD_LENGTH_PLAIN, false);
-}, hasOpenSSL3 ? {
+}, hasOpenSSL(3) ? {
   message: /wrong[\s_]final[\s_]block[\s_]length/i,
   code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
   reason: /wrong[\s_]final[\s_]block[\s_]length/i,
diff --git a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
index 8f2a10725c94..f4e1d781abc3 100644
--- a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
+++ b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -21,7 +21,7 @@ const algorithms = new Set([
   'ml-kem-512', 'ml-kem-768', 'ml-kem-1024',
 ]);
 // BoringSSL does not support ML-KEM-512.
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   algorithms.delete('ml-kem-512');
 }
 
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
index f2a19799c515..cd8f8c926f5b 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [
     }
   }
 
-  if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+  if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
       code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
     });
@@ -120,7 +120,7 @@ for (const [asymmetricKeyType, pubLen] of [
         [keys.private_seed_only, true, true],
         [keys.private_priv_only, false, false],
       ]) {
-        if (process.features.openssl_is_boringssl && !seedOnly) {
+        if (isBoringSSL && !seedOnly) {
           common.printSkipMessage('Skipping unsupported private key format test');
           continue;
         }
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
index 81353b5115dd..d08a479f421c 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [
     }
   }
 
-  if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+  if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
       code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
     });
@@ -110,7 +110,7 @@ for (const [asymmetricKeyType, pubLen] of [
         code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
       });
     }
-  } else if (process.features.openssl_is_boringssl && asymmetricKeyType === 'ml-kem-512') {
+  } else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') {
     // BoringSSL does not support ML-KEM-512.
     assert.throws(() => createPublicKey(keys.public),
                   { code: 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' });
@@ -123,7 +123,7 @@ for (const [asymmetricKeyType, pubLen] of [
     assertPublicKey(publicKey);
 
     {
-      const entries = process.features.openssl_is_boringssl ?
+      const entries = isBoringSSL ?
         // BoringSSL only supports the seed-only PKCS#8 private key encoding.
         [[keys.private_seed_only, true]] :
         [
diff --git a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
index e6534c988c4e..9f9b25bed8b0 100644
--- a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
@@ -4,14 +4,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   for (const asymmetricKeyType of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) {
     assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), {
       code: 'ERR_INVALID_ARG_VALUE',
diff --git a/test/parallel/test-crypto-pqc-keygen-ml-kem.js b/test/parallel/test-crypto-pqc-keygen-ml-kem.js
index 620f65c3a8d1..bcc5e5996683 100644
--- a/test/parallel/test-crypto-pqc-keygen-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-keygen-ml-kem.js
@@ -4,19 +4,19 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
 
-const algorithms = process.features.openssl_is_boringssl ?
+const algorithms = isBoringSSL ?
   // BoringSSL does not support ML-KEM-512.
   ['ml-kem-768', 'ml-kem-1024'] :
   ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024'];
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   for (const asymmetricKeyType of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
     assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), {
       code: 'ERR_INVALID_ARG_VALUE',
@@ -72,7 +72,7 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
   }
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   assert.throws(() => generateKeyPair('ml-kem-512', common.mustNotCall()), {
     code: 'ERR_INVALID_ARG_VALUE',
     message: /The argument 'type' must be a supported key type/
diff --git a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
index 535e6a33d5cc..e095269bf610 100644
--- a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -39,7 +39,7 @@ for (const [asymmetricKeyType, sigLen] of [
     [keys.private_seed_only, true],
     [keys.private_priv_only, false],
   ]) {
-    if (process.features.openssl_is_boringssl && !seedOnly) {
+    if (isBoringSSL && !seedOnly) {
       common.printSkipMessage('Skipping unsupported private key format test');
       continue;
     }
@@ -52,7 +52,7 @@ for (const [asymmetricKeyType, sigLen] of [
         assert.strictEqual(verify(undefined, data, keys.public, Buffer.alloc(sigLen)), false);
         assert.strictEqual(verify(undefined, data, keys.public, signature), true);
         assert.strictEqual(verify(undefined, data, privateKey, signature), true);
-        const code = process.features.openssl_is_boringssl ?
+        const code = isBoringSSL ?
           'ERR_OSSL_EVP_COMMAND_NOT_SUPPORTED' : 'ERR_OSSL_INVALID_DIGEST';
         assert.throws(() => sign('sha256', data, privateKey), { code });
         assert.throws(
@@ -72,7 +72,7 @@ for (const [asymmetricKeyType, sigLen] of [
           }));
         }));
 
-        const message = process.features.openssl_is_boringssl ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/;
+        const message = isBoringSSL ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/;
         sign('sha256', data, privateKey, common.expectsError(message));
         verify('sha256', data, keys.public, Buffer.alloc(sigLen), common.expectsError(message));
       }
diff --git a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
index 1afc5df8d94d..3ca57279c00f 100644
--- a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
+++ b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
@@ -5,12 +5,12 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
 
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const entry = fixtures.path('snapshot', 'crypto-provider-cipher-cache.js');
diff --git a/test/parallel/test-crypto-provider-cipher-cache.js b/test/parallel/test-crypto-provider-cipher-cache.js
index bde9988480ed..3654ae982435 100644
--- a/test/parallel/test-crypto-provider-cipher-cache.js
+++ b/test/parallel/test-crypto-provider-cipher-cache.js
@@ -5,8 +5,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3)
+const { hasOpenSSL } = require('../common/crypto');
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('assert');
diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js
index 609d00d7f7b0..ecccc02f01e4 100644
--- a/test/parallel/test-crypto-provider-hash-options.js
+++ b/test/parallel/test-crypto-provider-hash-options.js
@@ -3,12 +3,14 @@
 
 const common = require('../common');
 
+const { isBoringSSL } = require('../common/crypto');
+
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
 if (Number(process.versions.openssl.split('.')[0]) < 4 ||
-    process.features.openssl_is_boringssl) {
+    isBoringSSL) {
   common.skip('OpenSSL 4 provider support is required');
 }
 
diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js
index 166efaa0d7fd..1cf453f9b22b 100644
--- a/test/parallel/test-crypto-provider-hashes.js
+++ b/test/parallel/test-crypto-provider-hashes.js
@@ -26,9 +26,9 @@ const {
   sign,
   verify,
 } = require('node:crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3 || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 provider support is required');
 }
 
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index bda98652cf59..7c56dcd28dc8 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -12,6 +12,7 @@ const fixtures = require('../common/fixtures');
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 const fips3 = hasFIPS(3);
 const fips35 = hasFIPS(3, 5);
@@ -74,7 +75,7 @@ const openssl1DecryptError = {
 const decryptError = fips4 ?
   { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
     { message: 'error:1C800064:Provider routines::bad decrypt' } :
-    process.features.openssl_is_boringssl ? {
+    isBoringSSL ? {
       message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
       code: 'ERR_OSSL_BAD_DECRYPT',
       reason: 'BAD_DECRYPT',
@@ -87,7 +88,7 @@ const decryptPrivateKeyError = fips4 ? {
   code: 'ERR_OSSL_BAD_DECRYPT',
 } : hasOpenSSL(3) ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
-} : process.features.openssl_is_boringssl ? {
+} : isBoringSSL ? {
   message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
 } : openssl1DecryptError;
 
@@ -373,7 +374,7 @@ function test_rsa(padding, encryptOaepHash, decryptOaepHash) {
 test_rsa('RSA_NO_PADDING');
 test_rsa('RSA_PKCS1_OAEP_PADDING');
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   test_rsa('RSA_PKCS1_PADDING');
 } else {
   common.printSkipMessage('Skipping unsupported RSA_PKCS1_PADDING test case');
@@ -548,7 +549,7 @@ assert.throws(() => {
 //
 // Test DSA signing and verification
 //
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const input = 'I AM THE WALRUS';
 
   // DSA signatures vary across runs so there is no static string to verify
@@ -586,7 +587,7 @@ if (!process.features.openssl_is_boringssl) {
 //
 // Test DSA signing and verification with PKCS#8 private key
 //
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const input = 'I AM THE WALRUS';
 
   // DSA signatures vary across runs so there is no static string to verify
@@ -618,7 +619,7 @@ const input = 'I AM THE WALRUS';
   }, decryptPrivateKeyError);
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // DSA signatures vary across runs so there is no static string to verify
   // against.
   const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
diff --git a/test/parallel/test-crypto-scrypt.js b/test/parallel/test-crypto-scrypt.js
index 3012a8fa55d5..0f033e05d6d2 100644
--- a/test/parallel/test-crypto-scrypt.js
+++ b/test/parallel/test-crypto-scrypt.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const isFips = hasFIPS(3);
 
 if (typeof crypto.scrypt !== 'function' || typeof crypto.scryptSync !== 'function')
@@ -203,7 +203,7 @@ for (const options of toobig) {
   const expected = isFips ? {
     code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
   } : {
-    message: process.features.openssl_is_boringssl ?
+    message: isBoringSSL ?
       /Invalid scrypt params:.*(INVALID_PARAMETERS|MEMORY_LIMIT_EXCEEDED)/ :
       /Invalid scrypt params:.*memory limit exceeded/,
     code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js
index f2c0e3900624..ff32b29bb2b7 100644
--- a/test/parallel/test-crypto-sec-level.js
+++ b/test/parallel/test-crypto-sec-level.js
@@ -2,6 +2,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -15,7 +17,7 @@ const assert = require('assert');
 // This test simply validates that we can get some value for the secLevel
 // when needed by tests.
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   assert.strictEqual(secLevel, 0);
 } else {
   assert.ok(secLevel >= 0 && secLevel <= 5);
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 8bd93c5281da..edf4a6d4667f 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -13,14 +13,19 @@ if (common.isASan) {
   common.skip('ASan does not play well with secure heap allocations');
 }
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   common.skip('BoringSSL does not support secure heap');
 }
 
 const assert = require('assert');
 const { fork } = require('child_process');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const {
   secureHeapUsed,
   createDiffieHellman,
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index e8398c21bafd..4b874a7e43fb 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -12,6 +12,7 @@ const {
   hasOpenSSL,
   hasFIPS,
   opensslCli,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // Test certificates
@@ -80,7 +81,7 @@ if (fips30) {
       });
   }, { message: hasOpenSSL(3) ?
     'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
-    process.features.openssl_is_boringssl ?
+    isBoringSSL ?
       'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
       'bye, bye, error stack' });
 
@@ -376,7 +377,7 @@ assert.throws(
   }, hasOpenSSL(3) ? {
     code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /illegal or unsupported padding mode/,
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/,
   } : {
@@ -460,7 +461,7 @@ for (const pair of [
     raw: true },
   { private: fixtures.readKey('ed448_private.pem', 'ascii'),
     public: fixtures.readKey('ed448_public.pem', 'ascii'),
-    skip: process.features.openssl_is_boringssl,
+    skip: isBoringSSL,
     algo: null,
     supportsContext: hasOpenSSL(3, 2),
     sigLen: 114,
@@ -721,7 +722,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
   const keys = [['ec-key.pem', 64], dsaKey];
 
   for (const [file, length] of keys) {
-    if (process.features.openssl_is_boringssl && file.startsWith('dsa_')) {
+    if (isBoringSSL && file.startsWith('dsa_')) {
       common.printSkipMessage(`Skipping unsupported ${file} test case`);
       continue;
     }
@@ -857,7 +858,7 @@ if (!opensslCli) {
   }));
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Test RSA-PSS.
   {
     // This key pair does not restrict the message digest algorithm or salt
@@ -1022,7 +1023,7 @@ if (!process.features.openssl_is_boringssl) {
   // Ed25519 and Ed448 must use the one-shot methods
   const keys = [{ privateKey: fixtures.readKey('ed25519_private.pem', 'ascii'),
                   publicKey: fixtures.readKey('ed25519_public.pem', 'ascii') }];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     keys.push({ privateKey: fixtures.readKey('ed448_private.pem', 'ascii'),
                 publicKey: fixtures.readKey('ed448_public.pem', 'ascii') });
   } else {
@@ -1042,7 +1043,7 @@ if (!process.features.openssl_is_boringssl) {
   }
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Dh, x25519 and x448 should not be used for signing/verifying
   // https://github.com/nodejs/node/issues/53742
   for (const algo of ['dh', 'x25519', 'x448']) {
diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
index ed0916b036a9..9584e48f2cbd 100644
--- a/test/parallel/test-crypto-stream.js
+++ b/test/parallel/test-crypto-stream.js
@@ -28,7 +28,7 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const stream = require('stream');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 if (!crypto.getFips()) {
   // Small stream to buffer converter
@@ -73,7 +73,7 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
 const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
 
 cipher.pipe(decipher)
-  .on('error', common.expectsError((hasOpenSSL3 || process.features.openssl_is_boringssl) ? {
+  .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? {
     message: /bad[\s_]decrypt/i,
     library: /Provider routines|Cipher functions/,
     reason: /bad[\s_]decrypt/i,
diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
index 353699cf9117..c1416fd0703a 100644
--- a/test/parallel/test-crypto-x509.js
+++ b/test/parallel/test-crypto-x509.js
@@ -19,7 +19,7 @@ const {
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { readFileSync } = require('fs');
 
 const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
@@ -28,8 +28,8 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
 
 const privateKey = createPrivateKey(key);
 
-if (!process.features.openssl_is_boringssl) {
-  const expectedPubkeys = hasOpenSSL3 ? [
+if (!isBoringSSL) {
+  const expectedPubkeys = hasOpenSSL(3) ? [
     [
       'rsa_pss_cert_2048.pem',
       292,
@@ -88,7 +88,7 @@ emailAddress=ry@tinyclouds.org`;
 
 let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
 CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   infoAccessCheck += '\n';
 
 const der = Buffer.from(
@@ -156,7 +156,7 @@ const der = Buffer.from(
 
   assert.deepStrictEqual(x509.raw, der);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(x509.validFromDate, new Date('2022-09-03T21:40:37Z'));
     assert.deepStrictEqual(x509.validToDate, new Date('2296-06-17T21:40:37Z'));
   }
@@ -399,10 +399,10 @@ tAt3hIKFD1bJt6c6WtMH2Su3syosWxmdmGk5ihslB00lvLpfj/wed8i3bkcB1doq
 UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
 -----END CERTIFICATE-----`;
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const cert = new X509Certificate(certPem);
     assert.throws(() => cert.publicKey, {
-      message: hasOpenSSL3 ? /decode error/ : /wrong tag/,
+      message: hasOpenSSL(3) ? /decode error/ : /wrong tag/,
       name: 'Error'
     });
 
@@ -446,7 +446,7 @@ UidvpWWipVLZgK+oDks+bKTobcoXGW9oXobiIYqslXPy
 -----END CERTIFICATE-----`.trim();
   const c1 = new X509Certificate(certPemUTCTime);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(c1.validFromDate, new Date('1949-12-25T23:59:58Z'));
     assert.deepStrictEqual(c1.validToDate, new Date('1950-01-01T23:59:58Z'));
   }
@@ -483,7 +483,7 @@ CWwQO8JZjJqFtqtuzy2n+gLCvqePgG/gmSqHOPm2ZbLW
 -----END CERTIFICATE-----`.trim();
   const c2 = new X509Certificate(certPemGeneralizedTime);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(c2.validFromDate, new Date('2049-12-26T00:00:01Z'));
     assert.deepStrictEqual(c2.validToDate, new Date('2050-01-02T00:00:01Z'));
   }
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 047f051d1e94..3e431c788c62 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,7 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const isFips = hasFIPS(3);
 
 // Test Certificates
@@ -154,7 +154,7 @@ assert(crypto.getHashes().includes('sha1'));
 assert(crypto.getHashes().includes('sha256'));
 assert(!crypto.getHashes().includes('SHA1'));
 assert(!crypto.getHashes().includes('SHA256'));
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert(crypto.getHashes().includes('RSA-SHA1'));
   assert(!crypto.getHashes().includes('rsa-sha1'));
 }
@@ -230,7 +230,7 @@ assert.throws(() => {
     assert.throws(() => { throw err; }, {
       code: 'ERR_OSSL_INVALID_KEY_LENGTH',
     });
-  } else if (process.features.openssl_is_boringssl) {
+  } else if (isBoringSSL) {
     // BoringSSL rejects the tiny RSA key while decoding it, before signing.
     assert.throws(() => { throw err; }, {
       name: 'Error',
@@ -270,7 +270,7 @@ if (!hasOpenSSL(3)) {
   const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem',
                                            'ascii');
 
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
     const signature = crypto.createSign('sha1').sign(sha1_privateKey);
     assert(Buffer.isBuffer(signature));
diff --git a/test/parallel/test-https-agent-additional-options.js b/test/parallel/test-https-agent-additional-options.js
index 3707855ed5c8..eca5f147a419 100644
--- a/test/parallel/test-https-agent-additional-options.js
+++ b/test/parallel/test-https-agent-additional-options.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const https = require('https');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const fips3 = hasFIPS(3);
 
@@ -17,7 +17,7 @@ const options = {
   minVersion: fips3 ? 'TLSv1.2' : 'TLSv1.1',
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   options.ciphers = fips3 ?
     'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
 }
@@ -36,7 +36,7 @@ function getBaseOptions(port) {
     servername: 'agent1',
   };
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     baseOptions.ciphers = fips3 ?
       'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
   }
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index 971a8f359a6f..c4edc5b33db3 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const https = require('https');
 const { constants: { SSL_OP_NO_TICKET } } = require('crypto');
@@ -25,7 +25,7 @@ if (fips3) {
   options.maxVersion = 'TLSv1.3';
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   options.ciphers = fips3 ?
     'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
diff --git a/test/parallel/test-https-agent-session-reuse.js b/test/parallel/test-https-agent-session-reuse.js
index c5b7b78b8e02..da110e4aeb73 100644
--- a/test/parallel/test-https-agent-session-reuse.js
+++ b/test/parallel/test-https-agent-session-reuse.js
@@ -1,11 +1,13 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
 }
diff --git a/test/parallel/test-https-client-renegotiation-limit.js b/test/parallel/test-https-client-renegotiation-limit.js
index 729176b7c1aa..ee83c21c8762 100644
--- a/test/parallel/test-https-client-renegotiation-limit.js
+++ b/test/parallel/test-https-client-renegotiation-limit.js
@@ -20,12 +20,14 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-https-options-boolean-check.js b/test/parallel/test-https-options-boolean-check.js
index fa02a165b80f..776e966211c7 100644
--- a/test/parallel/test-https-options-boolean-check.js
+++ b/test/parallel/test-https-options-boolean-check.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff);
 const caArrDataView = toDataView(caCert);
 
 function filterBoringSSLKeyCertArrayCases(options, setName) {
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     return options;
 
   // The array-valued cases exercise multi-identity key/cert handling.
diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js
index ca2f240a9520..f97657051ca9 100644
--- a/test/parallel/test-permission-openssl-store.js
+++ b/test/parallel/test-permission-openssl-store.js
@@ -4,8 +4,8 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3)
+const { hasOpenSSL } = require('../common/crypto');
+if (!hasOpenSSL(3))
   common.skip('requires OpenSSL 3.x');
 
 // Verifies the openssl.store permission: allowed when --allow-openssl-store is
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 8349d4c3af6f..f5aeec017964 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -5,7 +5,7 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 const rootDir = path.resolve(__dirname, '..', '..');
 const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   documented.delete('--openssl-legacy-provider');
   documented.delete('--openssl-shared-config');
 }
@@ -63,8 +63,8 @@ const conditionalOpts = [
     filter: (opt) => {
       return [
         '--openssl-config',
-        hasOpenSSL3 ? '--openssl-legacy-provider' : '',
-        hasOpenSSL3 ? '--openssl-shared-config' : '',
+        hasOpenSSL(3) ? '--openssl-legacy-provider' : '',
+        hasOpenSSL(3) ? '--openssl-shared-config' : '',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 14ac88d76cd2..420625b01f59 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -104,12 +104,12 @@ assert.match(
 assert.match(process.versions.modules, /^\d+$/);
 
 if (common.hasCrypto) {
-  const { hasOpenSSL3 } = require('../common/crypto');
+  const { hasOpenSSL } = require('../common/crypto');
   assert.match(process.versions.ncrypto, commonTemplate);
   if (process.config.variables.node_shared_openssl) {
     assert.ok(process.versions.openssl);
   } else {
-    const versionRegex = hasOpenSSL3 ?
+    const versionRegex = hasOpenSSL(3) ?
       // The following also matches a development version of OpenSSL 3.x which
       // can be in the format '3.0.0-alpha4-dev'. This can be handy when
       // building and linking against the main development branch of OpenSSL.
diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
index c319e766ce8a..1b80571e70e6 100644
--- a/test/parallel/test-tls-alert-handling.js
+++ b/test/parallel/test-tls-alert-handling.js
@@ -6,7 +6,8 @@ if (!common.hasCrypto) {
 }
 
 const {
-  hasOpenSSL3,
+  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const assert = require('assert');
@@ -38,7 +39,7 @@ const errorHandler = common.mustCall((err) => {
   assert.match(err.code,
                /ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/);
   assert.strictEqual(err.library, 'SSL routines');
-  if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+  if (!hasOpenSSL(3) && !isBoringSSL)
     assert.strictEqual(err.function, 'ssl3_get_record');
   assert.match(err.reason,
                /wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i);
@@ -99,7 +100,7 @@ function sendBADTLSRecord() {
     assert.match(err.code,
                  /ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/);
     assert.strictEqual(err.library, 'SSL routines');
-    if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+    if (!hasOpenSSL(3) && !isBoringSSL)
       assert.strictEqual(err.function, 'ssl3_read_bytes');
     assert.match(err.reason,
                  /tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i);
diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js
index f20bf42a2dcd..5c229d7e05cd 100644
--- a/test/parallel/test-tls-alert.js
+++ b/test/parallel/test-tls-alert.js
@@ -29,6 +29,7 @@ const {
   hasOpenSSL,
   hasFIPS,
   opensslCli,
+  isBoringSSL,
 } = require('../common/crypto');
 
 if (!opensslCli) {
@@ -56,7 +57,7 @@ if (hasFIPS(3)) {
 }
 
 const server = tls.Server(serverOptions, null).listen(0, common.mustCall(() => {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     let gotClientError = false;
     let gotServerError = false;
     function maybeClose() {
diff --git a/test/parallel/test-tls-cert-ext-encoding.js b/test/parallel/test-tls-cert-ext-encoding.js
index 154e0cdcf022..973e9fad32ee 100644
--- a/test/parallel/test-tls-cert-ext-encoding.js
+++ b/test/parallel/test-tls-cert-ext-encoding.js
@@ -3,9 +3,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (hasOpenSSL3)
+if (hasOpenSSL(3))
   // TODO(danbev) This test fails with the following error:
   // error:0D00008F:asn1 encoding routines::no matching choice type
   //
diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js
index 517054c6e290..da06156e2e07 100644
--- a/test/parallel/test-tls-client-auth.js
+++ b/test/parallel/test-tls-client-auth.js
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const {
   assert, connect, keys, tls
@@ -111,7 +111,7 @@ if (tls.DEFAULT_MAX_VERSION === 'TLSv1.3') connect({
   // and sends a fatal Alert to the client that the client discovers there has
   // been a fatal error.
   pair.client.conn.once('error', common.mustCall((err) => {
-    const expectedErr = process.features.openssl_is_boringssl ?
+    const expectedErr = isBoringSSL ?
       'ERR_SSL_TLSV1_ALERT_CERTIFICATE_REQUIRED' :
       'ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED';
     assert.strictEqual(err.code, expectedErr);
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index 638df3ff0141..f1c179db8fae 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -3,13 +3,18 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testEphemeralKeyInfo();
   return;
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index 8f3b2eafbb8a..f08be448dd19 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -13,7 +13,7 @@ const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const fips3 = hasFIPS(3);
 const fips4 = hasFIPS(4);
 
@@ -88,7 +88,7 @@ function testDHE3072() {
   test(3072, false, null);
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   if (fips3 && !fips4) {
     // The FIPS provider rejects explicit DH parameters without a validated
     // subgroup, while OpenSSL's built-in FFDHE group remains available.
@@ -129,7 +129,7 @@ for (const minDHSize of [true, false, null, undefined, {}, [], '', '1']) {
   });
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   process.on('exit', function() {
     assert.strictEqual(nsuccess, 1);
     assert.strictEqual(nerror, 1);
diff --git a/test/parallel/test-tls-client-reject.js b/test/parallel/test-tls-client-reject.js
index cff0aabc89a7..90e3127ba471 100644
--- a/test/parallel/test-tls-client-reject.js
+++ b/test/parallel/test-tls-client-reject.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -31,7 +33,7 @@ const fixtures = require('../common/fixtures');
 const options = {
   key: fixtures.readKey('rsa_private.pem'),
   cert: fixtures.readKey('rsa_cert.crt'),
-  ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+  ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
 };
 
 const server = tls.createServer(options, function(socket) {
@@ -48,7 +50,7 @@ function unauthorized() {
     port: server.address().port,
     servername: 'localhost',
     rejectUnauthorized: false,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(function() {
     let _data;
     assert(!socket.authorized);
@@ -70,7 +72,7 @@ function rejectUnauthorized() {
   console.log('reject unauthorized');
   const socket = tls.connect(server.address().port, {
     servername: 'localhost',
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustNotCall());
   socket.on('data', common.mustNotCall());
   socket.on('error', common.mustCall(function(err) {
@@ -84,7 +86,7 @@ function rejectUnauthorizedUndefined() {
   const socket = tls.connect(server.address().port, {
     servername: 'localhost',
     rejectUnauthorized: undefined,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustNotCall());
   socket.on('data', common.mustNotCall());
   socket.on('error', common.mustCall(function(err) {
@@ -98,7 +100,7 @@ function authorized() {
   const socket = tls.connect(server.address().port, {
     ca: [fixtures.readKey('rsa_cert.crt')],
     servername: 'localhost',
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(function() {
     console.log('... authorized');
     assert(socket.authorized);
diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
index 80c4753d065e..33e74af13eda 100644
--- a/test/parallel/test-tls-client-renegotiation-13.js
+++ b/test/parallel/test-tls-client-renegotiation-13.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const fixtures = require('../common/fixtures');
 
@@ -32,7 +32,7 @@ connect({
   assert.strictEqual(client.getProtocol(), 'TLSv1.3');
 
   const ok = client.renegotiate({}, common.mustCall((err) => {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.throws(() => { throw err; }, {
         message: 'TLS session renegotiation is unsupported by this TLS ' +
                  'implementation',
@@ -40,7 +40,7 @@ connect({
       });
     } else {
       assert.throws(() => { throw err; }, {
-        message: hasOpenSSL3 ?
+        message: hasOpenSSL(3) ?
           'error:0A00010A:SSL routines::wrong ssl version' :
           'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
         code: 'ERR_SSL_WRONG_SSL_VERSION',
diff --git a/test/parallel/test-tls-client-renegotiation-limit.js b/test/parallel/test-tls-client-renegotiation-limit.js
index 9b7f62865b33..b712e6f7d9eb 100644
--- a/test/parallel/test-tls-client-renegotiation-limit.js
+++ b/test/parallel/test-tls-client-renegotiation-limit.js
@@ -25,13 +25,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli } = require('../common/crypto');
+const { opensslCli, isBoringSSL } = require('../common/crypto');
 
 if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 65f3dc6867c4..6f54bbd97667 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -26,7 +26,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').assertFiniteFieldDheUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-dhparam-auto-boringssl.js b/test/parallel/test-tls-dhparam-auto-boringssl.js
index 54f2190d1a94..d2334c7feb0e 100644
--- a/test/parallel/test-tls-dhparam-auto-boringssl.js
+++ b/test/parallel/test-tls-dhparam-auto-boringssl.js
@@ -1,9 +1,11 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!process.features.openssl_is_boringssl)
+if (!isBoringSSL)
   common.skip('only applies to BoringSSL builds');
 
 const assert = require('assert');
diff --git a/test/parallel/test-tls-disable-renegotiation.js b/test/parallel/test-tls-disable-renegotiation.js
index 84a6ead4a544..1934becc2a62 100644
--- a/test/parallel/test-tls-disable-renegotiation.js
+++ b/test/parallel/test-tls-disable-renegotiation.js
@@ -1,5 +1,7 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
 
@@ -8,7 +10,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js
index b01051d5b457..cc74130a2e39 100644
--- a/test/parallel/test-tls-ecdh-multiple.js
+++ b/test/parallel/test-tls-ecdh-multiple.js
@@ -12,6 +12,7 @@ const {
   opensslCli,
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 const crypto = require('crypto');
 
@@ -31,7 +32,7 @@ function loadPEM(n) {
 
 // The FIPS provider and OpenSSL 4.0 disable support for deprecated elliptic
 // curves from RFC 8422 (including secp256k1) by default.
-const ecdhCurve = process.features.openssl_is_boringssl ||
+const ecdhCurve = isBoringSSL ||
   hasOpenSSL(4, 0) || hasFIPS(3) ?
   'prime256v1:secp521r1' :
   'secp256k1:prime256v1:secp521r1';
@@ -82,7 +83,7 @@ const server = tls.createServer(options, (conn) => {
   }
 
   // Deprecated RFC 8422 curves are disabled by default in OpenSSL 4.0.
-  if (process.features.openssl_is_boringssl || hasOpenSSL(4, 0)) {
+  if (isBoringSSL || hasOpenSSL(4, 0)) {
     unsupportedCurves.push('secp256k1');
   }
 
diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js
index 6ecdfbeecbe3..7d8bf61239ac 100644
--- a/test/parallel/test-tls-empty-sni-context.js
+++ b/test/parallel/test-tls-empty-sni-context.js
@@ -3,7 +3,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -26,7 +26,7 @@ const server = tls.createServer(options, (c) => {
   }, common.mustNotCall());
 
   c.on('error', common.mustCall((err) => {
-    const expectedErr = process.features.openssl_is_boringssl ?
+    const expectedErr = isBoringSSL ?
       'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR' : hasOpenSSL(4, 0) ?
         'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
           'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
diff --git a/test/parallel/test-tls-finished.js b/test/parallel/test-tls-finished.js
index b23b4567d27e..5a33257cebc1 100644
--- a/test/parallel/test-tls-finished.js
+++ b/test/parallel/test-tls-finished.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -21,7 +23,7 @@ const pem = (n) => fixtures.readKey(`${n}.pem`);
 const server = tls.createServer({
   key: pem('agent1-key'),
   cert: pem('agent1-cert'),
-  ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+  ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
 }, common.mustCall((alice) => {
   msg.server = {
     alice: alice.getFinished(),
@@ -34,7 +36,7 @@ server.listen(0, common.mustCall(() => {
   const bob = tls.connect({
     port: server.address().port,
     rejectUnauthorized: false,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(() => {
     msg.client = {
       alice: bob.getPeerFinished(),
diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
index 2d4de5639afb..cb8f1ba826b5 100644
--- a/test/parallel/test-tls-getcipher.js
+++ b/test/parallel/test-tls-getcipher.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL: commonIsBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -36,7 +38,7 @@ const options = {
   honorCipherOrder: true
 };
 
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 let clients = 0;
 const expectedClients = isBoringSSL ? 1 : 2;
 const server = tls.createServer(options, common.mustCall(() => {
diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
index 2fe971444271..e3e0a1fa2418 100644
--- a/test/parallel/test-tls-getprotocol.js
+++ b/test/parallel/test-tls-getprotocol.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // This test ensures that `getProtocol` returns the right protocol
 // from a TLS connection
@@ -28,7 +28,7 @@ let clientConfigs = [
   },
 ];
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // Remove the TLSv1 and TLSv1.1 cases. BoringSSL does not negotiate those
   // legacy protocols in this configuration; keep TLSv1.2 to cover getProtocol()
   // on a successful BoringSSL TLS handshake.
@@ -42,7 +42,7 @@ const serverConfig = {
   cert: fixtures.readKey('agent2-cert.pem')
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   serverConfig.ciphers = fips3 ?
     'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
diff --git a/test/parallel/test-tls-honorcipherorder.js b/test/parallel/test-tls-honorcipherorder.js
index fbee483d83b9..fcaed53353a8 100644
--- a/test/parallel/test-tls-honorcipherorder.js
+++ b/test/parallel/test-tls-honorcipherorder.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const mustCall = common.mustCall;
 const tls = require('tls');
 const util = require('util');
@@ -17,7 +17,7 @@ const util = require('util');
 // default method is updated in the future
 const SSL_Method = 'TLSv1_2_method';
 const localhost = '127.0.0.1';
-const config = process.features.openssl_is_boringssl || hasFIPS(3) ? {
+const config = isBoringSSL || hasFIPS(3) ? {
   serverCiphers:
     'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
   clientPreferenceCiphers:
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index 797c7c171dc5..8f60ef0520c4 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -27,13 +27,13 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const tls = require('tls');
-const errorMessageRegex = process.features.openssl_is_boringssl ?
+const errorMessageRegex = isBoringSSL ?
   /^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ :
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
     /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
 
diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
index 5106217718db..77f9c0935025 100644
--- a/test/parallel/test-tls-legacy-pfx.js
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -4,9 +4,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
 }
 
diff --git a/test/parallel/test-tls-max-send-fragment.js b/test/parallel/test-tls-max-send-fragment.js
index 2e319fcdaeaf..d389cf50d3d7 100644
--- a/test/parallel/test-tls-max-send-fragment.js
+++ b/test/parallel/test-tls-max-send-fragment.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -64,7 +66,7 @@ const server = tls.createServer({
   // both out-of-range values and reports success, so assert that difference
   // explicitly instead of using a truthiness shortcut.
   const acceptsOutOfRangeFragmentSize =
-    process.features.openssl_is_boringssl;
+    isBoringSSL;
   assert.strictEqual(c.setMaxSendFragment(511),
                      acceptsOutOfRangeFragmentSize);
   assert.strictEqual(c.setMaxSendFragment(16385),
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index 83797238cf4b..932ad7f0f219 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -5,15 +5,17 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
-  require('../common/boringssl').testLegacyProtocolUnsupported();
-  return;
-}
-
 const {
+  isBoringSSL,
   hasOpenSSL,
   hasFIPS,
 } = require('../common/crypto');
+
+if (isBoringSSL) {
+  require('../common/boringssl').testLegacyProtocolUnsupported();
+  return;
+}
+
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
 
diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
index 239cb8aec725..cc52eb9e65d4 100644
--- a/test/parallel/test-tls-multi-key.js
+++ b/test/parallel/test-tls-multi-key.js
@@ -27,7 +27,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').assertMultiKeyUnsupported();
   return;
 }
@@ -35,7 +37,6 @@ if (process.features.openssl_is_boringssl) {
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
-const { hasFIPS } = require('../common/crypto');
 
 // Key is ordered as ec, rsa, cert is ordered as rsa, ec.
 test({
diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
index b5bbb6decc12..d8a533049b2e 100644
--- a/test/parallel/test-tls-multi-pfx.js
+++ b/test/parallel/test-tls-multi-pfx.js
@@ -3,14 +3,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testMultiPfxSelectionDifference();
   return;
 }
 
 const assert = require('assert');
 const tls = require('tls');
-const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const fips3 = hasFIPS(3);
 const fips4 = hasFIPS(4);
diff --git a/test/parallel/test-tls-no-cert-required.js b/test/parallel/test-tls-no-cert-required.js
index 499ab2dfd14e..36da97526b6b 100644
--- a/test/parallel/test-tls-no-cert-required.js
+++ b/test/parallel/test-tls-no-cert-required.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -28,7 +30,7 @@ const assert = require('assert');
 const tls = require('tls');
 
 // Omitting the cert or pfx option to tls.createServer() should not throw.
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // AECDH-NULL-SHA is a no-authentication/no-encryption cipher and hence
   // does not need a certificate. BoringSSL does not provide that anonymous
   // cipher suite, so only this cipher-specific no-cert case is skipped.
diff --git a/test/parallel/test-tls-options-boolean-check.js b/test/parallel/test-tls-options-boolean-check.js
index f7dd7bb102f3..4366502aacb3 100644
--- a/test/parallel/test-tls-options-boolean-check.js
+++ b/test/parallel/test-tls-options-boolean-check.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff);
 const caArrDataView = toDataView(caCert);
 
 function filterBoringSSLKeyCertArrayCases(options, setName) {
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     return options;
 
   // The array-valued cases exercise multi-identity key/cert handling.
diff --git a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
index 0ba55f9153b9..0045517b0224 100644
--- a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
+++ b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
@@ -10,11 +10,12 @@
 // throw exceptions during validation.
 
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js
index c9c93d533501..8a0115a76125 100644
--- a/test/parallel/test-tls-psk-circuit.js
+++ b/test/parallel/test-tls-psk-circuit.js
@@ -5,12 +5,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
 
-const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
index 692550fc1c19..29d164f019da 100644
--- a/test/parallel/test-tls-psk-server.js
+++ b/test/parallel/test-tls-psk-server.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
index cca22067a0fe..b013d9f02c7a 100644
--- a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
+++ b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
@@ -1,10 +1,12 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').assertOpenSSLSecurityLevelsUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-server-verify.js b/test/parallel/test-tls-server-verify.js
index 439e32131030..c7487f593eb7 100644
--- a/test/parallel/test-tls-server-verify.js
+++ b/test/parallel/test-tls-server-verify.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli } = require('../common/crypto');
+const { opensslCli, isBoringSSL } = require('../common/crypto');
 
 if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
@@ -125,7 +125,7 @@ let testCases =
      ] },
   ];
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // Remove the delayed client-certificate verification case. It depends on TLS
   // renegotiation to request a client certificate after the initial handshake,
   // but BoringSSL does not support caller-initiated renegotiation.
diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js
index 0789879e1dce..54b7eeca2e9b 100644
--- a/test/parallel/test-tls-session-cache.js
+++ b/test/parallel/test-tls-session-cache.js
@@ -28,6 +28,7 @@ const {
   hasOpenSSL,
   hasFIPS,
   opensslCli,
+  isBoringSSL: commonIsBoringSSL,
 } = require('../common/crypto');
 
 if (!opensslCli) {
@@ -38,7 +39,7 @@ const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
 const { spawn } = require('child_process');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 
 doTest({ tickets: false }, function() {
   doTest({ tickets: true }, function() {
diff --git a/test/parallel/test-tls-set-ciphers-error.js b/test/parallel/test-tls-set-ciphers-error.js
index b79bd512ffe1..102186f9e399 100644
--- a/test/parallel/test-tls-set-ciphers-error.js
+++ b/test/parallel/test-tls-set-ciphers-error.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 {
   const options = {
@@ -21,7 +21,7 @@ const { hasOpenSSL } = require('../common/crypto');
   assert.throws(() => tls.createServer(options, common.mustNotCall()),
                 /no[_ ]cipher[_ ]match/i);
   options.ciphers = 'TLS_not_a_cipher';
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     tls.createServer(options).close();
   } else {
     assert.throws(() => tls.createServer(options, common.mustNotCall()),
diff --git a/test/parallel/test-tls-set-default-ca-certificates-recovery.js b/test/parallel/test-tls-set-default-ca-certificates-recovery.js
index ea6f98d5686e..d4154a2da62e 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-recovery.js
+++ b/test/parallel/test-tls-set-default-ca-certificates-recovery.js
@@ -3,6 +3,7 @@
 // This tests error recovery and fallback behavior for tls.setDefaultCACertificates()
 
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) common.skip('missing crypto');
 
 const assert = require('assert');
@@ -27,7 +28,7 @@ function testRecovery(expectedCerts) {
   {
     const invalidCert = '-----BEGIN CERTIFICATE-----\nvalid cert content\n-----END CERTIFICATE-----';
     assert.throws(() => tls.setDefaultCACertificates([fixtureCert, invalidCert]), {
-      code: process.features.openssl_is_boringssl ?
+      code: isBoringSSL ?
         'ERR_OSSL_PEM_ASN.1_ENCODING_ROUTINES' :
         'ERR_OSSL_PEM_ASN1_LIB',
     });
diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
index e1bf8b93f8a3..ca111e83ef2b 100644
--- a/test/parallel/test-tls-set-sigalgs.js
+++ b/test/parallel/test-tls-set-sigalgs.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 // Test sigalgs: option for TLS.
@@ -41,7 +41,7 @@ function test(csigalgs, ssigalgs, shared_sigalgs, cerr, serr) {
       assert(pair.client.conn);
       // BoringSSL's OpenSSL-compatible SSL_get_shared_sigalgs() API always
       // returns zero, so a successful handshake still reports an empty list.
-      const expectedSharedSigalgs = process.features.openssl_is_boringssl ?
+      const expectedSharedSigalgs = isBoringSSL ?
         [] :
         shared_sigalgs;
       assert.deepStrictEqual(
@@ -74,7 +74,7 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
 const handshakeErr = hasOpenSSL(4, 0) ?
   'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
-const noSharedSigalgsErr = process.features.openssl_is_boringssl ?
+const noSharedSigalgsErr = isBoringSSL ?
   'ERR_SSL_NO_COMMON_SIGNATURE_ALGORITHMS' :
   'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITHMS';
 test('RSA-PSS+SHA384', 'ECDSA+SHA256',
diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/parallel/test-tls-ticket-cluster.js
index f183b53f24c0..fa3c23c2a6e2 100644
--- a/test/parallel/test-tls-ticket-cluster.js
+++ b/test/parallel/test-tls-ticket-cluster.js
@@ -20,11 +20,13 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
 }
diff --git a/test/parallel/test-tls-ticket.js b/test/parallel/test-tls-ticket.js
index 8316f5e8da8d..b6aa7a6de9c3 100644
--- a/test/parallel/test-tls-ticket.js
+++ b/test/parallel/test-tls-ticket.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -30,7 +32,7 @@ const net = require('net');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
-if (process.features.openssl_is_boringssl &&
+if (isBoringSSL &&
     tls.DEFAULT_MAX_VERSION !== 'TLSv1.2') {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
diff --git a/test/parallel/test-tls-write-error.js b/test/parallel/test-tls-write-error.js
index f6ec7b9bd245..08b943aab713 100644
--- a/test/parallel/test-tls-write-error.js
+++ b/test/parallel/test-tls-write-error.js
@@ -7,7 +7,7 @@ const { TestTLSSocket, ccs } = require('../common/tls');
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const https = require('https');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // Regression test for an use-after-free bug in the TLS implementation that
 // would occur when `SSL_write()` failed.
@@ -22,7 +22,7 @@ const opts = {
 };
 const rejectsClientHello = hasFIPS(3) && !hasFIPS(3, 5);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   opts.ciphers = 'ALL@SECLEVEL=0';
 }
 
diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js
index 7a7b80fa4c10..4d1a8165277e 100644
--- a/test/parallel/test-trace-env.js
+++ b/test/parallel/test-trace-env.js
@@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
     if (common.hasCrypto) {
       assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
 
-      const { hasOpenSSL3 } = require('../common/crypto');
-      if (hasOpenSSL3) {
+      const { hasOpenSSL } = require('../common/crypto');
+      if (hasOpenSSL(3)) {
         assert.match(output, /get "OPENSSL_CONF"/);
       }
     }
diff --git a/test/parallel/test-webcrypto-crypto-job-mode.js b/test/parallel/test-webcrypto-crypto-job-mode.js
index 327c6a6f154c..5f5f1761a4c7 100644
--- a/test/parallel/test-webcrypto-crypto-job-mode.js
+++ b/test/parallel/test-webcrypto-crypto-job-mode.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { types: { isCryptoKey } } = require('util');
 const { internalBinding } = require('internal/test/binding');
 const {
@@ -211,7 +211,7 @@ async function withObjectPrototypeSetters(names, fn) {
     }
   }
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     const pair = await subtle.generateKey(
       { name: 'ML-KEM-768' },
       true,
diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js
index d27675d873ce..1d7247644abd 100644
--- a/test/parallel/test-webcrypto-deduplicate-usages.js
+++ b/test/parallel/test-webcrypto-deduplicate-usages.js
@@ -13,7 +13,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const { createSecretKey } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function assertSameSet(actual, expected, msg) {
@@ -115,7 +115,7 @@ function assertSameSet(actual, expected, msg) {
     asymmetric.splice(asymmetric.findIndex(({ algorithm }) =>
       algorithm.name === 'X25519'), 1);
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     asymmetric.push({
       algorithm: { name: 'ML-DSA-65' },
       usages: ['verify', 'sign', 'verify', 'sign'],
@@ -297,7 +297,7 @@ function assertSameSet(actual, expected, msg) {
     assert.deepStrictEqual(imported.usages, ['sign']);
   })());
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     // ML-DSA JWK roundtrip.
     tests.push((async () => {
       const { privateKey } = await subtle.generateKey(
@@ -508,7 +508,7 @@ function assertSameSet(actual, expected, msg) {
     jwkPairVectors.splice(jwkPairVectors.findIndex(({ algorithm }) =>
       algorithm.name === 'X25519'), 1);
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     jwkPairVectors.push({
       algorithm: { name: 'ML-DSA-65' },
       usages: ['verify', 'sign', 'verify', 'sign'],
diff --git a/test/parallel/test-webcrypto-derivebits-cfrg.js b/test/parallel/test-webcrypto-derivebits-cfrg.js
index fae39ac89c5e..134360c62751 100644
--- a/test/parallel/test-webcrypto-derivebits-cfrg.js
+++ b/test/parallel/test-webcrypto-derivebits-cfrg.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const rejectsXCurves = hasFIPS(3, 5);
 
@@ -22,7 +22,7 @@ const kTests = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     {
       name: 'X448',
diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js
index 539440ea7c31..fafd6a7afa58 100644
--- a/test/parallel/test-webcrypto-derivebits-hkdf.js
+++ b/test/parallel/test-webcrypto-derivebits-hkdf.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function getDeriveKeyInfo(name, length, hash, ...usages) {
@@ -28,7 +28,7 @@ const kDerivedKeyTypes = [
   ['AES-KW', 256, undefined, 'wrapKey', 'unwrapKey'],
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kDerivedKeyTypes.push(
     ['HMAC', 256, 'SHA3-256', 'sign', 'verify'],
     ['HMAC', 256, 'SHA3-384', 'sign', 'verify'],
@@ -91,7 +91,7 @@ const kDerivations = {
         empty: '9e4b719033742101e90f1ad61e2ff3b4' +
                '256863667296d74389f1f02af2c4e6a6'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '386b0693d7a58c4ddf01b49bfbbd2fa87c6f911991543995170ba20ed28df599',
           empty: 'd029bc828b6c6c8bb16ce3d25f5058f19c7d2517745e11c5d65c6d242e82e47f',
@@ -131,7 +131,7 @@ const kDerivations = {
         empty: 'c8e12774135305c9147f2cc4766e5ead' +
                '25d8f457b9a1953d52677361ced558fb'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '9befc557f5baf4075b5fb38c014b41b92ab7534150baf64201069e8807d0e83d',
           empty: '54d1fa1aa7cad99dab0622b772170e775c103756183bac36a228fd817a98a3f6',
@@ -173,7 +173,7 @@ const kDerivations = {
         empty: 'e579d1f9e7f08e6f990ffcfcce1ed201' +
                'c5e37e62cdf606f0ba4aca80427fbc44'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '24f38fd1905554b7cbf8395cc3976292d11ce24a0b3131da0fd4b109832d27e3',
           empty: '33d0a5151c0f52e4bb7fb67cf7a17063127624dc3e685903f49ebb07872084d1',
@@ -213,7 +213,7 @@ const kDerivations = {
         empty: 'b4f7e7557674d501cbfbc0148ad800c0' +
                '750189fe295a2aca5e1bf4122c85edf9'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: 'fe32459f7339dd2e8df6c6fc874ed9e81e3b7aad669edad9b71196f53ed95b12',
           empty: '04519be1eb94079c91306cc5b21946b3de6a78ad35ec83d4f4a37bafbda678d7',
diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
index 6ef2227ab2d2..184f997377d0 100644
--- a/test/parallel/test-webcrypto-derivebits.js
+++ b/test/parallel/test-webcrypto-derivebits.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const requiresLongHkdfInputs = hasFIPS(3) && !hasFIPS(3, 5);
 const rejectsWeakPbkdf2Inputs = hasFIPS(4);
@@ -152,7 +152,7 @@ const rejectsXCurves = hasFIPS(3, 5);
     }
   } else {
     test('X25519').then(common.mustCall());
-    if (!process.features.openssl_is_boringssl) {
+    if (!isBoringSSL) {
       test('X448').then(common.mustCall());
     } else {
       common.printSkipMessage('Skipping unsupported X448 test case');
diff --git a/test/parallel/test-webcrypto-derivekey-cfrg.js b/test/parallel/test-webcrypto-derivekey-cfrg.js
index 13c4e56ce5b0..c9a9b60d091b 100644
--- a/test/parallel/test-webcrypto-derivekey-cfrg.js
+++ b/test/parallel/test-webcrypto-derivekey-cfrg.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const rejectsXCurves = hasFIPS(3, 5);
 
@@ -22,7 +22,7 @@ const kTests = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     {
       name: 'X448',
diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
index 631951c3f767..516838aaf0bf 100644
--- a/test/parallel/test-webcrypto-derivekey.js
+++ b/test/parallel/test-webcrypto-derivekey.js
@@ -6,7 +6,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
@@ -87,7 +87,7 @@ const fips4 = hasFIPS(4);
      'a7abd704d0be364c6d4a530b6f93fcaff95474a2eee5a127ff86c5d095a2a812'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       ['hello hello hello', 'there', 'my friend indeed', 'SHA3-256',
        '89b3751df2ada85322a57ec82f7d0a5c233c6def91c92e681bc5118bd5768dca'],
@@ -140,7 +140,7 @@ const fips4 = hasFIPS(4);
      '12790ce09027db067d680670f4dc704715b5120d139e8fde810afc34fb66f9f1'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       ['hello hello hello', 'my friend indeed', 1000, 'SHA3-256',
        '0f69b46660cba27b95215d5676492c64ed6abf6d426669a4a02b0ca3a1c36c11'],
@@ -176,7 +176,7 @@ const fips4 = hasFIPS(4);
     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     vectors.push(
       [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
       [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
@@ -236,7 +236,7 @@ const fips4 = hasFIPS(4);
     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     vectors.push(
       [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
       [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
@@ -372,7 +372,7 @@ if (hasOpenSSL(3) && !hasFIPS()) {
     }
   } else {
     test('X25519').then(common.mustCall());
-    if (!process.features.openssl_is_boringssl) {
+    if (!isBoringSSL) {
       test('X448').then(common.mustCall());
     } else {
       common.printSkipMessage('Skipping unsupported X448 test case');
diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js
index 7c0ef7668c61..47a56a912d69 100644
--- a/test/parallel/test-webcrypto-digest.js
+++ b/test/parallel/test-webcrypto-digest.js
@@ -9,7 +9,7 @@ const assert = require('assert');
 const { Buffer } = require('buffer');
 const { subtle } = globalThis.crypto;
 const { createHash, getHashes } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const fips = hasFIPS();
 
 const kTests = [
@@ -19,7 +19,7 @@ const kTests = [
   ['SHA-512', ['sha512'], 512],
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     [{ name: 'cSHAKE128', outputLength: 256 }, ['shake128', { outputLength: 256 >> 3 }], 256],
     [{ name: 'cSHAKE256', outputLength: 512 }, ['shake256', { outputLength: 512 >> 3 }], 512],
@@ -150,7 +150,7 @@ const kDigestedData = {
           '60b22aab8d36a4c2a3affdb71234f49276737c575ddf7' +
           '4d14054cbd6fdb98fd0ddcbcb46f91ad76b6ee'
   },
-  ...(!process.features.openssl_is_boringssl ? {
+  ...(!isBoringSSL ? {
     'cshake128': {
       empty: '7f9c2ba4e88f827d616045507605853ed73b8093f6e' +
             'fbc88eb1a6eacfa66ef26',
diff --git a/test/parallel/test-webcrypto-encap-decap-ml-kem.js b/test/parallel/test-webcrypto-encap-decap-ml-kem.js
index dbb0a7d3fa8b..0503e66da235 100644
--- a/test/parallel/test-webcrypto-encap-decap-ml-kem.js
+++ b/test/parallel/test-webcrypto-encap-decap-ml-kem.js
@@ -6,9 +6,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -288,7 +288,7 @@ async function testDecapsulateBits({ name, publicKeyPem, privateKeyPem, results
   const variations = [];
 
   for (const vector of vectors) {
-    if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') {
+    if (isBoringSSL && vector.name === 'ML-KEM-512') {
       common.printSkipMessage(`Skipping unsupported ${vector.name} test`);
       continue;
     }
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js
index 1015752a8b0a..9a10b214d7aa 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
@@ -59,7 +59,7 @@ const { subtle } = globalThis.crypto;
 }
 
 // Test Encrypt/Decrypt RSA-OAEP w/ SHA-3
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const buf = globalThis.crypto.getRandomValues(new Uint8Array(50));
 
   async function test() {
diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js
index fb8014840f34..1cc1cd478ac8 100644
--- a/test/parallel/test-webcrypto-export-import-cfrg.js
+++ b/test/parallel/test-webcrypto-export-import-cfrg.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const rejectsXCurves = hasFIPS(3, 5);
 
@@ -96,7 +96,7 @@ const testVectors = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   testVectors.push(
     {
       name: 'Ed448',
diff --git a/test/parallel/test-webcrypto-export-import-ml-dsa.js b/test/parallel/test-webcrypto-export-import-ml-dsa.js
index 9c6e04da053c..d79b8138f8ac 100644
--- a/test/parallel/test-webcrypto-export-import-ml-dsa.js
+++ b/test/parallel/test-webcrypto-export-import-ml-dsa.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -105,7 +105,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
       extractable,
       privateUsages);
   } catch (err) {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.strictEqual(err.name, 'DataError');
       assert.strictEqual(err.cause.code, 'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
       common.printSkipMessage('Skipping unsupported private key format test');
@@ -525,7 +525,7 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   }
 })().then(common.mustCall());
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
       const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii');
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
index 862eea96726d..c6ae5e51c566 100644
--- a/test/parallel/test-webcrypto-export-import-ml-kem.js
+++ b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -105,7 +105,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
       extractable,
       privateUsages);
   } catch (err) {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.strictEqual(err.name, 'DataError');
       assert.strictEqual(err.cause.code,
                          'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
@@ -469,7 +469,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
 (async function() {
   const tests = [];
   for (const vector of testVectors) {
-    if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') {
+    if (isBoringSSL && vector.name === 'ML-KEM-512') {
       common.printSkipMessage('Skipping unsupported ML-KEM-512 test');
       continue;
     }
@@ -525,7 +525,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
   }
 })().then(common.mustCall());
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
       const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii');
diff --git a/test/parallel/test-webcrypto-export-import-rsa.js b/test/parallel/test-webcrypto-export-import-rsa.js
index 294baff544a6..385b8e0bc520 100644
--- a/test/parallel/test-webcrypto-export-import-rsa.js
+++ b/test/parallel/test-webcrypto-export-import-rsa.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -19,7 +21,7 @@ const hashes = [
   'SHA-512',
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   hashes.push(
     'SHA3-256',
     'SHA3-384',
diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js
index 30d1ea622fae..385ae8c65e9d 100644
--- a/test/parallel/test-webcrypto-export-import.js
+++ b/test/parallel/test-webcrypto-export-import.js
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
@@ -518,7 +518,7 @@ if (hasOpenSSL(3)) {
 }
 
 // SHA-3 hashes and JWK "alg"
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const rsa = fixtures.readKey('rsa_private_2048.pem');
   const privateKey = createPrivateKey(rsa);
   const publicKey = createPublicKey(privateKey);
diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js
index 6e264031c4d1..e63ea8dfc7da 100644
--- a/test/parallel/test-webcrypto-keygen.js
+++ b/test/parallel/test-webcrypto-keygen.js
@@ -6,7 +6,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');
@@ -158,7 +158,7 @@ const vectors = {
   },
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   vectors.Ed448 = {
     result: 'CryptoKeyPair',
     usages: [
@@ -200,7 +200,7 @@ if (hasOpenSSL(3)) {
   }
 }
 
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
     vectors[name] = {
       result: 'CryptoKeyPair',
@@ -504,7 +504,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
 
   let fipsExponentTest;
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     if (fips3) {
       fipsExponentTest = assert.rejects(
         subtle.generateKey({
@@ -722,7 +722,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     [1024, 'SHA-512', ['sign', 'verify']],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       [256, 'SHA3-256', ['sign', 'verify']],
       [384, 'SHA3-384', ['sign', 'verify']],
@@ -808,7 +808,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
     ],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       [
         'Ed448',
@@ -836,7 +836,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
 }
 
 // Test ML-DSA Key Generation
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(
     name,
     privateUsages,
@@ -879,7 +879,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 }
 
 // Test ML-KEM Key Generation
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(
     name,
     privateUsages,
@@ -916,7 +916,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
   const kTests = ['ML-KEM-768', 'ML-KEM-1024'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.unshift('ML-KEM-512');
   } else {
     common.printSkipMessage('Skipping unsupported ML-KEM-512 test');
diff --git a/test/parallel/test-webcrypto-sign-verify-eddsa.js b/test/parallel/test-webcrypto-sign-verify-eddsa.js
index e34a3d43d2a3..2c1b0bd44001 100644
--- a/test/parallel/test-webcrypto-sign-verify-eddsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-eddsa.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -31,7 +31,7 @@ const smallOrderVerifyVectors = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   smallOrderVerifyVectors.push({
     name: 'Ed448',
     publicKey: Buffer.concat([Buffer.from([1]), Buffer.alloc(56)]),
diff --git a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
index ba6eab08efb1..6925c0782f81 100644
--- a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 12633cd50de2..5b5fc7a69e82 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const fips3 = hasFIPS(3);
 const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5);
@@ -269,7 +269,7 @@ async function testSaltLength(keyLength, hash, hLen) {
       ['SHA-256', 32],
       ['SHA-384', 48],
       ['SHA-512', 64],
-      ...(!process.features.openssl_is_boringssl ? [
+      ...(!isBoringSSL ? [
         ['SHA3-256', 32],
         ['SHA3-384', 48],
         ['SHA3-512', 64],
diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js
index db6c9e093872..295f13782389 100644
--- a/test/parallel/test-webcrypto-sign-verify.js
+++ b/test/parallel/test-webcrypto-sign-verify.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { getFips } = require('crypto');
@@ -152,7 +152,7 @@ if (hasOpenSSL(3)) {
 }
 
 // Test Sign/Verify Ed448
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   async function test(data) {
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
@@ -174,7 +174,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // Test Sign/Verify ML-DSA
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(name, data) {
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index 5ffffe230ac6..60ceffd710c9 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { getFips } = require('crypto');
@@ -206,7 +206,7 @@ async function generateKeysToWrap() {
     },
   ];
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
       parameters.push({
         algorithm: { name },
@@ -217,7 +217,7 @@ async function generateKeysToWrap() {
     }
   }
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     parameters.push(
       {
         algorithm: {
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index ab91e3345556..47901140cac0 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -10,7 +10,7 @@ const { X509Certificate } = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 // Test that all certificate chains provided by the reporter are rejected.
 {
@@ -59,8 +59,8 @@ const { hasOpenSSL3 } = require('../common/crypto');
     'IP Address:8.8.8.8',
     'IP Address:8.8.4.4',
     // For backward-compatibility, include invalid IP address lengths.
-    hasOpenSSL3 ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
-    hasOpenSSL3 ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
+    hasOpenSSL(3) ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
+    hasOpenSSL(3) ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
     // IPv6 addresses are represented as OpenSSL does.
     'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D',
     // Regular email addresses don't require escaping.
@@ -88,22 +88,22 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // This is an OID that will likely never be assigned to anything, thus
     // OpenSSL should not know it.
     'Registered ID:1.3.9999.12.34',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:XmppAddr:abc123' :
       'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' :
       'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"XmppAddr:good.example.com\\u0000abc123"' :
       'othername:<unsupported>',
     // This is unsupported because the OID is not recognized.
     'othername:<unsupported>',
-    hasOpenSSL3 ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
+    hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
     // This is unsupported because it is an SRVName with a UTF8String value,
     // which is not allowed for SRVName.
     'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"SRVName:abc\\u0000def"' :
       'othername:<unsupported>',
   ];
@@ -173,7 +173,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL3 ? {
+    hasOpenSSL(3) ? {
       text: 'OCSP - othername:XmppAddr:good.example.com\n' +
             'OCSP - othername:<unsupported>\n' +
             'OCSP - othername:SRVName:abc123',
@@ -196,7 +196,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL3 ? {
+    hasOpenSSL(3) ? {
       text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"',
       legacy: {
         'OCSP - othername': [
@@ -222,7 +222,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // Test the subjectAltName property of the X509Certificate API.
     const cert = new X509Certificate(pem);
     assert.strictEqual(cert.infoAccess,
-                       `${expected.text}${hasOpenSSL3 ? '' : '\n'}`);
+                       `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`);
 
     // Test that the certificate obtained by checkServerIdentity has the correct
     // subjectaltname property.
@@ -439,7 +439,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
   // The hostname is the CN, but not a SAN entry.
   const servername = 'good.example.com';
-  const cnFallback = process.features.openssl_is_boringssl ? undefined :
+  const cnFallback = isBoringSSL ? undefined :
     servername;
   const certX509 = new X509Certificate(cert);
   assert.strictEqual(certX509.subject, `CN=${servername}`);
@@ -485,7 +485,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
   assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4');
 
   // The newer X509Certificate API allows customizing this behavior:
-  const cnFallback = process.features.openssl_is_boringssl ? undefined :
+  const cnFallback = isBoringSSL ? undefined :
     servername;
   assert.strictEqual(certX509.checkHost(servername), cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js
index 03b4a9c831ae..e428df491a34 100644
--- a/test/pummel/test-crypto-dh-hash.js
+++ b/test/pummel/test-crypto-dh-hash.js
@@ -30,9 +30,9 @@ if (common.isPi()) {
   common.skip('Too slow for Raspberry Pi devices');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
 }
 
diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js
index 824628732a55..cbfec26d14a1 100644
--- a/test/pummel/test-crypto-dh-keys.js
+++ b/test/pummel/test-crypto-dh-keys.js
@@ -32,7 +32,7 @@ if (common.isPi()) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17']) {
   // modp1 is 768 bits, FIPS requires >= 1024.
@@ -47,7 +47,7 @@ for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'mo
     continue;
   }
   if ((name === 'modp1' && crypto.getFips() === 1) ||
-      (process.features.openssl_is_boringssl &&
+      (isBoringSSL &&
        (name === 'modp1' || name === 'modp2'))) {
     common.printSkipMessage(`Skipping unsupported ${name} test case`);
     continue;
diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
index 2eb6228f79f2..5cb429f47dec 100644
--- a/test/sequential/test-tls-psk-client.js
+++ b/test/sequential/test-tls-psk-client.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 095be39151ef..7715d5456152 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -3,6 +3,7 @@
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../../common/crypto.js');
 
 const conditionalFileSkips = {};
@@ -10,7 +11,7 @@ const conditionalSubtestSkips = {};
 
 function skip(...files) {
   for (const file of files) {
-    const provider = process.features.openssl_is_boringssl ?
+    const provider = isBoringSSL ?
       'BoringSSL' :
       `OpenSSL ${process.versions.openssl}${hasFIPS(3) ? ' FIPS mode' : ''}`;
     conditionalFileSkips[file] = {
@@ -49,7 +50,7 @@ if (!hasOpenSSL(3, 2) || hasFIPS(3)) {
     'import_export/Argon2_importKey.tentative.https.any.js');
 }
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   skip(
     'encap_decap/encap_decap_bits.tentative.https.any.js',
     'encap_decap/encap_decap_keys.tentative.https.any.js',
@@ -71,7 +72,7 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
     ]);
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   skip(
     'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',

From b265340d4ffd55453da4e383579d030e07ab6922 Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Sat, 5 Sep 2026 14:43:03 -0300
Subject: [PATCH 101/202] test: deflake test-permission-net-udp-handle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sending a dgram socket over IPC duplicates the handle instead of moving
it: `dgram.Socket` has no `postSend` in the child_process conversion
table, and `bind()` calls `recvStart()` unconditionally, so the parent
copy keeps consuming datagrams after the child adopts the handle. Both
sockets then compete for every packet, and the child receives nothing
until it wins that race. Locally the parent took up to 111 consecutive
packets first, stretching the run to about 1.2s; the retry interval is
the only thing keeping the test alive, and how long the parent can hold
the socket is a property of the scheduler, not of the test.

Close the parent copy as soon as the child reports it is receiving, so
the child is the only reader by the time the first datagram is sent.

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65767
Refs: https://github.com/nodejs/reliability/issues/1642
Refs: https://github.com/nodejs/reliability/issues/1649
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 test/parallel/test-permission-net-udp-handle.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/test/parallel/test-permission-net-udp-handle.js b/test/parallel/test-permission-net-udp-handle.js
index b6925421f829..10e90610d0c1 100644
--- a/test/parallel/test-permission-net-udp-handle.js
+++ b/test/parallel/test-permission-net-udp-handle.js
@@ -60,6 +60,7 @@ if (mode === 'ipc-denied') {
   const droppedSocket = dgram.createSocket('udp4');
   const sender = dgram.createSocket('udp4');
   droppedSocket.bind(0, '127.0.0.1', common.mustCall(() => {
+    const { port } = droppedSocket.address();
     const child = fork(__filename, ['ipc-drop'], {
       execArgv: [
         '--permission',
@@ -73,7 +74,10 @@ if (mode === 'ipc-denied') {
       if (message === 'ready') {
         child.send('socket', droppedSocket);
       } else if (message === 'receiving') {
-        const { port } = droppedSocket.address();
+        // Sending the socket over IPC keeps this copy open and receiving, so
+        // both ends compete for incoming datagrams. Stop receiving before the
+        // first one goes out.
+        droppedSocket.close();
         timer = setInterval(() => {
           sender.send('after-drop', port, '127.0.0.1');
         }, 10);
@@ -81,7 +85,6 @@ if (mode === 'ipc-denied') {
         assert.strictEqual(message, 'received');
         clearInterval(timer);
         sender.close();
-        droppedSocket.close();
         child.disconnect();
       }
     }, 3));

From 6f41e415639b5ec3dd816e44945cc73b4d7651e3 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Sat, 5 Sep 2026 22:54:14 +0200
Subject: [PATCH 102/202] crypto: fix multi-prime RSA JWKs

Preserve additional RSA prime information when exporting and importing
private JWKs across supported OpenSSL versions.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65649
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 deps/ncrypto/ncrypto.cc                       | 123 +++++++++++++++++-
 deps/ncrypto/ncrypto.h                        |  22 +++-
 src/crypto/crypto_rsa.cc                      | 107 +++++++++++++--
 src/env_properties.h                          |   3 +
 test/fixtures/keys/Makefile                   |   8 ++
 .../keys/rsa_private_2048_3_primes.pem        |  29 +++++
 .../test-crypto-rsa-multiprime-jwk.js         |  62 +++++++++
 7 files changed, 344 insertions(+), 10 deletions(-)
 create mode 100644 test/fixtures/keys/rsa_private_2048_3_primes.pem
 create mode 100644 test/parallel/test-crypto-rsa-multiprime-jwk.js

diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index 59006ebf6a84..20f22e614525 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -131,6 +131,31 @@ struct OpenSSLBufferDeleter {
 };
 using OpenSSLBufferPointer =
     std::unique_ptr<unsigned char, OpenSSLBufferDeleter>;
+
+struct RsaOtherPrimeParamNames {
+  const char* factor;
+  const char* exponent;
+  const char* coefficient;
+};
+
+#define RSA_OTHER_PRIME_PARAM_NAMES(prime, coefficient)                        \
+  {                                                                            \
+    OSSL_PKEY_PARAM_RSA_FACTOR #prime, OSSL_PKEY_PARAM_RSA_EXPONENT #prime,    \
+        OSSL_PKEY_PARAM_RSA_COEFFICIENT #coefficient                           \
+  }
+
+constexpr std::array<RsaOtherPrimeParamNames, 8> kRsaOtherPrimeParamNames = {{
+    RSA_OTHER_PRIME_PARAM_NAMES(3, 2),
+    RSA_OTHER_PRIME_PARAM_NAMES(4, 3),
+    RSA_OTHER_PRIME_PARAM_NAMES(5, 4),
+    RSA_OTHER_PRIME_PARAM_NAMES(6, 5),
+    RSA_OTHER_PRIME_PARAM_NAMES(7, 6),
+    RSA_OTHER_PRIME_PARAM_NAMES(8, 7),
+    RSA_OTHER_PRIME_PARAM_NAMES(9, 8),
+    RSA_OTHER_PRIME_PARAM_NAMES(10, 9),
+}};
+
+#undef RSA_OTHER_PRIME_PARAM_NAMES
 #endif
 
 static constexpr int kX509NameFlagsRFC2253WithinUtf8JSON =
@@ -3082,6 +3107,19 @@ EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
             bld.get(), OSSL_PKEY_PARAM_RSA_COEFFICIENT1, private_key.qi) != 1) {
       return {};
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (other_prime_infos.size() > kRsaOtherPrimeParamNames.size()) return {};
+    for (size_t i = 0; i < other_prime_infos.size(); i++) {
+      const auto& info = other_prime_infos[i];
+      const auto& names = kRsaOtherPrimeParamNames[i];
+      if (info.r == nullptr || info.d == nullptr || info.t == nullptr ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.factor, info.r) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.exponent, info.d) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.coefficient, info.t) != 1) {
+        return {};
+      }
+    }
     selection = EVP_PKEY_KEYPAIR;
   }
 
@@ -6135,6 +6173,11 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
 }
 }  // namespace
 
+Rsa::OtherPrimeInfoPointer::OtherPrimeInfoPointer(BignumPointer&& r,
+                                                  BignumPointer&& d,
+                                                  BignumPointer&& t)
+    : r(r.release()), d(d.release()), t(t.release()) {}
+
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
 namespace {
 int DigestAlgorithmIdentifierToNid(const unsigned char* data, size_t size) {
@@ -6363,6 +6406,19 @@ Rsa::Rsa(const EVP_PKEY* pkey) : Rsa() {
     return;
   }
 
+  for (const auto& names : kRsaOtherPrimeParamNames) {
+    OtherPrimeInfoPointer info;
+    if (!GetOptionalPKeyBnParam(pkey, names.factor, &info.r) ||
+        !GetOptionalPKeyBnParam(pkey, names.exponent, &info.d) ||
+        !GetOptionalPKeyBnParam(pkey, names.coefficient, &info.t)) {
+      return;
+    }
+
+    if (!info.r && !info.d && !info.t) break;
+    if (!info.r || !info.d || !info.t) return;
+    other_prime_infos_.push_back(std::move(info));
+  }
+
   if (type == EVP_PKEY_RSA_PSS) {
     MarkPopErrorOnReturn pop_errors;
     PssParams params;
@@ -6401,6 +6457,35 @@ const Rsa::PrivateKey Rsa::getPrivateKey() const {
 #endif
 }
 
+const Rsa::OtherPrimeInfos Rsa::getOtherPrimeInfos() const {
+  OtherPrimeInfos infos;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  infos.reserve(other_prime_infos_.size());
+  for (const auto& info : other_prime_infos_) {
+    infos.push_back({info.r.get(), info.d.get(), info.t.get()});
+  }
+#elif NCRYPTO_USE_LEGACY_OPENSSL
+  if (rsa_ == nullptr) return infos;
+  const int count = RSA_get_multi_prime_extra_count(rsa_);
+  if (count <= 0) return infos;
+
+  std::vector<const BIGNUM*> factors(count);
+  std::vector<const BIGNUM*> exponents(count);
+  std::vector<const BIGNUM*> coefficients(count);
+  if (RSA_get0_multi_prime_factors(rsa_, factors.data()) != 1 ||
+      RSA_get0_multi_prime_crt_params(
+          rsa_, exponents.data(), coefficients.data()) != 1) {
+    return {};
+  }
+
+  infos.reserve(count);
+  for (int i = 0; i < count; i++) {
+    infos.push_back({factors[i], exponents[i], coefficients[i]});
+  }
+#endif
+  return infos;
+}
+
 const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return pss_params_;
@@ -6502,15 +6587,20 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
                         BignumPointer&& p,
                         BignumPointer&& dp,
                         BignumPointer&& dq,
-                        BignumPointer&& qi) {
+                        BignumPointer&& qi,
+                        OtherPrimeInfoPointers&& other_prime_infos) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!d || !q || !p || !dp || !dq || !qi) return false;
+  for (const auto& info : other_prime_infos) {
+    if (!info.r || !info.d || !info.t) return false;
+  }
   d_.reset(d.release());
   q_.reset(q.release());
   p_.reset(p.release());
   dp_.reset(dp.release());
   dq_.reset(dq.release());
   qi_.reset(qi.release());
+  other_prime_infos_ = std::move(other_prime_infos);
   rsa_ = n_ != nullptr && e_ != nullptr;
   return rsa_;
 #else
@@ -6532,6 +6622,37 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
   dp.release();
   dq.release();
   qi.release();
+
+#if NCRYPTO_USE_LEGACY_OPENSSL
+  if (!other_prime_infos.empty()) {
+    std::vector<BIGNUM*> factors;
+    std::vector<BIGNUM*> exponents;
+    std::vector<BIGNUM*> coefficients;
+    factors.reserve(other_prime_infos.size());
+    exponents.reserve(other_prime_infos.size());
+    coefficients.reserve(other_prime_infos.size());
+    for (const auto& info : other_prime_infos) {
+      if (!info.r || !info.d || !info.t) return false;
+      factors.push_back(info.r.get());
+      exponents.push_back(info.d.get());
+      coefficients.push_back(info.t.get());
+    }
+    if (RSA_set0_multi_prime_params(const_cast<RSA*>(rsa_),
+                                    factors.data(),
+                                    exponents.data(),
+                                    coefficients.data(),
+                                    static_cast<int>(factors.size())) != 1) {
+      return false;
+    }
+    for (auto& info : other_prime_infos) {
+      info.r.release();
+      info.d.release();
+      info.t.release();
+    }
+  }
+#else
+  if (!other_prime_infos.empty()) return false;
+#endif
   return true;
 #endif
 }
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 79f403788cf4..6b1edceed061 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -724,6 +724,23 @@ class Rsa final {
     const BIGNUM* dq;
     const BIGNUM* qi;
   };
+  struct OtherPrimeInfo {
+    const BIGNUM* r;
+    const BIGNUM* d;
+    const BIGNUM* t;
+  };
+  struct OtherPrimeInfoPointer {
+    OtherPrimeInfoPointer() = default;
+    OtherPrimeInfoPointer(BignumPointer&& r,
+                          BignumPointer&& d,
+                          BignumPointer&& t);
+
+    DeleteFnPtr<BIGNUM, BN_clear_free> r;
+    DeleteFnPtr<BIGNUM, BN_clear_free> d;
+    DeleteFnPtr<BIGNUM, BN_clear_free> t;
+  };
+  using OtherPrimeInfos = std::vector<OtherPrimeInfo>;
+  using OtherPrimeInfoPointers = std::vector<OtherPrimeInfoPointer>;
   struct PssParams {
     std::string_view digest = "sha1";
     std::optional<std::string_view> mgf1_digest = "sha1";
@@ -732,6 +749,7 @@ class Rsa final {
 
   const PublicKey getPublicKey() const;
   const PrivateKey getPrivateKey() const;
+  const OtherPrimeInfos getOtherPrimeInfos() const;
   const std::optional<PssParams> getPssParams() const;
 
   bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
@@ -740,7 +758,8 @@ class Rsa final {
                      BignumPointer&& p,
                      BignumPointer&& dp,
                      BignumPointer&& dq,
-                     BignumPointer&& qi);
+                     BignumPointer&& qi,
+                     OtherPrimeInfoPointers&& other_prime_infos = {});
 
   using CipherParams = Cipher::CipherParams;
 
@@ -765,6 +784,7 @@ class Rsa final {
   DeleteFnPtr<BIGNUM, BN_clear_free> dp_;
   DeleteFnPtr<BIGNUM, BN_clear_free> dq_;
   DeleteFnPtr<BIGNUM, BN_clear_free> qi_;
+  OtherPrimeInfoPointers other_prime_infos_;
   std::optional<PssParams> pss_params_;
 #else
   OSSL3_CONST RSA* rsa_;
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index e80c70c961df..f6919221a4f2 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -22,6 +22,7 @@ using ncrypto::EVPKeyPointer;
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 using ncrypto::RSAPointer;
 #endif
+using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
 using v8::FunctionCallbackInfo;
@@ -39,6 +40,8 @@ using v8::Value;
 
 namespace crypto {
 namespace {
+constexpr uint32_t kMaxRsaOtherPrimeInfos = 8;
+
 bool IsRsaPssDigestEncodable(const Digest& digest) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   const int nid = EVP_MD_type(digest.get());
@@ -339,6 +342,29 @@ bool ExportJWKRsaKey(Environment* env,
             .IsNothing()) {
       return false;
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (!other_prime_infos.empty()) {
+      const uint32_t count = static_cast<uint32_t>(other_prime_infos.size());
+      Local<Array> oth = Array::New(env->isolate(), count);
+      for (uint32_t i = 0; i < count; i++) {
+        const auto& info = other_prime_infos[i];
+        Local<Object> item = Object::New(env->isolate());
+        if (SetEncodedValue(env, item, env->jwk_r_string(), info.r)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_d_string(), info.d)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_t_string(), info.t)
+                .IsNothing() ||
+            !oth->Set(env->context(), i, item).FromMaybe(false)) {
+          return false;
+        }
+      }
+      if (!target->DefineOwnProperty(env->context(), env->jwk_oth_string(), oth)
+               .FromMaybe(false)) {
+        return false;
+      }
+    }
   }
 
   return true;
@@ -348,12 +374,13 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   Local<Value> n_value;
   Local<Value> e_value;
   Local<Value> d_value;
+  Local<Value> oth_value;
 
   if (!jwk->Get(env->context(), env->jwk_n_string()).ToLocal(&n_value) ||
       !jwk->Get(env->context(), env->jwk_e_string()).ToLocal(&e_value) ||
       !jwk->Get(env->context(), env->jwk_d_string()).ToLocal(&d_value) ||
-      !n_value->IsString() ||
-      !e_value->IsString()) {
+      !jwk->Get(env->context(), env->jwk_oth_string()).ToLocal(&oth_value) ||
+      !n_value->IsString() || !e_value->IsString()) {
     THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
     return {};
   }
@@ -364,6 +391,10 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   }
 
   KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
+  if (type == kKeyTypePublic && !oth_value->IsUndefined()) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+    return {};
+  }
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   ncrypto::Rsa rsa_view;
@@ -417,19 +448,79 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
     ByteSource dq = ByteSource::FromEncodedString(env, dq_value.As<String>());
     ByteSource qi = ByteSource::FromEncodedString(env, qi_value.As<String>());
 
-    if (!rsa_view.setPrivateKey(
-            d.ToBN(), q.ToBN(), p.ToBN(), dp.ToBN(), dq.ToBN(), qi.ToBN())) {
+    ncrypto::Rsa::OtherPrimeInfoPointers other_prime_infos;
+    if (!oth_value->IsUndefined()) {
+      if (!oth_value->IsArray()) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+
+      Local<Array> oth = oth_value.As<Array>();
+      const uint32_t length = oth->Length();
+      if (length == 0 || length > kMaxRsaOtherPrimeInfos) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+      other_prime_infos.reserve(length);
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> item_value;
+        Local<Value> r_value;
+        Local<Value> other_d_value;
+        Local<Value> t_value;
+        if (!oth->Get(env->context(), i).ToLocal(&item_value) ||
+            !item_value->IsObject()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        Local<Object> item = item_value.As<Object>();
+        if (!item->Get(env->context(), env->jwk_r_string()).ToLocal(&r_value) ||
+            !item->Get(env->context(), env->jwk_d_string())
+                 .ToLocal(&other_d_value) ||
+            !item->Get(env->context(), env->jwk_t_string()).ToLocal(&t_value) ||
+            !r_value->IsString() || !other_d_value->IsString() ||
+            !t_value->IsString()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        other_prime_infos.push_back({
+            ByteSource::FromEncodedString(env, r_value.As<String>()).ToBN(),
+            ByteSource::FromEncodedString(env, other_d_value.As<String>())
+                .ToBN(),
+            ByteSource::FromEncodedString(env, t_value.As<String>()).ToBN(),
+        });
+      }
+    }
+
+    if (!rsa_view.setPrivateKey(d.ToBN(),
+                                q.ToBN(),
+                                p.ToBN(),
+                                dp.ToBN(),
+                                dq.ToBN(),
+                                qi.ToBN(),
+                                std::move(other_prime_infos))) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
       return {};
     }
 
-    // Verify that n == p * q.
+    // Verify that n is the product of all prime factors.
     const auto& pub = rsa_view.getPublicKey();
     const auto& priv = rsa_view.getPrivateKey();
-    auto pq = BignumPointer::New();
+    auto product = BignumPointer::New();
     BN_CTX* ctx = BN_CTX_new();
-    bool n_valid = ctx && pq && BN_mul(pq.get(), priv.p, priv.q, ctx) == 1 &&
-                   BN_cmp(pq.get(), pub.n) == 0;
+    bool n_valid =
+        ctx && product && BN_mul(product.get(), priv.p, priv.q, ctx) == 1;
+    for (const auto& info : rsa_view.getOtherPrimeInfos()) {
+      auto next = BignumPointer::New();
+      if (!n_valid || !next ||
+          BN_mul(next.get(), product.get(), info.r, ctx) != 1) {
+        n_valid = false;
+        break;
+      }
+      product = std::move(next);
+    }
+    n_valid = n_valid && BN_cmp(product.get(), pub.n) == 0;
     BN_CTX_free(ctx);
     if (!n_valid) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
diff --git a/src/env_properties.h b/src/env_properties.h
index 3eb1db96940b..fc1772f926e5 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -240,12 +240,15 @@
   V(jwk_n_string, "n")                                                         \
   V(jwk_oct_string, "oct")                                                     \
   V(jwk_okp_string, "OKP")                                                     \
+  V(jwk_oth_string, "oth")                                                     \
   V(jwk_p_string, "p")                                                         \
   V(jwk_priv_string, "priv")                                                   \
   V(jwk_pub_string, "pub")                                                     \
   V(jwk_q_string, "q")                                                         \
   V(jwk_qi_string, "qi")                                                       \
+  V(jwk_r_string, "r")                                                         \
   V(jwk_rsa_string, "RSA")                                                     \
+  V(jwk_t_string, "t")                                                         \
   V(jwk_x_string, "x")                                                         \
   V(jwk_y_string, "y")                                                         \
   V(kill_signal_string, "killSignal")                                          \
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 3ef61d00afff..0960e69f36fd 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -70,6 +70,7 @@ all: \
   rsa_spkac.spkac \
   rsa_spkac_invalid.spkac \
   rsa_private_2048.pem \
+  rsa_private_2048_3_primes.pem \
   rsa_private_4096.pem \
   rsa_public_2048.pem \
   rsa_public_4096.pem \
@@ -927,6 +928,13 @@ rsa_spkac_invalid.spkac: rsa_spkac.spkac
 rsa_private_2048.pem:
 	openssl genrsa -out rsa_private_2048.pem 2048
 
+rsa_private_2048_3_primes.pem:
+	openssl genpkey \
+		-algorithm RSA \
+		-pkeyopt rsa_keygen_bits:2048 \
+		-pkeyopt rsa_keygen_primes:3 \
+		-out rsa_private_2048_3_primes.pem
+
 rsa_private_4096.pem:
 	openssl genrsa -out rsa_private_4096.pem 4096
 
diff --git a/test/fixtures/keys/rsa_private_2048_3_primes.pem b/test/fixtures/keys/rsa_private_2048_3_primes.pem
new file mode 100644
index 000000000000..49535f2cd7f7
--- /dev/null
+++ b/test/fixtures/keys/rsa_private_2048_3_primes.pem
@@ -0,0 +1,29 @@
+-----BEGIN PRIVATE KEY-----
+MIIE8wIBADANBgkqhkiG9w0BAQEFAASCBN0wggTZAgEBAoIBAQC1Lu9a9Hlj8/OA
+J3I2h/1aFYV59SxWb1KzbuRb2nAoOVWCqG8ettkT7kGN6qva3C/oCw2pYPIlRxpX
+0Vve0fNRqpSCCXcnN9vlKpU0BrHfpIHuXSleT7vwSq70UV5YwjFhL+g5wcCUVCuz
+Fkd8dYb0keqVApSKkcydepk5/BwBwQdkfibs3RuIjROkgIbDKSXrm1lFinqyCBTG
+umLcaL9XMhaJRxsVIVqkCM6hs+kEXhIBvlFIqcycECKEV3l71nV0VM3RwlbORIjx
+iHpSvNEUixGR0Rwx4WdJNU4GiUJGZACKj+RrLX+mh0odOl5r8Up9TkTgWp4UEdUx
+GHbQ6lIrAgMBAAECggEAA8mZY1Nc/kPpQTKR5qXtG+b7RVNku+HT3sBgsbLdSVn5
+eaO/vuqfmxUN9cOEGC0mKzmf7XyDU1grKs7LltrYtUpVlGpSPVWjmSTMvauuKDiu
+Jqd35+irM+pQerj/AYOs9Lv2lLzzA1ivcSmB0uR2gNyiVvVxBAxydNXiBwCn+v8M
++qosREPVN9eEQ+1j+ZWvZ2j/AkT6EDdOl0qbhkLDkaLgDkO4uhAZfNKjwmuVkBoW
+BI9bUiQv9vzsSp7AIVXwd8D+NaX0VuDpbcIq/tIfrl2OxwUDuTkYYsvwlIwvAkZ4
+yMl57x2YjRJu2u4f4t+fuagqCisbbbE+LywM5r+YEQJWB/Z/lOoAXXCRSBSGhI29
+zI+pXWiK4UneitEKTJpdR7i38Var03aciK+q64z4gWDNSBRzYq5eyVWosv0f9WkO
+lQFRfOy0HM68dg2KYDCIVnquCwwgaDcCVgZ7lxyKqwirCDYL9VFxRNiBIOXuMLdl
+6c4YNpdPTrp/AILBeINJYKBYjpro6fPe0YHcxJpMNf5Izaow17VVAqJKDmXbca7y
+SclsgBR6mAnFf6WfFM5rAlYBe2nHp74lphwEVH2tEkyvVFXrotemkv8uyzWliF2w
+SbtC2iTlGQCNmFSxvu1J92B9+AB574aI5r6dget+2+zw4uvt2oizi+8b8e09dgsK
+PY9DUyB9BQJWBTsT4uPAvW3DYlijyOMsOcV3Vg+rH1AMJ09CPTSwwapYLykMpGJA
+pSDPcA8fNrdDNRV9TULRDiyQRhLC+n1tcqVumKFISXEWOIBjmCKTKs9A/9IsZ6EC
+VgQG607Arq/ztxJFVKHY4RW0v8Ofx9Q0h+GDcKqqxDlymZfrDsdKJjC1QTofRUR+
+JJiwshahF2jBtlsPwEjX8/InboaF2f2VlIxzxe2+GpzWeRgzIN9yMIIBDDCCAQgC
+VgOChKyWwWrVMfjdfwtFnMA/OjwK4KBtR8VWwAapaiJPFhZRM0jh8EMsC03X7xm9
+AbL3hfE3eLU2mRLxw1pPh0RfK2xtKTCZWjgnQDhPznMUUvF+FYxHAlYCZbRvGa1U
+Zffy7n7m2Q4+tTD2b8uLZ/jcjess4awvcOs6JQ4tWr07dCroaXPTlahCcBRZdLUK
+uRcGvIDc/3L5vTMwpMK8ghIARrbzf3cYXSpl7eOT4wJWAuPXcrk1PE1YuMidPa2v
+3OshgH2no6BeVW2vChBDnK9IBstWII/AhjQzDHjbj9S8xjLZA6bqHH89uXc+0Z/2
+hF8lLDsruEceLVckmk7wb1eFAvns/XA=
+-----END PRIVATE KEY-----
diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js
new file mode 100644
index 000000000000..be434c76e828
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+const {
+  createPrivateKey,
+} = require('crypto');
+const { subtle } = globalThis.crypto;
+
+if (process.features.openssl_is_boringssl)
+  common.skip('multi-prime RSA is not available with BoringSSL');
+if (hasFIPS())
+  common.skip('multi-prime RSA is not available in FIPS mode');
+
+const privateKey = createPrivateKey(
+  fixtures.readKey('rsa_private_2048_3_primes.pem'));
+const pkcs8 = privateKey.export({ format: 'der', type: 'pkcs8' });
+const jwk = privateKey.export({ format: 'jwk' });
+
+assert.strictEqual(jwk.oth.length, 1);
+assert.deepStrictEqual(Object.keys(jwk.oth[0]), ['r', 'd', 't']);
+
+const importedKey = createPrivateKey({ key: jwk, format: 'jwk' });
+assert.deepStrictEqual(importedKey.export({ format: 'jwk' }), jwk);
+assert.deepStrictEqual(
+  importedKey.export({ format: 'der', type: 'pkcs8' }),
+  pkcs8);
+
+for (const field of ['r', 'd', 't']) {
+  const invalidJwk = {
+    ...jwk,
+    oth: [{ ...jwk.oth[0] }],
+  };
+  delete invalidJwk.oth[0][field];
+  assert.throws(
+    () => createPrivateKey({ key: invalidJwk, format: 'jwk' }),
+    { code: 'ERR_CRYPTO_INVALID_JWK' });
+}
+
+(async () => {
+  const algorithm = { name: 'RSA-PSS', hash: 'SHA-256' };
+  const cryptoKey = await subtle.importKey(
+    'pkcs8', pkcs8, algorithm, true, ['sign']);
+  const exportedJwk = await subtle.exportKey('jwk', cryptoKey);
+
+  const exportedKeyMaterial = { ...exportedJwk };
+  delete exportedKeyMaterial.key_ops;
+  delete exportedKeyMaterial.ext;
+  delete exportedKeyMaterial.alg;
+  assert.deepStrictEqual(exportedKeyMaterial, jwk);
+
+  const importedCryptoKey = await subtle.importKey(
+    'jwk', exportedJwk, algorithm, true, ['sign']);
+  assert.deepStrictEqual(
+    Buffer.from(await subtle.exportKey('pkcs8', importedCryptoKey)),
+    pkcs8);
+})().then(common.mustCall());

From 7b61c62a3f741b1ba4ae7abafcafec692c812a04 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:12:34 +0000
Subject: [PATCH 103/202] stream: canWrite and ondrain now reflect physical
 capacity

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                        | 20 +++++++----
 lib/internal/streams/iter/broadcast.js        | 14 ++++----
 lib/internal/streams/iter/push.js             |  6 ++--
 ...test-stream-iter-broadcast-backpressure.js | 33 ++++++++++++++++++-
 test/parallel/test-stream-iter-push-writer.js | 31 +++++++++++++++++
 5 files changed, 87 insertions(+), 17 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index c1ebacd3dfad..6b430dd1d8e6 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -417,9 +417,13 @@ writer.fail(err);  // Always synchronous, no fallback needed
 
 * {boolean|null}
 
-Returns `true` if the next write is likely to be accepted (buffered data is
-below capacity), `false` if backpressure is active, or `null` if the writer
-is closed or the consumer has disconnected.
+Returns `true` if the slots buffer has physical capacity (buffered data is
+below the configured byte budget), `false` if the budget is exhausted, or
+`null` if the writer is closed or the consumer has disconnected.
+
+This reports physical capacity independently of the backpressure policy. With
+`'drop-oldest'` or `'drop-newest'`, writes still complete when this is `false`
+by evicting buffered data or discarding the incoming data, respectively.
 
 This is a hint, not a guarantee: the state can change between the check and
 the write. Use [`ondrain()`][] to wait for capacity rather than polling.
@@ -1089,9 +1093,13 @@ added:
 * `drainable` {Object} An object implementing the drainable protocol.
 * Returns: {Promise|null}
 
-Wait for a drainable writer's backpressure to clear. Returns `null` if
-the object does not implement the drainable protocol, or a promise that
-fulfills with `true` when the writer can accept more data.
+Wait for a drainable writer to regain physical buffer capacity. Returns `null`
+if the object does not implement the drainable protocol, or a promise that
+fulfills with `true` when buffered data falls below the byte budget.
+
+For writers using `'drop-oldest'` or `'drop-newest'`, this waits for physical
+capacity even though writes do not block. This allows producers to avoid data
+loss by waiting before writing.
 
 ```mjs
 import { push, ondrain, text } from 'node:stream/iter';
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0dc6364768d5..4131fbf2b8ec 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -310,6 +310,7 @@ class BroadcastImpl {
     if (this.#ended || this.#cancelled) return false;
 
     const batchSize = entry.byteLength;
+    let droppedOldest = false;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -321,6 +322,7 @@ class BroadcastImpl {
         case 'unbounded':
           return false;
         case 'drop-oldest':
+          droppedOldest = true;
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
@@ -343,6 +345,10 @@ class BroadcastImpl {
     this.#buffer.push(entry);
     this.#bufferedBytes += batchSize;
     this.#notifyConsumers();
+    if (droppedOldest &&
+        this.#bufferedBytes < this.#options.budget) {
+      this[kOnBufferDrained]?.();
+    }
     return true;
   }
 
@@ -399,15 +405,13 @@ class BroadcastImpl {
   }
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if ended/cancelled, true/false otherwise.
    * @returns {boolean | null}
    */
   [kCanWrite]() {
     if (this.#ended || this.#cancelled) return null;
-    if ((this.#options.backpressure === 'strict' ||
-        this.#options.backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#options.budget) {
+    if (this.#bufferedBytes >= this.#options.budget) {
       return false;
     }
     return true;
@@ -666,7 +670,6 @@ class BroadcastWriter {
 
   writeSync(chunk) {
     if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
     const converted =
       toUint8Array(chunk);
     const batch = createBatchEntry([converted]);
@@ -680,7 +683,6 @@ class BroadcastWriter {
   writevSync(chunks) {
     validateArray(chunks, 'chunks');
     if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
     const batch = createBatchEntry(converted);
     if (this.#broadcast[kWrite](batch)) {
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index fa84cafdfde7..c53fc7e902c6 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -152,7 +152,7 @@ class PushQueue {
   // ===========================================================================
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if writer is closed/errored or consumer has terminated.
    * @returns {boolean | null}
    */
@@ -160,9 +160,7 @@ class PushQueue {
     if (this.#writerState !== 'open' || this.#consumerState !== 'active') {
       return null;
     }
-    if ((this.#backpressure === 'strict' ||
-          this.#backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#budget) {
+    if (this.#bufferedBytes >= this.#budget) {
       return false;
     }
     return true;
diff --git a/test/parallel/test-stream-iter-broadcast-backpressure.js b/test/parallel/test-stream-iter-broadcast-backpressure.js
index 698f1821aeea..6efa7eb54c73 100644
--- a/test/parallel/test-stream-iter-broadcast-backpressure.js
+++ b/test/parallel/test-stream-iter-broadcast-backpressure.js
@@ -3,7 +3,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { broadcast, text } = require('stream/iter');
+const { broadcast, ondrain, text } = require('stream/iter');
 
 // =============================================================================
 // Backpressure policies
@@ -47,6 +47,36 @@ async function testDropNewest() {
   assert.strictEqual(data, 'K'.repeat(16384));
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, broadcast: bc } = broadcast({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = bc.push()[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    bc.cancel();
+  }
+}
+
 // =============================================================================
 // Block backpressure
 // =============================================================================
@@ -269,6 +299,7 @@ async function testEndSyncReturnValue() {
 Promise.all([
   testDropOldest(),
   testDropNewest(),
+  testDropPoliciesReportPhysicalCapacity(),
   testBlockBackpressure(),
   testBlockBackpressureContent(),
   testStrictBackpressureOverflow(),
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index dd6cf7d494b2..4f47675da146 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -19,6 +19,36 @@ async function testOndrain() {
   assert.strictEqual(ondrain(writer), null);
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, readable } = push({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = readable[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    await iterator.return();
+  }
+}
+
 async function testOndrainNonDrainable() {
   // Non-drainable objects return null
   assert.strictEqual(ondrain(null), null);
@@ -586,6 +616,7 @@ async function testFailRejectsPendingReadWithFalsyReason() {
 
 Promise.all([
   testOndrain(),
+  testDropPoliciesReportPhysicalCapacity(),
   testOndrainNonDrainable(),
   testWriteWithSignalRejects(),
   testWriteWithPreAbortedSignal(),

From 3c8f77f15d68ac6f7e029edc0ff65995c14ddfd6 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:23:12 +0000
Subject: [PATCH 104/202] stream: ensure factory signals remain active through
 closing

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                        |  4 +++-
 lib/internal/streams/iter/push.js             |  3 ++-
 test/parallel/test-stream-iter-push-writer.js | 16 ++++++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index 6b430dd1d8e6..6d6361472194 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -783,7 +783,9 @@ added:
     **Default:** `16384`.
   * `backpressure` {string} Backpressure policy: `'strict'`, `'unbounded'`,
     `'drop-oldest'`, or `'drop-newest'`. **Default:** `'strict'`.
-  * `signal` {AbortSignal} Abort the stream.
+  * `signal` {AbortSignal} Abort the stream. The signal remains active while
+    buffered data drains after `writer.end()`; aborting during that time fails
+    the writer and rejects the pending `end()` promise.
 * Returns: {Object}
   * `writer` {Writable} The writer side.
   * `readable` {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index c53fc7e902c6..8af326418b33 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -334,7 +334,6 @@ class PushQueue {
       return this.#bytesWritten; // Idempotent
     }
 
-    this.#cleanup();
     this.#rejectPendingWrites(
       new ERR_INVALID_STATE.TypeError('Writer closed'));
     this.#resolvePendingDrains(false);
@@ -342,6 +341,7 @@ class PushQueue {
     // If buffer is empty, close immediately
     if (this.#slots.length === 0) {
       this.#writerState = 'closed';
+      this.#cleanup();
       this.#resolvePendingReads();
       return this.#bytesWritten;
     }
@@ -359,6 +359,7 @@ class PushQueue {
   endDrained() {
     if (this.#writerState !== 'closing') return;
     this.#writerState = 'closed';
+    this.#cleanup();
     if (this.#pendingEnd) {
       this.#pendingEnd.resolve(this.#bytesWritten);
       this.#pendingEnd = null;
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 4f47675da146..8d9109d9eb3e 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -324,6 +324,21 @@ async function testEndSignalAbortWhileDraining() {
   assert.strictEqual(await completedEnd, 5);
 }
 
+async function testFactorySignalAbortWhileDraining() {
+  const controller = new AbortController();
+  const reason = new Error('stream aborted while draining');
+  const { writer, readable } = push({ signal: controller.signal });
+
+  writer.writeSync('hello');
+  const end = writer.end();
+  const endRejected = assert.rejects(end, (error) => error === reason);
+  controller.abort(reason);
+
+  await endRejected;
+  await assert.rejects(text(readable), (error) => error === reason);
+  await assert.rejects(writer.end(), (error) => error === reason);
+}
+
 async function testEndAfterEndSyncWaitsForDrain() {
   const { writer, readable } = push();
   writer.writeSync('hello');
@@ -634,6 +649,7 @@ Promise.all([
   testEndAsyncReturnValue(),
   testEndWithPreAbortedSignal(),
   testEndSignalAbortWhileDraining(),
+  testFactorySignalAbortWhileDraining(),
   testEndAfterEndSyncWaitsForDrain(),
   testWriteUint8Array(),
   testOndrainWaitsForDrain(),

From 57e0f33ebcb6d9e8459c5aae3d6a0ac82f71311d Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:27:42 +0000
Subject: [PATCH 105/202] stream: ensure async dispoal after endSync awaits for
 drain

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                        |  6 +++++
 lib/internal/streams/iter/push.js             | 25 ++++++-------------
 test/parallel/test-stream-iter-push-writer.js | 18 +++++++++++++
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index 6d6361472194..f8e27c3200e9 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -462,6 +462,12 @@ or errored, this is a no-op. Unlike `write()` and `end()`, `fail()` is
 unconditionally synchronous because failing a writer is a pure state
 transition with no async work to perform.
 
+#### `writer[Symbol.asyncDispose]()`
+
+If the writer is open, calls `writer.fail()`. If the writer is closing after
+`end()` or `endSync()`, waits for buffered data to drain. If the writer is
+already closed or errored, resolves immediately.
+
 #### `writer.write(chunk[, options])`
 
 * `chunk` {Uint8Array|string}
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 8af326418b33..767a54681064 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -412,12 +412,12 @@ class PushQueue {
     return this.#writerState;
   }
 
-  get pendingEndPromise() {
-    return this.#pendingEnd?.promise ?? null;
-  }
-
-  setPendingEnd(pending) {
-    this.#pendingEnd = pending;
+  getPendingEndPromise() {
+    if (this.#pendingEnd === null) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      this.#pendingEnd = { __proto__: null, promise, resolve, reject };
+    }
+    return this.#pendingEnd.promise;
   }
 
   /**
@@ -691,15 +691,7 @@ class PushWriter {
       return PromiseReject(this.#queue.error);
     }
     if (result === -3) {
-      // Closing: buffer has data, create deferred promise that resolves
-      // when consumer drains past the end sentinel
-      const pendingEndPromise = this.#queue.pendingEndPromise;
-      if (pendingEndPromise !== null) {
-        return raceEndWithSignal(pendingEndPromise, signal);
-      }
-      const { promise, resolve, reject } = PromiseWithResolvers();
-      this.#queue.setPendingEnd({ __proto__: null, promise, resolve, reject });
-      return raceEndWithSignal(promise, signal);
+      return raceEndWithSignal(this.#queue.getPendingEndPromise(), signal);
     }
     // >= 0: byte count (immediate close or idempotent)
     return PromiseResolve(result);
@@ -719,8 +711,7 @@ class PushWriter {
   [SymbolAsyncDispose]() {
     const state = this.#queue.writerState;
     if (state === 'closing') {
-      // Wait for graceful drain
-      return this.#queue.pendingEndPromise ?? PromiseResolve();
+      return this.#queue.getPendingEndPromise();
     }
     if (state === 'open') {
       this.fail();
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 8d9109d9eb3e..2e4eeafbda50 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -561,6 +561,23 @@ async function testAsyncDispose() {
   }
 }
 
+async function testAsyncDisposeWaitsAfterEndSync() {
+  const { writer, readable } = push({ budget: 16384 });
+  writer.writeSync('hello');
+  assert.strictEqual(writer.endSync(), -1);
+
+  let disposed = false;
+  const disposal = writer[Symbol.asyncDispose]().then(() => {
+    disposed = true;
+  });
+  await Promise.resolve();
+  assert.strictEqual(disposed, false);
+
+  assert.strictEqual(await text(readable), 'hello');
+  await disposal;
+  assert.strictEqual(disposed, true);
+}
+
 async function testSyncDispose() {
   const { writer, readable } = push({ budget: 16384 });
   writer.writeSync('hello');
@@ -666,5 +683,6 @@ Promise.all([
   testEndIdempotentWhenClosed(),
   testEndRejectsWhenErrored(),
   testAsyncDispose(),
+  testAsyncDisposeWaitsAfterEndSync(),
   testSyncDispose(),
 ]).then(common.mustCall());

From e6332d61755ee728076aee3b2877022da6443a66 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:38:22 +0000
Subject: [PATCH 106/202] stream: ensure pre-existing writes drain before EOF
 and end() waits

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                        |  6 +-
 lib/internal/streams/iter/push.js             | 35 +++++------
 test/parallel/test-stream-iter-push-writer.js | 61 +++++++++++++------
 3 files changed, 65 insertions(+), 37 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index f8e27c3200e9..b46057f60371 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -435,7 +435,11 @@ the write. Use [`ondrain()`][] to wait for capacity rather than polling.
     the pending `end()` call; it does not fail the writer itself.
 * Returns: {Promise} Fulfills with the total number of bytes written.
 
-Signals that no more data will be written and waits for buffered data to drain.
+Signals that no more data will be written. Writes already waiting for buffer
+space remain ordered before the end of the stream, while later writes fail. If
+data is outstanding, the returned promise fulfills after the consumer pulls
+`done: true` beyond the final batch. If no data is buffered or pending, the
+writer closes immediately.
 
 #### `writer.endSync()`
 
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 767a54681064..8d680cd2ad01 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -299,7 +299,10 @@ class PushQueue {
       const onAbort = () => {
         // Remove from queue so it doesn't occupy a slot
         const idx = this.#pendingWrites.indexOf(entry);
-        if (idx !== -1) this.#pendingWrites.removeAt(idx);
+        if (idx !== -1) {
+          this.#pendingWrites.removeAt(idx);
+          this.#resolvePendingReads();
+        }
         reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
       };
 
@@ -334,30 +337,31 @@ class PushQueue {
       return this.#bytesWritten; // Idempotent
     }
 
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Writer closed'));
     this.#resolvePendingDrains(false);
 
-    // If buffer is empty, close immediately
-    if (this.#slots.length === 0) {
+    // If there is no accepted work to drain, close immediately.
+    if (this.#slots.length === 0 && this.#pendingWrites.length === 0) {
       this.#writerState = 'closed';
       this.#cleanup();
       this.#resolvePendingReads();
       return this.#bytesWritten;
     }
 
-    // Buffer has data: transition to closing, defer completion until drained
+    // Accepted work remains: close after it drains and the consumer pulls EOF.
     this.#writerState = 'closing';
     return -3; // Signal to PushWriter: create deferred end promise
   }
 
   /**
-   * Called by the read path when the consumer has drained all data while
-   * the writer is in the 'closing' state. Transitions to 'closed' and
-   * resolves the pending end promise.
+   * Called when the consumer pulls past all accepted data while the writer is
+   * closing. Transitions to 'closed' and resolves the pending end promise.
    */
   endDrained() {
-    if (this.#writerState !== 'closing') return;
+    if (this.#writerState !== 'closing' ||
+        this.#slots.length > 0 ||
+        this.#pendingWrites.length > 0) {
+      return;
+    }
     this.#writerState = 'closed';
     this.#cleanup();
     if (this.#pendingEnd) {
@@ -384,6 +388,7 @@ class PushQueue {
     this.#cleanup();
     this.#rejectPendingReads(this.#error);
     this.#rejectPendingDrains(this.#error);
+    this.#rejectPendingWrites(this.#error);
 
     if (wasClosing) {
       // Short-circuit the graceful drain: reject the pending end promise
@@ -391,8 +396,6 @@ class PushQueue {
         this.#pendingEnd.reject(this.#error);
         this.#pendingEnd = null;
       }
-    } else {
-      this.#rejectPendingWrites(this.#error);
     }
   }
 
@@ -446,10 +449,6 @@ class PushQueue {
     if (this.#slots.length > 0) {
       const result = this.#drain();
       this.#resolvePendingWrites();
-      // After draining, check if writer was closing and buffer is now empty
-      if (this.#writerState === 'closing' && this.#slots.length === 0) {
-        this.endDrained();
-      }
       return { __proto__: null, done: false, value: result };
     }
 
@@ -555,7 +554,9 @@ class PushQueue {
         } catch (error) {
           pending.reject(error);
         }
-      } else if (this.#writerState === 'closing' && this.#slots.length === 0) {
+      } else if (this.#writerState === 'closing' &&
+                 this.#slots.length === 0 &&
+                 this.#pendingWrites.length === 0) {
         this.endDrained();
         const pending = this.#pendingReads.shift();
         pending.resolve({ __proto__: null, done: true, value: undefined });
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 2e4eeafbda50..98f084ab01a6 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -84,9 +84,9 @@ async function testWriteWithSignalRejects() {
   await assert.rejects(writePromise, { name: 'AbortError' });
 
   // Clean up
-  writer.end();
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+  const end = writer.end();
+  await text(readable);
+  await end;
 }
 
 async function testWriteWithPreAbortedSignal() {
@@ -100,9 +100,10 @@ async function testWriteWithPreAbortedSignal() {
 
   // Writer should still be usable for other writes
   writer.write('ok');
-  writer.end();
+  const end = writer.end();
   const data = await text(readable);
   assert.strictEqual(data, 'ok');
+  await end;
 }
 
 async function testCancelledWriteRemovedFromQueue() {
@@ -127,7 +128,7 @@ async function testCancelledWriteRemovedFromQueue() {
   // The cancelled write should NOT occupy a pending slot.
   // A new write should succeed now that the buffer has room.
   await writer.write(kChunk);
-  writer.end();
+  const end = writer.end();
 
   const result = await iter.next();
   assert.ok(!result.done);
@@ -136,7 +137,8 @@ async function testCancelledWriteRemovedFromQueue() {
     totalBytes += chunk.byteLength;
   }
   assert.strictEqual(totalBytes, 16384);
-  await iter.return();
+  assert.strictEqual((await iter.next()).done, true);
+  await end;
 }
 
 async function testOndrainResolvesFalseOnConsumerBreak() {
@@ -505,28 +507,48 @@ async function testConsumerThrowRejectsPendingRead() {
   await readRejects;
 }
 
-// end() while writes are pending rejects those writes
-async function testEndRejectsPendingWrites() {
+// end() drains writes that were already pending, then waits for EOF to be read.
+async function testEndDrainsPendingWrites() {
   const kChunk = new Uint8Array(16384);
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   writer.writeSync(kChunk); // fill budget
 
   // This write blocks on backpressure
   const writePromise = writer.write(kChunk);
+  const endPromise = writer.end();
+  await assert.rejects(writer.write(kChunk), { code: 'ERR_INVALID_STATE' });
 
-  await new Promise(setImmediate);
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
 
-  // Ending should reject the pending write
-  writer.endSync();
+  assert.strictEqual((await iterator.next()).done, false);
+  await writePromise;
+  assert.strictEqual((await iterator.next()).done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
 
-  await assert.rejects(
-    () => writePromise,
-    { code: 'ERR_INVALID_STATE' },
-  );
+  assert.strictEqual((await iterator.next()).done, true);
+  assert.strictEqual(await endPromise, kChunk.byteLength * 2);
+  assert.strictEqual(ended, true);
+}
 
-  // Clean up: drain the readable
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+async function testEndWaitsForEofPull() {
+  const { writer, readable } = push();
+  writer.writeSync('hello');
+  const endPromise = writer.end();
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
+
+  const data = await iterator.next();
+  assert.strictEqual(data.done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
+
+  assert.strictEqual((await iterator.next()).done, true);
+  await endPromise;
+  assert.strictEqual(ended, true);
 }
 
 async function testEndIdempotentWhenClosed() {
@@ -679,7 +701,8 @@ Promise.all([
   testConsumerReturnResolvesPendingRead(),
   testEndRejectsAfterConsumerReturn(),
   testConsumerThrowRejectsPendingRead(),
-  testEndRejectsPendingWrites(),
+  testEndDrainsPendingWrites(),
+  testEndWaitsForEofPull(),
   testEndIdempotentWhenClosed(),
   testEndRejectsWhenErrored(),
   testAsyncDispose(),

From 1ed73da6a05f25696ca47696fc18999b0fc54914 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:44:08 +0000
Subject: [PATCH 107/202] stream: pre-aborted pipeTo now applies dest failure
 handling

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                        |  3 +-
 lib/internal/streams/iter/pull.js             | 18 +++++--
 .../test-stream-iter-pipeto-signal.js         | 47 +++++++++++++++++++
 3 files changed, 62 insertions(+), 6 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index b46057f60371..32120aaf4a3c 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -619,7 +619,8 @@ added:
 * `...transforms` {Function|Object} Zero or more transforms to apply.
 * `writer` {Object} Destination with `write(chunk)` method.
 * `options` {Object}
-  * `signal` {AbortSignal} Abort the pipeline.
+  * `signal` {AbortSignal} Abort the pipeline. Aborting fails the destination
+    writer unless `preventFail` is `true`.
   * `preventClose` {boolean} If `true`, do not call `writer.end()` when
     the source ends. **Default:** `false`.
   * `preventFail` {boolean} If `true`, do not call `writer.fail()` on
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index c1e42f03dc38..75a2f1a7f308 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -1054,8 +1054,18 @@ async function pipeTo(source, ...args) {
 
   const signal = options?.signal;
 
-  // Check for abort
-  signal?.throwIfAborted();
+  function failWriter(error) {
+    if (!options?.preventFail) {
+      writer.fail?.(wrapError(error));
+    }
+  }
+
+  try {
+    signal?.throwIfAborted();
+  } catch (error) {
+    failWriter(error);
+    throw error;
+  }
 
   const hasWriteSync = typeof writer.writeSync === 'function';
   const useSyncIterableFastPath =
@@ -1192,9 +1202,7 @@ async function pipeTo(source, ...args) {
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
-      writer.fail?.(wrapError(error));
-    }
+    failWriter(error);
     throw error;
   }
 
diff --git a/test/parallel/test-stream-iter-pipeto-signal.js b/test/parallel/test-stream-iter-pipeto-signal.js
index ec1324a4e04b..be04c8c635df 100644
--- a/test/parallel/test-stream-iter-pipeto-signal.js
+++ b/test/parallel/test-stream-iter-pipeto-signal.js
@@ -9,6 +9,51 @@ const assert = require('assert');
 const { setTimeout } = require('timers/promises');
 const { pipeTo, from } = require('stream/iter');
 
+async function testPipeToPreAbortedSignalFailsWriter() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustCall((error) => assert.strictEqual(error, reason)),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, { signal: AbortSignal.abort(reason) }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
+async function testPipeToPreAbortedSignalPreventFail() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustNotCall(),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, {
+      signal: AbortSignal.abort(reason),
+      preventFail: true,
+    }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
 // pipeTo with live signal, no transforms — abort mid-stream
 async function testPipeToLiveSignalNoTransforms() {
   const ac = new AbortController();
@@ -116,6 +161,8 @@ async function testPipeToLiveSignalWithTransformsCompletes() {
 }
 
 Promise.all([
+  testPipeToPreAbortedSignalFailsWriter(),
+  testPipeToPreAbortedSignalPreventFail(),
   testPipeToLiveSignalNoTransforms(),
   testPipeToLiveSignalNoTransformsPendingNext(),
   testPipeToLiveSignalWithTransforms(),

From 7089049a09ec0685e1ed5188518dd05669775243 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 01:55:01 +0000
Subject: [PATCH 108/202] stream: make pipeTo source normalization independent
 of Writer

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/streams/iter/pull.js        | 53 +-----------------------
 test/parallel/test-stream-iter-pipeto.js | 39 +++++++++++++----
 2 files changed, 34 insertions(+), 58 deletions(-)

diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index 75a2f1a7f308..0be6a3975dbd 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -8,8 +8,6 @@
 
 const {
   ArrayBufferIsView,
-  ArrayFromAsync,
-  ArrayIsArray,
   ArrayPrototypePush,
   ArrayPrototypeSlice,
   FunctionPrototypeCall,
@@ -46,9 +44,7 @@ const {
   fromSync,
   isSyncIterable,
   isAsyncIterable,
-  isPrimitiveChunk,
   isUint8ArrayBatch,
-  normalizeAsyncValue,
 } = require('internal/streams/iter/from');
 
 const {
@@ -65,10 +61,7 @@ const {
 } = require('internal/streams/iter/utils');
 
 const {
-  kValidatedSource,
   kValidatedTransform,
-  toAsyncStreamable,
-  toStreamable,
 } = require('internal/streams/iter/types');
 
 // =============================================================================
@@ -131,22 +124,6 @@ function parsePipeToArgs(args, requiredMethod) {
   };
 }
 
-function canUseSyncIterablePipeToFastPath(source, transforms, signal) {
-  if (signal !== undefined ||
-      transforms.length !== 0 ||
-      isPrimitiveChunk(source) ||
-      ArrayIsArray(source) ||
-      source?.[kValidatedSource] ||
-      !isSyncIterable(source) ||
-      isAsyncIterable(source)) {
-    return false;
-  }
-
-  // Preserve from()'s top-level protocol precedence for custom iterables.
-  return typeof source[toAsyncStreamable] !== 'function' &&
-    typeof source[toStreamable] !== 'function';
-}
-
 // =============================================================================
 // Transform Output Flattening
 // =============================================================================
@@ -1068,9 +1045,7 @@ async function pipeTo(source, ...args) {
   }
 
   const hasWriteSync = typeof writer.writeSync === 'function';
-  const useSyncIterableFastPath =
-    hasWriteSync && canUseSyncIterablePipeToFastPath(source, transforms, signal);
-  const normalized = useSyncIterableFastPath ? undefined : from(source);
+  const normalized = from(source);
 
   let totalBytes = 0;
   const hasWritev = typeof writer.writev === 'function';
@@ -1141,31 +1116,7 @@ async function pipeTo(source, ...args) {
   }
 
   try {
-    if (useSyncIterableFastPath) {
-      // Avoid from()'s async sync-iterable batching path. This keeps writes
-      // incremental for synchronous sources while preserving async
-      // normalization for non-primitive yielded values.
-      for (const value of source) {
-        if (isUint8ArrayBatch(value)) {
-          if (value.length > 0) {
-            const p = writeBatch(value);
-            if (p) await p;
-          }
-          continue;
-        }
-        if (isUint8Array(value)) {
-          const p = writeBatch([value]);
-          if (p) await p;
-          continue;
-        }
-
-        const batch = await ArrayFromAsync(normalizeAsyncValue(value));
-        if (batch.length > 0) {
-          const p = writeBatch(batch);
-          if (p) await p;
-        }
-      }
-    } else if (transforms.length === 0) {
+    if (transforms.length === 0) {
       // Fast path: no transforms - iterate normalized source directly
       if (signal) {
         for await (const batch of yieldAbortable(normalized, signal)) {
diff --git a/test/parallel/test-stream-iter-pipeto.js b/test/parallel/test-stream-iter-pipeto.js
index f16d7ae89972..4711b291a7af 100644
--- a/test/parallel/test-stream-iter-pipeto.js
+++ b/test/parallel/test-stream-iter-pipeto.js
@@ -247,7 +247,7 @@ async function testPipeToSyncMinimalWriter() {
   assert.strictEqual(chunks.length > 0, true);
 }
 
-async function testPipeToSyncIterableFastPathWritesIncrementally() {
+async function testPipeToSyncIterableUsesFromBatching() {
   let pulled = 0;
   let firstWritePulled = 0;
   const chunks = [];
@@ -270,7 +270,7 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
 
   const totalBytes = await pipeTo(source(), writer);
   assert.strictEqual(totalBytes, 3);
-  assert.strictEqual(firstWritePulled, 1);
+  assert.strictEqual(firstWritePulled, 3);
   assert.deepStrictEqual(chunks, [
     new Uint8Array([0x61]),
     new Uint8Array([0x62]),
@@ -278,7 +278,31 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
   ]);
 }
 
-async function testPipeToSyncIterableFastPathWriteFallback() {
+async function testPipeToSourceNormalizationIndependentOfWriter() {
+  function source() {
+    return {
+      *[Symbol.iterator]() {
+        yield {
+          async *[Symbol.asyncIterator]() {
+            yield 'nested';
+          },
+        };
+      },
+    };
+  }
+
+  for (const hasWriteSync of [false, true]) {
+    const writer = { write: common.mustNotCall() };
+    if (hasWriteSync) writer.writeSync = common.mustNotCall();
+
+    await assert.rejects(
+      pipeTo(source(), writer, { preventClose: true, preventFail: true }),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+    );
+  }
+}
+
+async function testPipeToSyncIterableWriteFallback() {
   const asyncWrites = [];
   const writer = {
     writeSync(chunk) {
@@ -299,7 +323,7 @@ async function testPipeToSyncIterableFastPathWriteFallback() {
   assert.deepStrictEqual(asyncWrites, [new Uint8Array([0x62])]);
 }
 
-async function testPipeToSyncIterableFastPathAsyncValue() {
+async function testPipeToSyncIterableAsyncValue() {
   const chunks = [];
   const writer = {
     write: common.mustNotCall(),
@@ -337,7 +361,8 @@ Promise.all([
   testPipeToSyncPreventClose(),
   testPipeToMinimalWriter(),
   testPipeToSyncMinimalWriter(),
-  testPipeToSyncIterableFastPathWritesIncrementally(),
-  testPipeToSyncIterableFastPathWriteFallback(),
-  testPipeToSyncIterableFastPathAsyncValue(),
+  testPipeToSyncIterableUsesFromBatching(),
+  testPipeToSyncIterableWriteFallback(),
+  testPipeToSyncIterableAsyncValue(),
+  testPipeToSourceNormalizationIndependentOfWriter(),
 ]).then(common.mustCall());

From 7fafadf3cea94dd5688e09974b0cd7cba62bb93a Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 02:04:08 +0000
Subject: [PATCH 109/202] stream: make consumer signals on longer alter source
 precedence

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/streams/iter/consumers.js        |  4 +--
 .../test-stream-iter-consumers-bytes.js       | 26 +++++++++++++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index 0a317939e8f4..95ab63a054b3 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -143,9 +143,7 @@ async function collectAsync(source, signal, limit) {
   signal?.throwIfAborted();
 
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
-  const abortableSource = signal && isAsyncIterable(source) ?
-    yieldAbortable(source, signal) : source;
-  const normalized = from(abortableSource);
+  const normalized = from(source);
   const entries = [];
 
   // Fast path: no signal and no limit
diff --git a/test/parallel/test-stream-iter-consumers-bytes.js b/test/parallel/test-stream-iter-consumers-bytes.js
index 53d0a3858f87..531917eb9734 100644
--- a/test/parallel/test-stream-iter-consumers-bytes.js
+++ b/test/parallel/test-stream-iter-consumers-bytes.js
@@ -101,6 +101,31 @@ async function testAsyncConsumersAbortPendingNormalization() {
   }
 }
 
+async function testAsyncConsumerSignalPreservesProtocolPrecedence() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    __proto__: null,
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('protocol');
+    },
+    async *[Symbol.asyncIterator]() {
+      iteratorCalls++;
+      yield 'iterator';
+    },
+  };
+
+  const result = await text(source, {
+    __proto__: null,
+    signal: new AbortController().signal,
+  });
+
+  assert.strictEqual(result, 'protocol');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+}
+
 async function testBytesEmpty() {
   const data = await bytes(from([]));
   assert.ok(data instanceof Uint8Array);
@@ -255,6 +280,7 @@ Promise.all([
   testBytesAsyncAbort(),
   testAsyncConsumersAbortPendingNext(),
   testAsyncConsumersAbortPendingNormalization(),
+  testAsyncConsumerSignalPreservesProtocolPrecedence(),
   testBytesEmpty(),
   testArrayBufferSyncBasic(),
   testArrayBufferAsync(),

From 6e1789a3cef2d607a9ab3d829664733d33c2c3d5 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 02:35:19 +0000
Subject: [PATCH 110/202] stream: apply source normalization once at call time

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                       |  9 ++--
 lib/internal/streams/iter/pull.js            | 35 +++++++------
 test/parallel/test-stream-iter-pull-async.js | 55 +++++++++++++++++---
 test/parallel/test-stream-iter-pull-sync.js  | 33 +++++++++++-
 4 files changed, 105 insertions(+), 27 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index 32120aaf4a3c..45509c7f07e4 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -703,8 +703,10 @@ added:
   * `signal` {AbortSignal} Abort the pipeline.
 * Returns: {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
 
-Create a lazy async pipeline. Data is not read from `source` until the
-returned iterable is consumed. Transforms are applied in order.
+Create a lazy async pipeline. Source conversion and streamable protocol
+dispatch occur when `pull()` is called, but data is not read from `source`
+until the returned iterable is consumed. A signal that is already aborted is
+thrown synchronously after source conversion. Transforms are applied in order.
 
 ```mjs
 import { from, pull, text } from 'node:stream/iter';
@@ -774,7 +776,8 @@ added:
 * `...transforms` {Function|Object} Zero or more sync transforms.
 * Returns: {Iterable} whose chunks return {Uint8Array\[]}
 
-Synchronous version of [`pull()`][]. All transforms must be synchronous.
+Synchronous version of [`pull()`][]. Source conversion and streamable protocol
+dispatch occur when `pullSync()` is called. All transforms must be synchronous.
 
 ## Push streams
 
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index 0be6a3975dbd..6e00ab43f414 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -805,6 +805,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
  * @returns {Iterable<Uint8Array[]>}
  */
 function pullSync(source, ...transforms) {
+  const normalized = fromSync(source);
   for (let i = 0; i < transforms.length; i++) {
     if (!isTransform(transforms[i])) {
       throw new ERR_INVALID_ARG_TYPE(
@@ -815,7 +816,7 @@ function pullSync(source, ...transforms) {
   return {
     __proto__: null,
     *[SymbolIterator]() {
-      yield* createSyncPipeline(fromSync(source), transforms);
+      yield* createSyncPipeline(normalized, transforms);
     },
   };
 }
@@ -832,17 +833,9 @@ function pull(source, ...args) {
   const signal = options?.signal;
   if (signal !== undefined) {
     validateAbortSignal(signal, 'options.signal');
-    // Eagerly check abort at call time per spec
-    if (signal.aborted) {
-      return {
-        __proto__: null,
-        // eslint-disable-next-line require-yield
-        async *[SymbolAsyncIterator]() {
-          throw signal.reason;
-        },
-      };
-    }
   }
+  const normalized = from(source);
+  signal?.throwIfAborted();
 
   return {
     __proto__: null,
@@ -852,7 +845,7 @@ function pull(source, ...args) {
         controller.signal : AbortSignal.any([signal, controller.signal]);
 
       async function* pipeline() {
-        yield* createAsyncPipeline(from(source), transforms, iteratorSignal);
+        yield* createAsyncPipeline(normalized, transforms, iteratorSignal);
       }
       const iterator = pipeline();
 
@@ -887,9 +880,6 @@ function pullWithConsumerCleanup(source, transforms, signal) {
       return sourceIterator;
     },
   };
-  const pipeline = signal === undefined ?
-    pull(pipelineSource, ...transforms) :
-    pull(pipelineSource, ...transforms, { __proto__: null, signal });
   let sourceClosed = false;
   let abortHandler;
 
@@ -906,6 +896,21 @@ function pullWithConsumerCleanup(source, transforms, signal) {
     }
   }
 
+  if (signal?.aborted) {
+    closeSource('throw', signal.reason);
+    return {
+      __proto__: null,
+      // eslint-disable-next-line require-yield
+      async *[SymbolAsyncIterator]() {
+        throw signal.reason;
+      },
+    };
+  }
+
+  const pipeline = signal === undefined ?
+    pull(pipelineSource, ...transforms) :
+    pull(pipelineSource, ...transforms, { __proto__: null, signal });
+
   if (signal !== undefined) {
     abortHandler = () => closeSource('throw', signal.reason);
     signal.addEventListener('abort', abortHandler,
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 86c790c85cb2..6105d9250cad 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -11,6 +11,7 @@ const {
   share,
   tap,
   text,
+  toAsyncStreamable,
 } = require('stream/iter');
 
 async function testPullIdentity() {
@@ -53,18 +54,54 @@ async function testPullWithAbortSignal() {
     yield [new Uint8Array([1])];
   }
 
-  const result = pull(gen(), { signal: AbortSignal.abort() });
-  await assert.rejects(
-    async () => {
-      // eslint-disable-next-line no-unused-vars
-      for await (const _ of result) {
-        assert.fail('Should not reach here');
-      }
-    },
+  assert.throws(
+    () => pull(gen(), { signal: AbortSignal.abort() }),
     { name: 'AbortError' },
   );
 }
 
+async function testPullNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return {
+        async *[Symbol.asyncIterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pull(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(await text(result), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+}
+
+function testPullPreAbortOrdering() {
+  const reason = new Error('already aborted');
+  let protocolCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('data');
+    },
+  };
+  const signal = AbortSignal.abort(reason);
+
+  assert.throws(() => pull(source, { signal }), (error) => error === reason);
+  assert.strictEqual(protocolCalls, 1);
+  assert.throws(
+    () => pull(null, { signal }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+}
+
 async function testPullChainedTransforms() {
   const enc = new TextEncoder();
   const transforms = [
@@ -475,6 +512,8 @@ async function testTransformOptionsNotShared() {
     testPullStatelessTransform(),
     testPullStatefulTransform(),
     testPullWithAbortSignal(),
+    testPullNormalizesSourceAtCallTime(),
+    testPullPreAbortOrdering(),
     testPullChainedTransforms(),
     testPullSourceError(),
     testTapCallbackError(),
diff --git a/test/parallel/test-stream-iter-pull-sync.js b/test/parallel/test-stream-iter-pull-sync.js
index c47a6b3f9233..f14619cc1b42 100644
--- a/test/parallel/test-stream-iter-pull-sync.js
+++ b/test/parallel/test-stream-iter-pull-sync.js
@@ -3,7 +3,13 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pullSync, fromSync, bytesSync, tapSync } = require('stream/iter');
+const {
+  pullSync,
+  fromSync,
+  bytesSync,
+  tapSync,
+  toStreamable,
+} = require('stream/iter');
 
 function testPullSyncIdentity() {
   // No transforms - just pass through
@@ -11,6 +17,30 @@ function testPullSyncIdentity() {
   assert.deepStrictEqual(data, new TextEncoder().encode('hello'));
 }
 
+function testPullSyncNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toStreamable]() {
+      protocolCalls++;
+      return {
+        *[Symbol.iterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pullSync(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(new TextDecoder().decode(bytesSync(result)), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+  assert.throws(() => pullSync(null), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 function testPullSyncStatelessTransform() {
   const upper = (chunks) => {
     if (chunks === null) return null;
@@ -177,6 +207,7 @@ function testPullSyncInvalidTransform() {
 
 Promise.all([
   testPullSyncIdentity(),
+  testPullSyncNormalizesSourceAtCallTime(),
   testPullSyncStatelessTransform(),
   testPullSyncStatefulTransform(),
   testPullSyncChainedTransforms(),

From 60b8f285f686912e8c70df613f10adb492630050 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 02:42:36 +0000
Subject: [PATCH 111/202] stream: ensure from() observes returned rejecting
 promise correctly

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/streams/iter/from.js            |  9 ++++++++-
 test/parallel/test-stream-iter-from-async.js | 15 +++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/lib/internal/streams/iter/from.js b/lib/internal/streams/iter/from.js
index 59ac6a15775b..b33509ba90e6 100644
--- a/lib/internal/streams/iter/from.js
+++ b/lib/internal/streams/iter/from.js
@@ -15,6 +15,7 @@ const {
   DataViewPrototypeGetByteLength,
   DataViewPrototypeGetByteOffset,
   FunctionPrototypeCall,
+  PromisePrototypeThen,
   SymbolAsyncIterator,
   SymbolIterator,
   TypedArrayPrototypeGetBuffer,
@@ -23,6 +24,8 @@ const {
   Uint8Array,
 } = primordials;
 
+const { markPromiseAsHandled } = internalBinding('util');
+
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
@@ -594,7 +597,11 @@ function from(input) {
   // Check toAsyncStreamable protocol (takes precedence over toStreamable and
   // iteration protocols)
   if (typeof input[toAsyncStreamable] === 'function') {
-    const result = input[toAsyncStreamable]();
+    let result = input[toAsyncStreamable]();
+    if (isPromise(result)) {
+      result = PromisePrototypeThen(result, undefined, undefined);
+      markPromiseAsHandled(result);
+    }
     // Synchronous validated source (e.g. Readable batched iterator)
     if (result?.[kValidatedSource]) {
       return result;
diff --git a/test/parallel/test-stream-iter-from-async.js b/test/parallel/test-stream-iter-from-async.js
index 5ef78088bfbd..cdc6cc23ea2f 100644
--- a/test/parallel/test-stream-iter-from-async.js
+++ b/test/parallel/test-stream-iter-from-async.js
@@ -235,6 +235,20 @@ async function testFromTopLevelProtocolOverIterator() {
   assert.strictEqual(result, 'from-protocol');
 }
 
+async function testFromHandlesProtocolRejectionUntilIteration() {
+  const reason = new Error('protocol failed');
+  const iterable = from({
+    [Symbol.for('Stream.toAsyncStreamable')]: common.mustCall(
+      () => Promise.reject(reason)),
+  });
+
+  await new Promise(setImmediate);
+  await assert.rejects(
+    iterable[Symbol.asyncIterator]().next(),
+    (error) => error === reason,
+  );
+}
+
 // DataView input should be converted to Uint8Array (zero-copy)
 async function testFromDataView() {
   const buf = new ArrayBuffer(5);
@@ -279,5 +293,6 @@ Promise.all([
   testFromTopLevelToStreamable(),
   testFromTopLevelAsyncPrecedence(),
   testFromTopLevelProtocolOverIterator(),
+  testFromHandlesProtocolRejectionUntilIteration(),
   testFromDataView(),
 ]).then(common.mustCall());

From 33f85fee74ba9d46f06bcd7c90478fa254449b9d Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 02:46:33 +0000
Subject: [PATCH 112/202] stream: fix nested async flushing with infinite
 sources

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                       |  3 ++-
 lib/internal/streams/iter/from.js            |  6 ++++-
 test/parallel/test-stream-iter-from-async.js | 25 ++++++++++++++++++++
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index 45509c7f07e4..e146c95a4ff4 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -547,7 +547,8 @@ added:
 
 Create an async byte stream from the given input. Strings are UTF-8 encoded.
 `ArrayBuffer` and `ArrayBufferView` values are wrapped as `Uint8Array`. Arrays
-and iterables in `input` are recursively flattened and normalized.
+and iterables in `input` are recursively flattened and normalized. Flattened
+values may be split across implementation-defined bounded batches.
 
 Objects implementing `Symbol.for('Stream.toAsyncStreamable')` or
 `Symbol.for('Stream.toStreamable')` are converted via those protocols. The
diff --git a/lib/internal/streams/iter/from.js b/lib/internal/streams/iter/from.js
index b33509ba90e6..7fe03511861f 100644
--- a/lib/internal/streams/iter/from.js
+++ b/lib/internal/streams/iter/from.js
@@ -363,9 +363,13 @@ async function* normalizeAsyncSource(source) {
         continue;
       }
       // Slow path: normalize the value
-      const batch = [];
+      let batch = [];
       for await (const chunk of normalizeAsyncValue(value)) {
         ArrayPrototypePush(batch, chunk);
+        if (batch.length === FROM_BATCH_SIZE) {
+          yield batch;
+          batch = [];
+        }
       }
       if (batch.length > 0) {
         yield batch;
diff --git a/test/parallel/test-stream-iter-from-async.js b/test/parallel/test-stream-iter-from-async.js
index cdc6cc23ea2f..a4726d633ef0 100644
--- a/test/parallel/test-stream-iter-from-async.js
+++ b/test/parallel/test-stream-iter-from-async.js
@@ -31,6 +31,30 @@ async function testFromAsyncGenerator() {
   assert.deepStrictEqual(batches[1][0], new Uint8Array([30, 40]));
 }
 
+async function testFromBoundsNestedAsyncIterable() {
+  let nestedClosed = false;
+  async function* nested() {
+    try {
+      let value = 0;
+      while (true) yield new Uint8Array([value++]);
+    } finally {
+      nestedClosed = true;
+    }
+  }
+
+  async function* source() {
+    yield nested();
+  }
+
+  const iterator = from(source())[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+  assert.strictEqual(first.value.length, 128);
+
+  await iterator.return();
+  assert.strictEqual(nestedClosed, true);
+}
+
 async function testFromSyncIterableAsAsync() {
   // Sync iterable passed to from() should work
   function* gen() {
@@ -274,6 +298,7 @@ function testFromUndefinedThrows() {
 Promise.all([
   testFromString(),
   testFromAsyncGenerator(),
+  testFromBoundsNestedAsyncIterable(),
   testFromSyncIterableAsAsync(),
   testFromSyncIterableAwaitsPromiseValues(),
   testFromSyncIterableRejectsNestedAsyncIterable(),

From 5ada0667153f328e75e754543aaf6405cd65af3d Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 02:52:01 +0000
Subject: [PATCH 113/202] stream: ensure that stateful transforms preserve this

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/streams/iter/pull.js             | 24 ++++++++++++-------
 test/parallel/test-stream-iter-pull-async.js  | 14 +++++++++++
 test/parallel/test-stream-iter-pull-sync.js   | 15 ++++++++++++
 .../test-stream-iter-transform-roundtrip.js   | 13 ++++++++++
 4 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index 6e00ab43f414..d1eb2e2c2409 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -505,8 +505,9 @@ function* withFlushSync(source) {
   yield null;
 }
 
-function* applyStatefulSyncTransform(source, transform) {
-  const output = transform(withFlushSync(source));
+function* applyStatefulSyncTransform(source, transform, receiver) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushSync(source));
   for (const item of output) {
     if (item === null) continue;
     const batch = [];
@@ -537,7 +538,8 @@ function* createSyncPipeline(source, transforms) {
         current = applyFusedStatelessSyncTransforms(current, statelessRun);
         statelessRun = [];
       }
-      current = applyStatefulSyncTransform(current, transform.transform);
+      current = applyStatefulSyncTransform(
+        current, transform.transform, transform);
     } else {
       ArrayPrototypePush(statelessRun, transform);
     }
@@ -648,8 +650,10 @@ async function* withFlushAsync(source) {
   yield null;
 }
 
-async function* applyStatefulAsyncTransform(source, transform, options) {
-  const output = transform(withFlushAsync(source), options);
+async function* applyStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushAsync(source), options);
   for await (const item of output) {
     if (item === null) continue;
     // Fast path: item is already a Uint8Array[] batch (e.g. compression transforms)
@@ -681,8 +685,10 @@ async function* applyStatefulAsyncTransform(source, transform, options) {
  * skips isUint8ArrayBatch validation (transform guarantees valid output).
  * @yields {Uint8Array[]}
  */
-async function* applyValidatedStatefulAsyncTransform(source, transform, options) {
-  const output = transform(source, options);
+async function* applyValidatedStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, source, options);
   for await (const batch of output) {
     if (batch.length > 0) {
       yield batch;
@@ -750,10 +756,10 @@ async function* createAsyncPipeline(source, transforms, signal) {
       const opts = { __proto__: null, signal: transformSignal };
       if (transform[kValidatedTransform]) {
         current = applyValidatedStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       } else {
         current = applyStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       }
     } else {
       ArrayPrototypePush(statelessRun, transform);
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 6105d9250cad..c341cf296ddd 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -49,6 +49,19 @@ async function testPullStatefulTransform() {
   assert.strictEqual(data, 'data-ASYNC-END');
 }
 
+async function testPullStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    async function*(source) {
+      assert.strictEqual(this, descriptor);
+      for await (const chunks of source) {
+        yield chunks;
+      }
+    });
+
+  assert.strictEqual(await text(pull(from('receiver'), descriptor)), 'receiver');
+}
+
 async function testPullWithAbortSignal() {
   async function* gen() {
     yield [new Uint8Array([1])];
@@ -511,6 +524,7 @@ async function testTransformOptionsNotShared() {
     testPullIdentity(),
     testPullStatelessTransform(),
     testPullStatefulTransform(),
+    testPullStatefulTransformReceiver(),
     testPullWithAbortSignal(),
     testPullNormalizesSourceAtCallTime(),
     testPullPreAbortOrdering(),
diff --git a/test/parallel/test-stream-iter-pull-sync.js b/test/parallel/test-stream-iter-pull-sync.js
index f14619cc1b42..af481dbfa137 100644
--- a/test/parallel/test-stream-iter-pull-sync.js
+++ b/test/parallel/test-stream-iter-pull-sync.js
@@ -74,6 +74,20 @@ function testPullSyncStatefulTransform() {
   assert.strictEqual(data, 'data-END');
 }
 
+function testPullSyncStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    function*(source) {
+      assert.strictEqual(this, descriptor);
+      yield* source;
+    });
+
+  assert.strictEqual(
+    new TextDecoder().decode(bytesSync(pullSync(fromSync('receiver'), descriptor))),
+    'receiver',
+  );
+}
+
 function testPullSyncChainedTransforms() {
   const addExcl = (chunks) => {
     if (chunks === null) return null;
@@ -210,6 +224,7 @@ Promise.all([
   testPullSyncNormalizesSourceAtCallTime(),
   testPullSyncStatelessTransform(),
   testPullSyncStatefulTransform(),
+  testPullSyncStatefulTransformReceiver(),
   testPullSyncChainedTransforms(),
   testPullSyncSourceError(),
   testPullSyncEmptySource(),
diff --git a/test/parallel/test-stream-iter-transform-roundtrip.js b/test/parallel/test-stream-iter-transform-roundtrip.js
index df63483d6c85..d9a745593c27 100644
--- a/test/parallel/test-stream-iter-transform-roundtrip.js
+++ b/test/parallel/test-stream-iter-transform-roundtrip.js
@@ -42,6 +42,18 @@ async function testGzipRoundTrip() {
   assert.strictEqual(result, input);
 }
 
+async function testValidatedTransformReceiver() {
+  const descriptor = compressGzip();
+  const transform = descriptor.transform;
+  descriptor.transform = common.mustCall(function(source, options) {
+    assert.strictEqual(this, descriptor);
+    return Reflect.apply(transform, this, [source, options]);
+  });
+
+  const result = await bytes(pull(from('receiver'), descriptor));
+  assert.ok(result.byteLength > 0);
+}
+
 async function testGzipLargeData() {
   // 100KB of repeated text - exercises multi-chunk path
   const input = 'gzip large data test. '.repeat(5000);
@@ -250,6 +262,7 @@ async function testGzipWithLevel() {
 (async () => {
   // Gzip
   await testGzipRoundTrip();
+  await testValidatedTransformReceiver();
   await testGzipLargeData();
   await testGzipActuallyCompresses();
 

From 7aba44d4ac456f60970a264c176e23ba3b486b94 Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Sun, 30 Aug 2026 03:49:45 +0000
Subject: [PATCH 114/202] stream: use webidl validation semantics for args

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65658
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/stream_iter.md                        |  19 +-
 lib/internal/fs/promises.js                   |  50 ++---
 lib/internal/quic/quic.js                     |  62 +++---
 lib/internal/streams/iter/broadcast.js        |  64 +++----
 lib/internal/streams/iter/classic.js          |  21 +--
 lib/internal/streams/iter/consumers.js        | 103 +++++-----
 lib/internal/streams/iter/duplex.js           |  19 +-
 lib/internal/streams/iter/pull.js             |  51 ++---
 lib/internal/streams/iter/push.js             |  31 +--
 lib/internal/streams/iter/share.js            |  31 +--
 lib/internal/streams/iter/utils.js            |  42 ++---
 lib/internal/streams/iter/webidl.js           | 177 ++++++++++++++++++
 .../test-fs-promises-file-handle-writer.js    |  22 +++
 test/parallel/test-quic-stream-writer-api.mjs |  24 ++-
 .../test-stream-iter-consumers-text.js        |  12 +-
 test/parallel/test-stream-iter-push-writer.js |   2 +-
 test/parallel/test-stream-iter-validation.js  |  21 +--
 test/parallel/test-stream-iter-webidl.js      | 159 ++++++++++++++++
 .../test-stream-iter-writable-interop.js      |  19 +-
 19 files changed, 651 insertions(+), 278 deletions(-)
 create mode 100644 lib/internal/streams/iter/webidl.js
 create mode 100644 test/parallel/test-stream-iter-webidl.js

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index e146c95a4ff4..b5ed8e06f6e1 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -401,6 +401,12 @@ const { writer, readable } = push({
 A writer is any object conforming to the Writer interface. Only `write()` is
 required; all other methods are optional.
 
+Writer arguments use Web IDL conversion semantics. A non-`Uint8Array` chunk is
+converted to a `USVString` and then UTF-8 encoded. `writev()` and
+`writevSync()` accept any iterable object whose values can be converted to
+chunks. Writer option dictionaries treat `null` as an empty dictionary and
+ignore unknown members.
+
 Each async method has a synchronous `*Sync` counterpart designed for a
 try-fallback pattern: attempt the fast synchronous path first, and fall back
 to the async version only when the synchronous call indicates it could not
@@ -492,7 +498,7 @@ Synchronous write. Does not block; returns `false` if backpressure is active.
 
 #### `writer.writev(chunks[, options])`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * `options` {Object}
   * `signal` {AbortSignal} Cancel just this write operation. The signal cancels
     only the pending `writev()` call; it does not fail the writer itself.
@@ -502,7 +508,7 @@ Write multiple chunks as a single batch.
 
 #### `writer.writevSync(chunks)`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * Returns: {boolean} `true` if the write was accepted, `false` if the
   buffer is full.
 
@@ -521,6 +527,12 @@ import { from, pull, bytes, Stream } from 'node:stream/iter';
 Stream.from('hello');
 ```
 
+Options dictionaries defined by the Iterable Streams API use Web IDL
+conversion semantics. `null` is treated as an empty dictionary, unknown
+members are ignored, and known members are converted to their declared types
+before the operation runs. Conversion failures use Node.js error codes such as
+`ERR_INVALID_ARG_TYPE`, `ERR_INVALID_ARG_VALUE`, and `ERR_OUT_OF_RANGE`.
+
 ```cjs
 // Named exports
 const { from, pull, bytes, Stream } = require('node:stream/iter');
@@ -860,7 +872,7 @@ added:
 
 * `options` {Object}
   * `budget` {number} Buffer size in bytes for both directions.
-    **Default:** `16384`.
+    Must be >= 16384. **Default:** `16384`.
   * `backpressure` {string} Policy for both directions.
     **Default:** `'strict'`.
   * `signal` {AbortSignal} Cancellation signal for both channels.
@@ -1379,6 +1391,7 @@ added:
     **Default:** `65536`.
   * `backpressure` {string} `'strict'`, `'unbounded'`, `'drop-oldest'`, or
     `'drop-newest'`. **Default:** `'strict'`.
+  * `signal` {AbortSignal}
 * Returns: {Share}
 
 Create a pull-model multi-consumer shared stream. Unlike `broadcast()`, the
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index 73c637a36d7c..d5a6b9a2c853 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -161,8 +161,9 @@ const lazyReadableStream = getLazy(() =>
 let newStreamsPull;
 let newStreamsPullSync;
 let newStreamsParsePullArgs;
-let newStreamsToUint8Array;
+let newStreamsToWriterUint8Array;
 let newStreamsConvertChunks;
+let newStreamsGetWriterSignal;
 function lazyNewStreams() {
   if (newStreamsPull === undefined) {
     const pullModule = require('internal/streams/iter/pull');
@@ -170,8 +171,9 @@ function lazyNewStreams() {
     newStreamsPullSync = pullModule.pullSync;
     const utils = require('internal/streams/iter/utils');
     newStreamsParsePullArgs = utils.parsePullArgs;
-    newStreamsToUint8Array = utils.toUint8Array;
+    newStreamsToWriterUint8Array = utils.toWriterUint8Array;
     newStreamsConvertChunks = utils.convertChunks;
+    newStreamsGetWriterSignal = utils.getWriterSignal;
   }
 }
 
@@ -882,6 +884,8 @@ if (getOptionValue('--experimental-stream-iter')) {
     return {
       __proto__: null,
       write(chunk, options = kNullPrototo) {
+        chunk = newStreamsToWriterUint8Array(chunk);
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -889,17 +893,9 @@ if (getOptionValue('--experimental-stream-iter')) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunk = newStreamsToUint8Array(chunk);
         if (bytesRemaining >= 0 && chunk.byteLength > bytesRemaining) {
           return PromiseReject(
             new ERR_OUT_OF_RANGE('write', `<= ${bytesRemaining} bytes`,
@@ -912,6 +908,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writev(chunks, options = kNullPrototo) {
+        chunks = newStreamsConvertChunks(chunks);
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -919,17 +917,9 @@ if (getOptionValue('--experimental-stream-iter')) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal?.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunks = newStreamsConvertChunks(chunks);
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -946,8 +936,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writeSync(chunk) {
+        chunk = newStreamsToWriterUint8Array(chunk);
         if (error || closed || asyncPending) return false;
-        chunk = newStreamsToUint8Array(chunk);
         const length = chunk.byteLength;
         if (length > syncWriteThreshold) return false;
         if (length === 0) return true;
@@ -977,8 +967,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writevSync(chunks) {
-        if (error || closed || asyncPending) return false;
         chunks = newStreamsConvertChunks(chunks);
+        if (error || closed || asyncPending) return false;
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -1013,6 +1003,7 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       end(options = kNullPrototo) {
+        const signal = newStreamsGetWriterSignal(options);
         if (error) {
           return PromiseReject(error);
         }
@@ -1022,15 +1013,8 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (closing) {
           return pendingEndPromise;
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
         closing = true;
         pendingEndPromise = PromisePrototypeThen(
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index d55603daf1f4..8ecd5fc776a3 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -138,8 +138,9 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
-  toUint8Array,
   convertChunks,
+  getWriterSignal,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -164,7 +165,6 @@ const {
 } = require('internal/fs/promises');
 
 const {
-  validateAbortSignal,
   validateBoolean,
   validateFunction,
   validateInteger,
@@ -2197,7 +2197,7 @@ class QuicStream {
     // signals backpressure additional writes are rejected until the buffer has
     // capacity again.
 
-    function writeSync(chunk) {
+    function writeConvertedSync(chunk) {
       // If the stream is closed, errored, or write-ended, we cannot accept
       // more data. Refuse the sync write.
       // If a drain is already pending, another operation is waiting
@@ -2205,7 +2205,6 @@ class QuicStream {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunk = toUint8Array(chunk);
       const len = TypedArrayPrototypeGetByteLength(chunk);
       if (len === 0) return true;
       // Refuse the write only when there is no available capacity at
@@ -2223,13 +2222,18 @@ class QuicStream {
       return true;
     }
 
-    async function write(chunk, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writeSync(chunk) {
+      return writeConvertedSync(toWriterUint8Array(chunk));
+    }
+
+    function write(chunk, options = kEmptyObject) {
+      chunk = toWriterUint8Array(chunk);
+      const signal = getWriterSignal(options);
+      return writeAsync(chunk, signal);
+    }
+
+    async function writeAsync(chunk, signal) {
+      signal?.throwIfAborted();
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
@@ -2242,16 +2246,15 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writeSync(chunk)) {
+      if (!writeConvertedSync(chunk)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
 
-    function writevSync(chunks) {
+    function writevConvertedSync(chunks) {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunks = convertChunks(chunks);
       let len = 0;
       for (const c of chunks) len += TypedArrayPrototypeGetByteLength(c);
       if (len === 0) return true;
@@ -2262,13 +2265,18 @@ class QuicStream {
       return true;
     }
 
-    async function writev(chunks, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writevSync(chunks) {
+      return writevConvertedSync(convertChunks(chunks));
+    }
+
+    function writev(chunks, options = kEmptyObject) {
+      chunks = convertChunks(chunks);
+      const signal = getWriterSignal(options);
+      return writevAsync(chunks, signal);
+    }
+
+    async function writevAsync(chunks, signal) {
+      signal?.throwIfAborted();
 
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
@@ -2283,7 +2291,7 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writevSync(chunks)) {
+      if (!writevConvertedSync(chunks)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
@@ -2308,11 +2316,13 @@ class QuicStream {
       return totalBytesWritten;
     }
 
-    async function end(options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
+    function end(options = kEmptyObject) {
+      const signal = getWriterSignal(options);
+      return endAsync(signal);
+    }
+
+    async function endAsync(signal) {
       if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
         signal.throwIfAborted();
         // TODO(@jasnell): The stream/iter spec allows individual sync end
         // calls to be canceled via an AbortSignal. We currently do not support
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 4131fbf2b8ec..16cb4c06533c 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -33,10 +33,7 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 const {
@@ -65,10 +62,12 @@ const {
   onSignalAbort,
   parsePullArgs,
   wrapError,
-  toUint8Array,
-  validateBackpressure,
+  toWriterUint8Array,
   validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -135,9 +134,13 @@ class BroadcastImpl {
   }
 
   push(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -595,46 +598,30 @@ class BroadcastWriter {
   }
 
   write(chunk, options) {
+    const converted = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = toUint8Array(chunk);
       const batch = createBatchEntry([converted]);
       this.#broadcast[kWrite](batch);
       this.#totalBytes += batch.byteLength;
       return kResolvedPromise;
     }
-    return this.#writevSlow([chunk], signal);
+    return this.#writeBatchSlow(createBatchEntry([converted]), signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const converted = convertChunks(chunks);
     const signal = getWriterSignal(options);
+    const batch = createBatchEntry(converted);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = convertChunks(chunks);
-      const batch = createBatchEntry(converted);
       if (this.#state === 'open' && this.#broadcast[kWrite](batch)) {
         this.#totalBytes += batch.byteLength;
         return kResolvedPromise;
       }
       return this.#writeBatchSlow(batch, signal);
     }
-    return this.#writevSlow(chunks, signal);
-  }
-
-  async #writevSlow(chunks, signal) {
-    if (this.#state === 'errored') {
-      throw this.#error;
-    }
-    if (this.#state !== 'open') {
-      throw new ERR_INVALID_STATE.TypeError('Writer is closed');
-    }
-
-    signal?.throwIfAborted();
-
-    const batch = createBatchEntry(convertChunks(chunks));
-
     return this.#writeBatchSlow(batch, signal);
   }
 
@@ -669,9 +656,8 @@ class BroadcastWriter {
   }
 
   writeSync(chunk) {
+    const converted = toWriterUint8Array(chunk);
     if (this.#state !== 'open') return false;
-    const converted =
-      toUint8Array(chunk);
     const batch = createBatchEntry([converted]);
     if (this.#broadcast[kWrite](batch)) {
       this.#totalBytes += batch.byteLength;
@@ -681,9 +667,8 @@ class BroadcastWriter {
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
-    if (this.#state !== 'open') return false;
     const converted = convertChunks(chunks);
+    if (this.#state !== 'open') return false;
     const batch = createBatchEntry(converted);
     if (this.#broadcast[kWrite](batch)) {
       this.#totalBytes += batch.byteLength;
@@ -863,17 +848,16 @@ function onBroadcastCancel(broadcastImpl, signal) {
  * @returns {{ writer: Writer, broadcast: Broadcast }}
  */
 function broadcast(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.BroadcastOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -916,8 +900,12 @@ const Broadcast = {
         'input', ['Broadcastable', 'AsyncIterable', 'Iterable'], input);
     }
 
+    options = converters.BroadcastOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const result = broadcast(options);
-    const signal = options?.signal;
+    const { signal } = options;
 
     const pump = async () => {
       const w = result.writer;
diff --git a/lib/internal/streams/iter/classic.js b/lib/internal/streams/iter/classic.js
index 0769348a3981..28f6079e6fe2 100644
--- a/lib/internal/streams/iter/classic.js
+++ b/lib/internal/streams/iter/classic.js
@@ -40,7 +40,6 @@ const {
 } = require('internal/errors');
 
 const {
-  validateArray,
   validateInteger,
   validateObject,
 } = require('internal/validators');
@@ -60,9 +59,10 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
+  convertChunks,
   getWriterSignal,
   validateBackpressure,
-  toUint8Array,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const { Buffer } = require('buffer');
@@ -538,7 +538,7 @@ function fromWritable(writable, options = kNullPrototype) {
   function writeChunks(chunks) {
     let ok = true;
     for (let i = 0; i < chunks.length; i++) {
-      const bytes = toUint8Array(chunks[i]);
+      const bytes = chunks[i];
       totalBytes += TypedArrayPrototypeGetByteLength(bytes);
       ok = writable.write(bytes);
     }
@@ -554,10 +554,12 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writeSync(chunk) {
+      toWriterUint8Array(chunk);
       return false;
     },
 
     writevSync(chunks) {
+      convertChunks(chunks);
       return false;
     },
 
@@ -576,18 +578,12 @@ function fromWritable(writable, options = kNullPrototype) {
     // otherwise ignored. Classic stream.Writable has no per-write abort signal
     // support; cancellation should be handled at the pipeline level instead.
     write(chunk, options) {
+      const bytes = toWriterUint8Array(chunk);
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
 
-      let bytes;
-      try {
-        bytes = toUint8Array(chunk);
-      } catch (err) {
-        return PromiseReject(err);
-      }
-
       if (backpressure === 'strict' && isFull()) {
         return PromiseReject(new ERR_INVALID_STATE.RangeError(
           'Backpressure violation: buffer is full. ' +
@@ -619,7 +615,7 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writev(chunks, options) {
-      validateArray(chunks, 'chunks');
+      chunks = convertChunks(chunks);
       getWriterSignal(options);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
@@ -634,8 +630,7 @@ function fromWritable(writable, options = kNullPrototype) {
       if (backpressure === 'drop-newest' && isFull()) {
         // Discard entire batch.
         for (let i = 0; i < chunks.length; i++) {
-          totalBytes +=
-            TypedArrayPrototypeGetByteLength(toUint8Array(chunks[i]));
+          totalBytes += TypedArrayPrototypeGetByteLength(chunks[i]);
         }
         return PromiseResolve();
       }
diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index 95ab63a054b3..75ad4026ad7c 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -36,11 +36,7 @@ const {
 } = require('internal/errors');
 const { TextDecoder } = require('internal/encoding');
 const {
-  validateAbortSignal,
   validateFunction,
-  validateInteger,
-  validateObject,
-  validateString,
 } = require('internal/validators');
 
 const {
@@ -66,6 +62,9 @@ const {
   toAsyncStreamable,
   toStreamable,
 } = require('internal/streams/iter/types');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   isAnyArrayBuffer,
@@ -197,37 +196,6 @@ function toArrayBuffer(data) {
                                    byteOffset + byteLength);
 }
 
-// =============================================================================
-// Shared option validation
-// =============================================================================
-
-function validateBaseConsumerOptions(options) {
-  validateObject(options, 'options');
-  if (options.limit !== undefined) {
-    validateInteger(options.limit, 'options.limit', 0);
-  }
-  if (options.encoding !== undefined) {
-    validateString(options.encoding, 'options.encoding');
-    try {
-      new TextDecoder(options.encoding);
-    } catch {
-      throw new ERR_INVALID_ARG_VALUE.RangeError(
-        'options.encoding', options.encoding);
-    }
-  }
-}
-
-function validateConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-  if (options.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
-}
-
-function validateSyncConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-}
-
 // =============================================================================
 // Sync Consumers
 // =============================================================================
@@ -241,7 +209,10 @@ const kNullPrototype = { __proto__: null };
  * @returns {Uint8Array}
  */
 function bytesSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return concatBytes(collectSync(source, options.limit));
 }
 
@@ -252,9 +223,18 @@ function bytesSync(source, options = kNullPrototype) {
  * @returns {string}
  */
 function textSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.TextConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const data = concatBytes(collectSync(source, options.limit));
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -268,7 +248,10 @@ function textSync(source, options = kNullPrototype) {
  * @returns {ArrayBuffer}
  */
 function arrayBufferSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return toArrayBuffer(concatBytes(collectSync(source, options.limit)));
 }
 
@@ -279,7 +262,10 @@ function arrayBufferSync(source, options = kNullPrototype) {
  * @returns {Uint8Array[]}
  */
 function arraySync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectSync(source, options.limit);
 }
 
@@ -294,7 +280,10 @@ function arraySync(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array>}
  */
 async function bytes(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return concatBytes(chunks);
 }
@@ -306,10 +295,19 @@ async function bytes(source, options = kNullPrototype) {
  * @returns {Promise<string>}
  */
 async function text(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.TextConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const chunks = await collectAsync(source, options.signal, options.limit);
   const data = concatBytes(chunks);
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -323,7 +321,10 @@ async function text(source, options = kNullPrototype) {
  * @returns {Promise<ArrayBuffer>}
  */
 async function arrayBuffer(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return toArrayBuffer(concatBytes(chunks));
 }
@@ -335,7 +336,10 @@ async function arrayBuffer(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array[]>}
  */
 async function array(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectAsync(source, options.signal, options.limit);
 }
 
@@ -419,9 +423,10 @@ function merge(...args) {
     sources = args;
   }
 
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  options = converters.MergeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
 
   // Normalize each source via from()
   const normalized = ArrayPrototypeMap(sources, (source) => from(source));
@@ -429,7 +434,7 @@ function merge(...args) {
   return {
     __proto__: null,
     async *[SymbolAsyncIterator]() {
-      const signal = options?.signal;
+      const { signal } = options;
 
       signal?.throwIfAborted();
 
diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index a60c510c4199..674ef81a53c9 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -16,9 +16,8 @@ const {
   push,
 } = require('internal/streams/iter/push');
 const {
-  validateAbortSignal,
-  validateObject,
-} = require('internal/validators');
+  converters,
+} = require('internal/streams/iter/webidl');
 
 /**
  * Create a pair of connected duplex channels for bidirectional communication.
@@ -27,17 +26,11 @@ const {
  * @returns {[DuplexChannel, DuplexChannel]}
  */
 function duplex(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.DuplexOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const { budget, backpressure, signal, a, b } = options;
-  if (a !== undefined) {
-    validateObject(a, 'options.a');
-  }
-  if (b !== undefined) {
-    validateObject(b, 'options.b');
-  }
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   // Channel A writes to B's readable (A->B direction).
   // Signal is NOT passed to push() -- we handle abort via close() below.
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index d1eb2e2c2409..6b44f5c5e431 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -27,7 +27,6 @@ const {
   },
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
-const { validateAbortSignal } = require('internal/validators');
 const {
   isAnyArrayBuffer,
   isPromise,
@@ -49,7 +48,6 @@ const {
 
 const {
   createBatchEntry,
-  isPullOptions,
   isTransform,
   isTransformObject,
   parsePullArgs,
@@ -59,6 +57,9 @@ const {
   wrapError,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   kValidatedTransform,
@@ -80,7 +81,7 @@ function hasMethod(value, name) {
  * Parse pipeTo/pipeToSync arguments: [...transforms, writer, options?]
  * @param {Array} args
  * @param {string} requiredMethod - 'write' for pipeTo, 'writeSync' for pipeToSync
- * @returns {{ transforms: Array, writer: object, options: object }}
+ * @returns {{ transforms: Array, writer: object, options: unknown }}
  */
 function parsePipeToArgs(args, requiredMethod) {
   if (args.length === 0) {
@@ -92,7 +93,7 @@ function parsePipeToArgs(args, requiredMethod) {
 
   // Check if last arg is options
   const last = args[args.length - 1];
-  if (isPullOptions(last) && !hasMethod(last, requiredMethod)) {
+  if (!isTransform(last) && !hasMethod(last, requiredMethod)) {
     options = last;
     writerIndex = args.length - 2;
   }
@@ -835,11 +836,13 @@ function pullSync(source, ...transforms) {
  * @returns {AsyncIterable<Uint8Array[]>}
  */
 function pull(source, ...args) {
-  const { transforms, options } = parsePullArgs(args);
-  const signal = options?.signal;
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
+  const parsed = parsePullArgs(args);
+  const { transforms } = parsed;
+  const options = converters.PullOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
   const normalized = from(source);
   signal?.throwIfAborted();
 
@@ -969,11 +972,16 @@ function pullWithConsumerCleanup(source, transforms, signal) {
  * @returns {number} Total bytes written
  */
 function pipeToSync(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'writeSync');
+  const parsed = parsePipeToArgs(args, 'writeSync');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToSyncOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
   const hasWritevSync = typeof writer.writevSync === 'function';
   const endSync = writer.endSync;
 
-  if (!options?.preventClose && typeof endSync !== 'function') {
+  if (!options.preventClose && typeof endSync !== 'function') {
     throw new ERR_INVALID_ARG_TYPE(
       'writer.endSync', 'Function', endSync);
   }
@@ -1012,14 +1020,14 @@ function pipeToSync(source, ...args) {
       }
     }
 
-    if (!options?.preventClose) {
+    if (!options.preventClose) {
       if (FunctionPrototypeCall(endSync, writer) < 0) {
         throw new ERR_INVALID_STATE(
           'Writer could not be closed synchronously');
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
+    if (!options.preventFail) {
       writer.fail?.(wrapError(error));
     }
     throw error;
@@ -1035,15 +1043,16 @@ function pipeToSync(source, ...args) {
  * @returns {Promise<number>} Total bytes written
  */
 async function pipeTo(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'write');
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
-
-  const signal = options?.signal;
+  const parsed = parsePipeToArgs(args, 'write');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
 
   function failWriter(error) {
-    if (!options?.preventFail) {
+    if (!options.preventFail) {
       writer.fail?.(wrapError(error));
     }
   }
@@ -1158,7 +1167,7 @@ async function pipeTo(source, ...args) {
       }
     }
 
-    if (!options?.preventClose) {
+    if (!options.preventClose) {
       if (!hasEndSync || writer.endSync() < 0) {
         await writer.end?.(signal ? { __proto__: null, signal } : undefined);
       }
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 8d680cd2ad01..0536d8212c2a 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -25,8 +25,6 @@ const {
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
 } = require('internal/validators');
 
@@ -39,13 +37,15 @@ const {
   kResolvedPromise,
   createBatchEntry,
   onSignalAbort,
-  toUint8Array,
+  toWriterUint8Array,
   convertChunks,
   getWriterSignal,
   parsePullArgs,
-  validateBackpressure,
   validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   pullWithConsumerCleanup,
@@ -124,16 +124,16 @@ class PushQueue {
   #bufferedBytes = 0;
 
   constructor(options = { __proto__: null }) {
+    options = converters.PushStreamOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const {
       budget = kPushDefaultBudget,
       backpressure = 'strict',
       signal,
     } = options;
     validateInteger(budget, 'options.budget', 16384);
-    validateBackpressure(backpressure);
-    if (signal !== undefined) {
-      validateAbortSignal(signal, 'options.signal');
-    }
     this.#budget = budget;
     this.#backpressure = backpressure;
     this.#signal = signal;
@@ -166,6 +166,10 @@ class PushQueue {
     return true;
   }
 
+  get signal() {
+    return this.#signal;
+  }
+
   /**
    * Check if a sync write would be accepted.
    * @returns {boolean}
@@ -651,20 +655,18 @@ class PushWriter {
   }
 
   write(chunk, options) {
+    const bytes = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     if (!signal && this.#queue.canWriteSync()) {
-      const bytes = toUint8Array(chunk);
       this.#queue.writeSync([bytes]);
       return kResolvedPromise;
     }
-    const bytes = toUint8Array(chunk);
     return this.#queue.writeAsync([bytes], signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
-    const signal = getWriterSignal(options);
     const bytes = convertChunks(chunks);
+    const signal = getWriterSignal(options);
     if (!signal && this.#queue.writeSync(bytes)) {
       return kResolvedPromise;
     }
@@ -672,12 +674,11 @@ class PushWriter {
   }
 
   writeSync(chunk) {
-    const bytes = toUint8Array(chunk);
+    const bytes = toWriterUint8Array(chunk);
     return this.#queue.writeSync([bytes]);
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
     const bytes = convertChunks(chunks);
     return this.#queue.writeSync(bytes);
   }
@@ -780,7 +781,7 @@ function push(...args) {
   let readable;
   if (transforms.length > 0) {
     readable = pullWithConsumerCleanup(
-      rawReadable, transforms, options.signal);
+      rawReadable, transforms, queue.signal);
   } else {
     readable = rawReadable;
   }
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 00d9d387ce82..70179dffd3c1 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -43,9 +43,11 @@ const {
   onSignalAbort,
   wrapError,
   parsePullArgs,
-  validateBackpressure,
   validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -59,9 +61,7 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 // =============================================================================
@@ -104,9 +104,13 @@ class ShareImpl {
   }
 
   pull(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -746,17 +750,16 @@ function onShareCancel(shareImpl, signal) {
 function share(source, options = { __proto__: null }) {
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = from(source);
-  validateObject(options, 'options');
+  options = converters.ShareOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -777,13 +780,15 @@ function share(source, options = { __proto__: null }) {
 function shareSync(source, options = { __proto__: null }) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  validateObject(options, 'options');
+  options = converters.ShareSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
 
   const opts = {
     __proto__: null,
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 66e831a58523..08337a5536f2 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -35,9 +35,11 @@ const { isError } = require('internal/util');
 const { isSharedArrayBuffer, isUint8Array } = require('internal/util/types');
 
 const {
-  validateAbortSignal,
   validateOneOf,
 } = require('internal/validators');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 // Cached resolved promise to avoid allocating a new one on every sync fast-path.
 const kResolvedPromise = PromiseResolve();
@@ -304,6 +306,10 @@ function concatBytes(chunks) {
  * @returns {Uint8Array[]}
  */
 function convertChunks(chunks) {
+  chunks = converters.WriterChunkSequence(chunks, {
+    __proto__: null,
+    context: 'chunks',
+  });
   const len = chunks.length;
   const result = new Array(len);
   for (let i = 0; i < len; i++) {
@@ -318,9 +324,17 @@ function convertChunks(chunks) {
  * @returns {AbortSignal|undefined}
  */
 function getWriterSignal(options) {
-  const signal = options?.signal;
-  validateAbortSignal(signal, 'options.signal');
-  return signal;
+  return converters.WriteOptions(options, {
+    __proto__: null,
+    context: 'options',
+  }).signal;
+}
+
+function toWriterUint8Array(chunk) {
+  return toUint8Array(converters.WriterChunk(chunk, {
+    __proto__: null,
+    context: 'chunk',
+  }));
 }
 
 /**
@@ -348,20 +362,6 @@ function hasProtocol(value, symbol) {
   );
 }
 
-/**
- * Check if a value is PullOptions (object without transform or write property).
- * @param {unknown} value
- * @returns {boolean}
- */
-function isPullOptions(value) {
-  return (
-    value !== null &&
-    typeof value === 'object' &&
-    !('transform' in value) &&
-    !('write' in value)
-  );
-}
-
 /**
  * Check if a value is a stateful transform object (has a transform method).
  * @param {unknown} value
@@ -384,7 +384,7 @@ function isTransform(value) {
  * Parse variadic arguments for pull/pullSync.
  * Returns { transforms, options }
  * @param {Array} args
- * @returns {{ transforms: Array, options: object|undefined }}
+ * @returns {{ transforms: Array, options: unknown }}
  */
 function parsePullArgs(args) {
   if (args.length === 0) {
@@ -394,7 +394,7 @@ function parsePullArgs(args) {
   let transforms;
   let options;
   const last = args[args.length - 1];
-  if (isPullOptions(last)) {
+  if (!isTransform(last)) {
     transforms = ArrayPrototypeSlice(args, 0, -1);
     options = last;
   } else {
@@ -436,12 +436,12 @@ module.exports = {
   getWriterSignal,
   getMinCursor,
   hasProtocol,
-  isPullOptions,
   isTransform,
   isTransformObject,
   onSignalAbort,
   parsePullArgs,
   toUint8Array,
+  toWriterUint8Array,
   validateBackpressure,
   validateBatchEntry,
   validateByteView,
diff --git a/lib/internal/streams/iter/webidl.js b/lib/internal/streams/iter/webidl.js
new file mode 100644
index 000000000000..b971fa95071b
--- /dev/null
+++ b/lib/internal/streams/iter/webidl.js
@@ -0,0 +1,177 @@
+'use strict';
+
+const {
+  converters: baseConverters,
+  convertToInt,
+  createDictionaryConverter,
+  createEnumConverter,
+  createInterfaceConverter,
+  createSequenceConverter,
+} = require('internal/webidl');
+const { AbortSignal } = require('internal/abort_controller');
+const { isUint8Array } = require('internal/util/types');
+
+const converters = { __proto__: null };
+
+function unsignedLongLong(value, options) {
+  return convertToInt(value, 64, 'unsigned', options);
+}
+
+function enforceRangeUnsignedLongLong(value, options = { __proto__: null }) {
+  return convertToInt(value, 64, 'unsigned', {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    enforceRange: true,
+  });
+}
+
+function allowStreamBufferOptions(options) {
+  return {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    allowShared: true,
+    allowResizable: true,
+  };
+}
+
+converters.AbortSignal = createInterfaceConverter(
+  'AbortSignal', AbortSignal.prototype);
+converters.BackpressurePolicy = createEnumConverter('BackpressurePolicy', [
+  'strict',
+  'unbounded',
+  'drop-oldest',
+  'drop-newest',
+]);
+converters.unsignedLongLong = unsignedLongLong;
+converters.enforceRangeUnsignedLongLong = enforceRangeUnsignedLongLong;
+converters.WriterChunk = (value, options = { __proto__: null }) => {
+  if (isUint8Array(value)) {
+    return baseConverters.Uint8Array(
+      value, allowStreamBufferOptions(options));
+  }
+  return baseConverters.USVString(value, options);
+};
+converters.WriterChunkSequence = createSequenceConverter(
+  converters.WriterChunk);
+
+const signalMember = {
+  __proto__: null,
+  key: 'signal',
+  converter: converters.AbortSignal,
+};
+const budgetMember = {
+  __proto__: null,
+  key: 'budget',
+  converter: converters.unsignedLongLong,
+};
+const backpressureMember = {
+  __proto__: null,
+  key: 'backpressure',
+  converter: converters.BackpressurePolicy,
+  defaultValue: () => 'strict',
+};
+const limitMember = {
+  __proto__: null,
+  key: 'limit',
+  converter: converters.enforceRangeUnsignedLongLong,
+};
+
+converters.WriteOptions = createDictionaryConverter('WriteOptions', [
+  signalMember,
+]);
+converters.PushStreamOptions = createDictionaryConverter(
+  'PushStreamOptions', [budgetMember, backpressureMember, signalMember]);
+converters.PullOptions = createDictionaryConverter('PullOptions', [
+  signalMember,
+]);
+converters.PipeToOptions = createDictionaryConverter('PipeToOptions', [
+  {
+    __proto__: null,
+    key: 'preventClose',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  {
+    __proto__: null,
+    key: 'preventFail',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  signalMember,
+]);
+converters.PipeToSyncOptions = createDictionaryConverter(
+  'PipeToSyncOptions', [
+    {
+      __proto__: null,
+      key: 'preventClose',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+    {
+      __proto__: null,
+      key: 'preventFail',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+  ]);
+converters.ConsumeOptions = createDictionaryConverter('ConsumeOptions', [
+  limitMember,
+  signalMember,
+]);
+converters.ConsumeSyncOptions = createDictionaryConverter(
+  'ConsumeSyncOptions', [limitMember]);
+const encodingMember = {
+  __proto__: null,
+  key: 'encoding',
+  converter: baseConverters.DOMString,
+  defaultValue: () => 'utf-8',
+};
+converters.TextConsumeOptions = createDictionaryConverter(
+  'TextConsumeOptions', [
+    [limitMember, signalMember],
+    [encodingMember],
+  ]);
+converters.TextConsumeSyncOptions = createDictionaryConverter(
+  'TextConsumeSyncOptions', [
+    [limitMember],
+    [encodingMember],
+  ]);
+converters.MergeOptions = createDictionaryConverter('MergeOptions', [
+  signalMember,
+]);
+converters.BroadcastOptions = createDictionaryConverter(
+  'BroadcastOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareOptions = createDictionaryConverter(
+  'ShareOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareSyncOptions = createDictionaryConverter(
+  'ShareSyncOptions', [budgetMember, backpressureMember]);
+converters.DuplexDirectionOptions = createDictionaryConverter(
+  'DuplexDirectionOptions', [
+    budgetMember,
+    {
+      __proto__: null,
+      key: 'backpressure',
+      converter: converters.BackpressurePolicy,
+    },
+  ]);
+converters.DuplexOptions = createDictionaryConverter('DuplexOptions', [
+  {
+    __proto__: null,
+    key: 'a',
+    converter: converters.DuplexDirectionOptions,
+  },
+  {
+    __proto__: null,
+    key: 'b',
+    converter: converters.DuplexDirectionOptions,
+  },
+  budgetMember,
+  backpressureMember,
+  signalMember,
+]);
+
+module.exports = { converters };
diff --git a/test/parallel/test-fs-promises-file-handle-writer.js b/test/parallel/test-fs-promises-file-handle-writer.js
index ff90716400ef..d43bababad1e 100644
--- a/test/parallel/test-fs-promises-file-handle-writer.js
+++ b/test/parallel/test-fs-promises-file-handle-writer.js
@@ -1060,6 +1060,27 @@ async function testWriterArgumentValidation() {
   }
 }
 
+async function testWriterWebIDLConversion() {
+  const filePath = path.join(tmpDir, 'writer-webidl.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(await w.end(null), 12);
+  await fh.close();
+
+  assert.strictEqual(fs.readFileSync(filePath, 'utf8'), '42trueobject');
+}
+
 // =============================================================================
 // Run all tests
 // =============================================================================
@@ -1114,4 +1135,5 @@ Promise.all([
   testWriterLimitWritevSync(),
   testWriterLimitAndStart(),
   testWriterArgumentValidation(),
+  testWriterWebIDLConversion(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-quic-stream-writer-api.mjs b/test/parallel/test-quic-stream-writer-api.mjs
index 009cb4ff8a4a..4f19502d8579 100644
--- a/test/parallel/test-quic-stream-writer-api.mjs
+++ b/test/parallel/test-quic-stream-writer-api.mjs
@@ -16,7 +16,7 @@ const { bytes } = await import('stream/iter');
 
 const encoder = new TextEncoder();
 
-const totalStreams = 5;
+const totalStreams = 6;
 const serverResults = [];
 const allDone = Promise.withResolvers();
 
@@ -88,6 +88,25 @@ await clientSession.opened;
   await stream.closed;
 }
 
+// Web IDL Writer argument conversion
+{
+  const stream = await clientSession.createBidirectionalStream();
+  const w = stream.writer;
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(w.endSync(), 12);
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await stream.closed;
+}
+
 {
   const stream = await clientSession.createBidirectionalStream();
   const w = stream.writer;
@@ -139,4 +158,5 @@ assert.strictEqual(decoder.decode(serverResults[0]), 'async write');
 assert.strictEqual(decoder.decode(serverResults[1]), 'hello writev');
 assert.strictEqual(decoder.decode(serverResults[2]), 'async writev');
 assert.strictEqual(decoder.decode(serverResults[3]), 'end async');
-assert.strictEqual(decoder.decode(serverResults[4]), 'capacity');
+assert.strictEqual(decoder.decode(serverResults[4]), '42trueobject');
+assert.strictEqual(decoder.decode(serverResults[5]), 'capacity');
diff --git a/test/parallel/test-stream-iter-consumers-text.js b/test/parallel/test-stream-iter-consumers-text.js
index a8fb7a74367f..68be098ff8f6 100644
--- a/test/parallel/test-stream-iter-consumers-text.js
+++ b/test/parallel/test-stream-iter-consumers-text.js
@@ -143,17 +143,17 @@ function testTextSyncUnsupportedEncodingThrowsRangeError() {
   );
 }
 
-async function testTextNonStringEncodingThrowsTypeError() {
+async function testTextConvertedEncodingThrowsRangeError() {
   await assert.rejects(
     () => text(from('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
-function testTextSyncNonStringEncodingThrowsTypeError() {
+function testTextSyncConvertedEncodingThrowsRangeError() {
   assert.throws(
     () => textSync(fromSync('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
@@ -173,6 +173,6 @@ Promise.all([
   testTextSyncBOMStripped(),
   testTextUnsupportedEncodingThrowsRangeError(),
   testTextSyncUnsupportedEncodingThrowsRangeError(),
-  testTextNonStringEncodingThrowsTypeError(),
-  testTextSyncNonStringEncodingThrowsTypeError(),
+  testTextConvertedEncodingThrowsRangeError(),
+  testTextSyncConvertedEncodingThrowsRangeError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 98f084ab01a6..854bd69f0ac6 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -216,7 +216,7 @@ async function testWritevSyncInvalidChunkDoesNotQueue() {
   const { writer, readable } = push({ budget: 16384 });
 
   assert.throws(
-    () => writer.writevSync([1]),
+    () => writer.writevSync([Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
 
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index b93e6575490f..871c891a6539 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -22,7 +22,7 @@ const {
 // =============================================================================
 
 // Budget must be integer >= 16384
-assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => push({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 // Values < 16384 are rejected
 assert.throws(() => push({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
@@ -68,12 +68,11 @@ assert.throws(() => push('bad', {}), { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
-// Writer.write rejects non-string/non-Uint8Array
+// Writer chunks use the Web IDL (Uint8Array or USVString) conversion.
 {
   const { writer } = push();
-  assert.throws(() => writer.writeSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync({}), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync(true), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writeSync(Symbol()),
+                { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
@@ -87,7 +86,7 @@ assert.throws(() => duplex({ a: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => duplex({ b: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
 
 // Budget validation (cascades through to push())
-assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -129,7 +128,7 @@ assert.throws(() => pullSync(fromSync('a'), 42), { code: 'ERR_INVALID_ARG_TYPE'
 // broadcast() validation
 // =============================================================================
 
-assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -214,7 +213,7 @@ assert.throws(() => Broadcast.from(42), { code: 'ERR_INVALID_ARG_TYPE' });
 // =============================================================================
 
 assert.throws(() => share(42), { code: 'ERR_INVALID_ARG_TYPE' });
-assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -239,7 +238,7 @@ share(from('a'), { budget: Number.MAX_SAFE_INTEGER }).cancel();
 
 assert.throws(() => shareSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 'bad' }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 1.5 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
@@ -274,7 +273,7 @@ assert.throws(() => bytesSync(fromSync('a'), { limit: 'bad' }),
 assert.throws(() => bytesSync(fromSync('a'), { limit: -1 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 42 }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 'bogus' }),
               { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => arrayBufferSync(fromSync('a'), { limit: 'bad' }),
@@ -318,7 +317,7 @@ async function testAsyncValidation() {
   await assert.rejects(
     () => bytes(from('a'), { limit: -1 }), { code: 'ERR_OUT_OF_RANGE' });
   await assert.rejects(
-    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
+    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_VALUE' });
   await assert.rejects(
     () => text(from('a'), { encoding: 'not-a-real-encoding' }),
     { code: 'ERR_INVALID_ARG_VALUE' });
diff --git a/test/parallel/test-stream-iter-webidl.js b/test/parallel/test-stream-iter-webidl.js
new file mode 100644
index 000000000000..904bf77a647f
--- /dev/null
+++ b/test/parallel/test-stream-iter-webidl.js
@@ -0,0 +1,159 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Writable } = require('stream');
+const {
+  Broadcast,
+  broadcast,
+  bytesSync,
+  from,
+  fromWritable,
+  fromSync,
+  pipeTo,
+  pull,
+  push,
+  share,
+  shareSync,
+  text,
+  textSync,
+} = require('stream/iter');
+
+function testDictionaryAndIntegerConversion() {
+  const pushed = push(null);
+  assert.strictEqual(pushed.writer.endSync(), 0);
+  const transformedWithNull = push((chunks) => chunks, null);
+  transformedWithNull.writer.endSync();
+
+  const broadcasted = broadcast(null);
+  assert.strictEqual(broadcasted.writer.endSync(), 0);
+
+  share(from(''), null).cancel();
+  shareSync(fromSync(''), null).cancel();
+
+  assert.deepStrictEqual(bytesSync(fromSync('data'), null),
+                         new TextEncoder().encode('data'));
+  assert.deepStrictEqual(
+    bytesSync(fromSync('data'), { limit: '4.9' }),
+    new TextEncoder().encode('data'),
+  );
+  assert.throws(
+    () => bytesSync(fromSync('data'), { limit: -1 }),
+    { name: 'TypeError', code: 'ERR_OUT_OF_RANGE' },
+  );
+
+  const converted = push({
+    budget: '16384.9',
+    backpressure: { toString: () => 'strict' },
+  });
+  assert.strictEqual(converted.writer.canWrite, true);
+  converted.writer.endSync();
+
+  let signalReads = 0;
+  const transformed = push((chunks) => chunks, {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  transformed.writer.endSync();
+}
+
+async function testUnknownDictionaryMembers() {
+  const source = pull(from('pull'), {
+    transform: 1,
+    write: 1,
+    unknown: true,
+  });
+  assert.strictEqual(await text(source), 'pull');
+
+  let ended = false;
+  const writer = {
+    write() {},
+    end() { ended = true; },
+  };
+  await pipeTo(from('pipe'), writer, {
+    transform: 1,
+    write: 1,
+  });
+  assert.strictEqual(ended, true);
+
+  const options = {
+    get encoding() {
+      throw new Error('unknown member was read');
+    },
+  };
+  assert.deepStrictEqual(bytesSync(fromSync('bytes'), options),
+                         new TextEncoder().encode('bytes'));
+  assert.strictEqual(textSync(fromSync('text'), {
+    encoding: { toString: () => 'utf-8' },
+  }), 'text');
+}
+
+async function testWriterConversion() {
+  const { writer, readable } = push();
+
+  await writer.write(42, null);
+  assert.strictEqual(writer.writevSync(new Set([
+    null,
+    true,
+    { toString: () => 'object' },
+  ])), true);
+
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.writev('not a sequence object'),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+
+  writer.endSync();
+  assert.strictEqual(await text(readable), '42nulltrueobject');
+}
+
+async function testOtherWriterConversions() {
+  const output = [];
+  const writable = new Writable({
+    write(chunk, encoding, callback) {
+      output.push(chunk.toString());
+      callback();
+    },
+  });
+  const classicWriter = fromWritable(writable);
+  await classicWriter.write(42, null);
+  await classicWriter.writev(new Set([false, '!']));
+  await classicWriter.end(null);
+  assert.strictEqual(output.join(''), '42false!');
+
+  const result = broadcast();
+  const source = result.broadcast.push();
+  await result.writer.write(42, null);
+  await result.writer.writev(new Set([true]));
+  result.writer.endSync();
+  assert.strictEqual(await text(source), '42true');
+
+  let signalReads = 0;
+  const fromResult = Broadcast.from(from(''), {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  fromResult.broadcast.cancel();
+}
+
+Promise.all([
+  testDictionaryAndIntegerConversion(),
+  testUnknownDictionaryMembers(),
+  testWriterConversion(),
+  testOtherWriterConversions(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-writable-interop.js b/test/parallel/test-stream-iter-writable-interop.js
index 110e8e0a7d2e..a8ae0a99cad7 100644
--- a/test/parallel/test-stream-iter-writable-interop.js
+++ b/test/parallel/test-stream-iter-writable-interop.js
@@ -511,25 +511,18 @@ async function testAsyncDispose() {
 }
 
 // =============================================================================
-// write() validates chunk type
+// write() rejects values that cannot be converted to USVString
 // =============================================================================
 
-async function testWriteInvalidChunkType() {
+function testWriteInvalidChunkType() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
   const writer = fromWritable(writable);
 
-  await assert.rejects(
-    writer.write(42),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write(null),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write({}),
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
+  writable.destroy();
 }
 
 // =============================================================================
@@ -559,7 +552,7 @@ function testWritevInvalidChunkUncorks() {
   const writer = fromWritable(writable);
 
   assert.throws(
-    () => writer.writev([new Uint8Array([1]), 42]),
+    () => writer.writev([new Uint8Array([1]), Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
   assert.strictEqual(writable.writableCorked, 0);

From 5552a068ca6a0e535968b8faa86cae49a417492a Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Sun, 6 Sep 2026 03:34:38 -0300
Subject: [PATCH 115/202] test: handle EPIPE in closed channel test

The second handle is only sent once the first one is acknowledged, by
which time the worker may already have exited, so the write can fail
with EPIPE. Observed on AIX in the CI reliability report of 2026-09-04.

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65770
Refs: https://github.com/nodejs/reliability/issues/1650
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 test/parallel/test-child-process-fork-closed-channel-segfault.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/parallel/test-child-process-fork-closed-channel-segfault.js b/test/parallel/test-child-process-fork-closed-channel-segfault.js
index 73bd118ddce3..779e02205e29 100644
--- a/test/parallel/test-child-process-fork-closed-channel-segfault.js
+++ b/test/parallel/test-child-process-fork-closed-channel-segfault.js
@@ -76,6 +76,7 @@ const server = net
           // Ignore errors when sending the second handle because the worker
           // may already have exited.
           if (err && err.code !== 'ERR_IPC_CHANNEL_CLOSED' &&
+                     err.code !== 'EPIPE' &&
                      err.code !== 'ECONNRESET' &&
                      err.code !== 'ECONNREFUSED' &&
                      err.code !== 'EMFILE') {

From 29bc0c12834f590b8ff29bf1706bd43f3a229e48 Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Sun, 6 Sep 2026 16:26:05 +0900
Subject: [PATCH 116/202] typings: add profiler internal binding types

Add a ProfilerBinding declaration for
internalBinding('profiler') and wire it into InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65660
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 typings/globals.d.ts                  | 2 ++
 typings/internalBinding/profiler.d.ts | 8 ++++++++
 2 files changed, 10 insertions(+)
 create mode 100644 typings/internalBinding/profiler.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index e112e3ecd2bd..2e4617c6d692 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -28,6 +28,7 @@ import { PerformanceBinding } from './internalBinding/performance';
 import { PermissionBinding } from './internalBinding/permission';
 import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
+import { ProfilerBinding } from './internalBinding/profiler';
 import { SeaBinding } from './internalBinding/sea';
 import { SerdesBinding } from './internalBinding/serdes';
 import { SignalWrapBinding } from './internalBinding/signal_wrap';
@@ -75,6 +76,7 @@ interface InternalBindingMap {
   permission: PermissionBinding;
   process: ProcessBinding;
   process_wrap: ProcessWrapBinding;
+  profiler: ProfilerBinding;
   sea: SeaBinding;
   serdes: SerdesBinding;
   signal_wrap: SignalWrapBinding;
diff --git a/typings/internalBinding/profiler.d.ts b/typings/internalBinding/profiler.d.ts
new file mode 100644
index 000000000000..67e5dca87696
--- /dev/null
+++ b/typings/internalBinding/profiler.d.ts
@@ -0,0 +1,8 @@
+export interface ProfilerBinding {
+  setCoverageDirectory(directory: string): void;
+  setSourceMapCacheGetter(getter: () => object | undefined): void;
+  startCoverage(): void;
+  takeCoverage(): void;
+  stopCoverage(): void;
+  endCoverage(): void;
+}

From 29d39e10ad64eac6e8914375a8c741c927c116a1 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 4 Sep 2026 07:56:29 +0000
Subject: [PATCH 117/202] test: ignore tunnel resets in proxy
 invalid-char-in-url test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test-https-proxy-request-invalid-char-in-url is the only client-proxy
test that asserts the proxy logged no socket errors at all. Once the
last response has been read the client destroys its tunnel, and if the
proxy is still relaying the upstream's TLS close_notify at that point
the client answers with a reset, which the proxy records as ECONNRESET
on the CONNECT socket. That has been failing the test on macOS even
though every request was routed to the sanitized URL. Keep asserting
on other errors but leave connection resets out.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65780
Fixes: https://github.com/nodejs/node/issues/64226
Refs: https://github.com/nodejs/node/issues/59146
Refs: https://github.com/nodejs/node/issues/54534
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 .../test-https-proxy-request-invalid-char-in-url.mjs          | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
index 888137b9a5a6..6f27f0775aee 100644
--- a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
+++ b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
@@ -83,7 +83,9 @@ for (const testCase of testCases) {
           server.close();
           assert.deepStrictEqual(requests, expectedUrls);
           const requestLogs = logs.filter((log) => !('error' in log));
-          const errors = logs.filter((log) => 'error' in log);
+          // The client may reset a tunnel while the proxy is still relaying
+          // the upstream's TLS shutdown; that says nothing about the URLs.
+          const errors = logs.filter((log) => 'error' in log && log.error.code !== 'ECONNRESET');
           assert.deepStrictEqual(new Set(requestLogs), expectedProxyLogs);
           assert.deepStrictEqual(errors, []);
         }));

From a8f1517c4d48c953862ab8d3e44f2ec18346b4e4 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 4 Sep 2026 08:07:27 +0000
Subject: [PATCH 118/202] test: do not dump core in external memory limit test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test-external-memory-reasonable-size makes a child allocate 1.2 GB of
external memory so that V8's --external-memory-max-reasonable-size
check fires and the process aborts. The abort raises SIGABRT with all
of that memory resident, and on hosts that write core files (the
SmartOS CI machines in particular) the dump takes longer than the test
timeout, so the test has been timing out there since it was added.

Run the child under `ulimit -c 0` on POSIX, the same way
test-abort-fatal-error and common.childShouldThrowAndAbort() handle
their aborting children.

Refs: https://github.com/nodejs/node/pull/65589
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65780
Fixes: https://github.com/nodejs/node/issues/64226
Refs: https://github.com/nodejs/node/issues/59146
Refs: https://github.com/nodejs/node/issues/54534
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 .../test-external-memory-reasonable-size.js   | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/test/parallel/test-external-memory-reasonable-size.js b/test/parallel/test-external-memory-reasonable-size.js
index 14e2573328ba..f9ff1af8e5a1 100644
--- a/test/parallel/test-external-memory-reasonable-size.js
+++ b/test/parallel/test-external-memory-reasonable-size.js
@@ -8,7 +8,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { execSync } = require('child_process');
 const { totalmem } = require('os');
 
 // The smallest limit V8 accepts is 1 GB, so the child has to allocate more
@@ -20,14 +20,15 @@ for (const flag of [
   '--external-memory-max-reasonable-size=1',
   '--external_memory_max_reasonable_size=1',
 ]) {
-  const child = spawnSync(process.execPath, [
-    flag, '-e', 'new Float64Array(150_000_000)',
-  ]);
-
-  assert.notStrictEqual(
-    child.status,
-    0,
-    `${flag} was not honored, the child exited cleanly`,
+  // The child aborts with over a gigabyte resident, so keep it from writing a
+  // core file; on some hosts that dump alone outlasts the test timeout.
+  const [cmd, opts] = common.escapePOSIXShell`"${process.execPath}" ${flag} -e "new Float64Array(150_000_000)"`;
+  assert.throws(
+    () => execSync(common.isWindows ? cmd : `ulimit -c 0; ${cmd}`, { ...opts, stdio: 'pipe' }),
+    (err) => {
+      assert.notStrictEqual(err.status, 0, `${flag} was not honored, the child exited cleanly`);
+      assert.match(err.stderr.toString(), /kMaxReasonableBytes/);
+      return true;
+    },
   );
-  assert.match(child.stderr.toString(), /kMaxReasonableBytes/);
 }

From b273c27404171d341eec5edb0d4d30c3c0091213 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 4 Sep 2026 08:22:22 +0000
Subject: [PATCH 119/202] test: only count restarts after the write in watch
 emit-restarted test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test-run-watch-emit-restarted expected exactly one test:watch:restarted
event, but it starts run({ watch: true }) right after writing the
fixtures into the watched directory. Watch backends that deliver events
with some latency, FSEvents on macOS most visibly, can still report
those setup writes once the first run is under way, which restarts it
and makes the later, intentional write the second restart. The test has
been marked flaky on macOS x64 for that reason.

Wait for the first drain, then require that the write is followed by a
restart and a drain, ignoring whatever the setup produced before it, and
drop the flaky marker.

Refs: https://github.com/nodejs/node/issues/54534
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65780
Fixes: https://github.com/nodejs/node/issues/64226
Refs: https://github.com/nodejs/node/issues/59146
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 .../test-run-watch-emit-restarted.mjs         | 28 ++++++++-----------
 test/test-runner/test-runner.status           |  1 -
 2 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/test/test-runner/test-run-watch-emit-restarted.mjs b/test/test-runner/test-run-watch-emit-restarted.mjs
index 200231c69043..fd596bd818ca 100644
--- a/test/test-runner/test-run-watch-emit-restarted.mjs
+++ b/test/test-runner/test-run-watch-emit-restarted.mjs
@@ -1,5 +1,5 @@
 // Test run({ watch: true }) emits test:watch:restarted when file is updated
-import * as common from '../common/index.mjs';
+import '../common/index.mjs';
 import { run } from 'node:test';
 import assert from 'node:assert';
 import { writeFileSync } from 'node:fs';
@@ -11,9 +11,8 @@ import { refreshForTestRunnerWatch, skipIfNoWatch, fixtureContent } from '../com
 skipIfNoWatch();
 refreshForTestRunnerWatch();
 
-let alreadyDrained = false;
 const events = [];
-const testWatchRestarted = common.mustCall(1);
+let written = false;
 
 const controller = new AbortController();
 const stream = run({
@@ -21,27 +20,24 @@ const stream = run({
   watch: true,
   signal: controller.signal,
 }).on('data', function({ type }) {
-  events.push(type);
-  if (type === 'test:watch:restarted') {
-    testWatchRestarted();
+  if (type !== 'test:watch:restarted' && type !== 'test:watch:drained') {
+    return;
   }
-  if (type === 'test:watch:drained') {
-    if (alreadyDrained) {
-      controller.abort();
-    }
-    alreadyDrained = true;
+  events.push(type);
+  // Watchers with latency (FSEvents) can still report the fixture setup after
+  // the first run has started, so only a restart after the write below counts.
+  if (written && type === 'test:watch:drained' && events.at(-2) === 'test:watch:restarted') {
+    controller.abort();
   }
 });
 
 await once(stream, 'test:watch:drained');
 
+events.length = 0;
+written = true;
 writeFileSync(join(tmpdir.path, 'test.js'), fixtureContent['test.js']);
 
 // eslint-disable-next-line no-unused-vars
 for await (const _ of stream);
 
-assert.partialDeepStrictEqual(events, [
-  'test:watch:drained',
-  'test:watch:restarted',
-  'test:watch:drained',
-]);
+assert.deepStrictEqual(events.slice(-2), ['test:watch:restarted', 'test:watch:drained']);
diff --git a/test/test-runner/test-runner.status b/test/test-runner/test-runner.status
index 149d6ab689cd..7d2d59d3540c 100644
--- a/test/test-runner/test-runner.status
+++ b/test/test-runner/test-runner.status
@@ -14,4 +14,3 @@ test-watch-create-isolation-none: SKIP
 # https://github.com/nodejs/node/issues/54534#issuecomment-5423551021
 test-run-watch-cwd-isolation-none: PASS, FLAKY
 test-run-watch-cwd-isolation-none-argv: PASS, FLAKY
-test-run-watch-emit-restarted: PASS, FLAKY

From bb8f1148c4437eabf9ab568dc5b199cac0b2ae93 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 4 Sep 2026 08:24:27 +0000
Subject: [PATCH 120/202] test: fix the thread-spawn handshake in the WASI
 threads fixture
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test-wasi-pthread fails now and then on every platform with
"Assertion failed: r == 0 (c/pthread.c: main: 17)", i.e.
pthread_create() itself reporting an error. The fixture implements
`thread-spawn` by starting a Worker and blocking in
Atomics.wait(result, 0, 0, 1000) until the worker signals that it has
instantiated the module. Two things go wrong there: the worker signals
success by storing 0, the value the main thread is already waiting on,
so when the worker is quicker than the main thread its notify is lost
and the wait runs into the timeout; and one second is not always enough
for a Worker to start and instantiate a threads build on the slower CI
hosts (arm debug, Windows, macOS). Either way spawn() returns -6 and
wasi-libc turns that into a pthread_create() failure.

Wait on a sentinel value that neither outcome writes, and give the
worker a platform-scaled 30 seconds. Drop the flaky markers.

Fixes: https://github.com/nodejs/node/issues/64226
Refs: https://github.com/nodejs/node/issues/59146
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65780
Refs: https://github.com/nodejs/node/issues/54534
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 test/fixtures/wasi-preview-1.js | 5 ++++-
 test/wasi/wasi.status           | 7 -------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/test/fixtures/wasi-preview-1.js b/test/fixtures/wasi-preview-1.js
index 535bc3e5ec18..3fde5a30b759 100644
--- a/test/fixtures/wasi-preview-1.js
+++ b/test/fixtures/wasi-preview-1.js
@@ -68,6 +68,9 @@ assert.strictEqual(wasiPreview1.wasiImport,
       const name = `pthread-${tid}`;
       const sab = new SharedArrayBuffer(8 + 8192);
       const result = new Int32Array(sab);
+      // The thread stores 0 once it has loaded or 1 with an error; wait on a
+      // value neither of them writes so an early notify cannot be missed.
+      Atomics.store(result, 0, -1);
 
       const workerData = {
         name,
@@ -106,7 +109,7 @@ assert.strictEqual(wasiPreview1.wasiImport,
         throw new Error(e);
       });
 
-      const r = Atomics.wait(result, 0, 0, 1000);
+      const r = Atomics.wait(result, 0, -1, common.platformTimeout(30_000));
       if (r === 'timed-out') {
         workers[tid].terminate();
         delete workers[tid];
diff --git a/test/wasi/wasi.status b/test/wasi/wasi.status
index 14b671b6e3b1..a26617e01367 100644
--- a/test/wasi/wasi.status
+++ b/test/wasi/wasi.status
@@ -15,10 +15,3 @@ test-wasi-getrusage: SKIP
 # Unsupported on Windows and Android
 test-wasi-readdir: SKIP
 
-[$system==win32 || $system==macos]
-# https://github.com/nodejs/node/issues/64226#issuecomment-5423585588
-test-wasi-pthread: PASS, FLAKY
-
-[$system==linux]
-# https://github.com/nodejs/node/issues/59146
-test-wasi-pthread: PASS, FLAKY

From 093e37cfc3b87398ab8fc00927d7ffe6c7bdd4cf Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 5 Sep 2026 17:49:59 +0000
Subject: [PATCH 121/202] test: widen the gap in the resolver maxTimeout
 comparison
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test-dns-resolver-max-timeout times a query with `{ timeout: 500,
tries: 3 }` against one that also sets `maxTimeout: 500` and asserts
the first took longer. c-ares only expires a try when cares_wrap's
timer fires, every `timeout` ms, so each try costs one or two ticks
depending on sub-millisecond ordering, and uncapped retries also get
0.5-1x jitter. That leaves the capped run anywhere in 1500-3000 ms and
the uncapped one in 3000-4500 ms; on a busy rhel10-ppc64le host both
came out at 3005 ms. With `timeout: 100, tries: 5` the ranges (about
600-1000 ms and 5000-7500 ms measured under load) cannot meet.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65780
Fixes: https://github.com/nodejs/node/issues/64226
Refs: https://github.com/nodejs/node/issues/59146
Refs: https://github.com/nodejs/node/issues/54534
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 test/parallel/test-dns-resolver-max-timeout.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/test/parallel/test-dns-resolver-max-timeout.js b/test/parallel/test-dns-resolver-max-timeout.js
index 7abac39323e1..1a4aaef96c96 100644
--- a/test/parallel/test-dns-resolver-max-timeout.js
+++ b/test/parallel/test-dns-resolver-max-timeout.js
@@ -52,9 +52,11 @@ server.bind(0, common.mustCall(async () => {
 
   // Test that maxTimeout is effective.
   // Without maxTimeout, the timeout will keep increasing when retrying.
-  const timeout1 = await timeout(address, { timeout: 500, tries: 3 });
-  // With maxTimeout, the timeout will always be 500 when retrying.
-  const timeout2 = await timeout(address, { timeout: 500, tries: 3, maxTimeout: 500 });
+  // Expired tries are only noticed on the resolver's `timeout` ms timer tick,
+  // so use enough tries that the doubling run cannot overlap the capped one.
+  const timeout1 = await timeout(address, { timeout: 100, tries: 5 });
+  // With maxTimeout, the timeout will always be 100 when retrying.
+  const timeout2 = await timeout(address, { timeout: 100, tries: 5, maxTimeout: 100 });
   console.log(`timeout1: ${timeout1}, timeout2: ${timeout2}`);
   assert.strictEqual(timeout1 !== undefined && timeout2 !== undefined, true);
   assert.strictEqual(timeout1 > timeout2, true);

From 7991140d5b5275a10cfd8524e88b44f407b8f14f Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 5 Sep 2026 18:16:32 +0000
Subject: [PATCH 122/202] test: make node:bench test samples survive a coarse
 clock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most node:bench tests record a sample with `b.start();
process.hrtime.bigint(); b.end(1)`, counting on the extra clock read to
make end() see a later timestamp than start(). On a debian12-x64 CI
host the monotonic clock is coarse enough that all three reads returned
the same value, so end() threw ERR_INVALID_STATE ("insufficient clock
precision for benchmark sample") and test-bench-harness-errors failed;
every test using the idiom can fail the same way there.

Add test/common/bench.js with completeSample(), which spins until
process.hrtime.bigint() moves between start() and end(), and use it at
all of those sites, bench-runner fixtures included.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65780
Fixes: https://github.com/nodejs/node/issues/64226
Refs: https://github.com/nodejs/node/issues/59146
Refs: https://github.com/nodejs/node/issues/54534
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
---
 test/common/README.md                           | 16 ++++++++++++++++
 test/common/bench.js                            | 13 +++++++++++++
 test/fixtures/bench-runner/identity-child-a.cjs |  5 ++---
 test/fixtures/bench-runner/identity-child-b.cjs |  5 ++---
 test/fixtures/bench-runner/identity-preload.cjs |  5 ++---
 test/fixtures/bench-runner/identity-shared.cjs  |  5 ++---
 .../load-error-after-declaration.cjs            |  5 ++---
 test/fixtures/bench-runner/tools.cjs            |  9 ++-------
 test/parallel/test-bench-context-control.js     |  5 ++---
 test/parallel/test-bench-context-errors.js      |  5 ++---
 test/parallel/test-bench-create-runner.js       | 17 +++++------------
 test/parallel/test-bench-custom-reporter.js     |  5 ++---
 test/parallel/test-bench-errors.js              | 15 +++++----------
 test/parallel/test-bench-filtering.js           |  5 ++---
 test/parallel/test-bench-harness-errors.js      | 17 ++++++-----------
 test/parallel/test-bench-hook-errors.js         | 11 +++--------
 test/parallel/test-bench-reporters.js           |  5 ++---
 test/parallel/test-bench-run-options.js         |  5 ++---
 test/parallel/test-bench-run.js                 |  9 +++------
 test/parallel/test-bench-validation.js          | 13 ++++---------
 .../test-bench-yield-between-samples.js         |  9 +++------
 21 files changed, 82 insertions(+), 102 deletions(-)
 create mode 100644 test/common/bench.js

diff --git a/test/common/README.md b/test/common/README.md
index 6c8fcf42847a..193250562972 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -28,6 +28,7 @@ several other tasks:
 ## Table of contents
 
 * [ArrayStream module](#arraystream-module)
+* [Bench module](#bench-module)
 * [Benchmark module](#benchmark-module)
 * [Child process module](#child-process-module)
 * [Common module API](#common-module-api)
@@ -49,6 +50,21 @@ several other tasks:
 * [UDP pair helper](#udp-pair-helper)
 * [WPT module](#wpt-module)
 
+## Bench module
+
+The `bench` module has helpers for tests of `node:bench`.
+
+### `completeSample(b[, operations[, options]])`
+
+* `b` The `BenchContext` passed to a `node:bench` benchmark function.
+* `operations` [\<number>][<number>] Passed to `b.end()`. **Default:** `1`.
+* `options` [\<Object>][<Object>] Passed to `b.end()`.
+* return the sample returned by `b.end()`.
+
+Calls `b.start()` and `b.end()` with at least one `process.hrtime.bigint()`
+tick in between, so the sample has a non-zero duration on hosts whose
+monotonic clock is coarse.
+
 ## Benchmark module
 
 The `benchmark` module is used by tests to run benchmarks.
diff --git a/test/common/bench.js b/test/common/bench.js
new file mode 100644
index 000000000000..25d67e3a17b2
--- /dev/null
+++ b/test/common/bench.js
@@ -0,0 +1,13 @@
+'use strict';
+
+// Records a sample with start()/end() and at least one hrtime tick in
+// between, so its duration is non-zero even on hosts with a coarse clock.
+function completeSample(b, operations = 1, options = undefined) {
+  b.start();
+  const started = process.hrtime.bigint();
+  let now = started;
+  while (now === started) now = process.hrtime.bigint();
+  return b.end(operations, options);
+}
+
+module.exports = { completeSample };
diff --git a/test/fixtures/bench-runner/identity-child-a.cjs b/test/fixtures/bench-runner/identity-child-a.cjs
index 2b8c4b728b1c..ae7824d0ab7d 100644
--- a/test/fixtures/bench-runner/identity-child-a.cjs
+++ b/test/fixtures/bench-runner/identity-child-a.cjs
@@ -1,11 +1,10 @@
 'use strict';
 
+const { completeSample } = require('../../common/bench');
 const { bench } = require('node:bench');
 
 module.exports = function declareChildA() {
   bench('child a', { samples: 1 }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
 };
diff --git a/test/fixtures/bench-runner/identity-child-b.cjs b/test/fixtures/bench-runner/identity-child-b.cjs
index 249bcdcfc4f1..2841a98055e0 100644
--- a/test/fixtures/bench-runner/identity-child-b.cjs
+++ b/test/fixtures/bench-runner/identity-child-b.cjs
@@ -1,11 +1,10 @@
 'use strict';
 
+const { completeSample } = require('../../common/bench');
 const { bench } = require('node:bench');
 
 module.exports = function declareChildB() {
   bench('child b', { samples: 1 }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
 };
diff --git a/test/fixtures/bench-runner/identity-preload.cjs b/test/fixtures/bench-runner/identity-preload.cjs
index ed55e627527b..bcc9df72c410 100644
--- a/test/fixtures/bench-runner/identity-preload.cjs
+++ b/test/fixtures/bench-runner/identity-preload.cjs
@@ -1,9 +1,8 @@
 'use strict';
 
+const { completeSample } = require('../../common/bench');
 const { bench } = require('node:bench');
 
 bench('preload identity', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
 });
diff --git a/test/fixtures/bench-runner/identity-shared.cjs b/test/fixtures/bench-runner/identity-shared.cjs
index 40ce0f27be29..c47bcc954745 100644
--- a/test/fixtures/bench-runner/identity-shared.cjs
+++ b/test/fixtures/bench-runner/identity-shared.cjs
@@ -1,11 +1,10 @@
 'use strict';
 
+const { completeSample } = require('../../common/bench');
 const { bench } = require('node:bench');
 
 module.exports = function registerSharedIdentity() {
   bench('shared identity', { samples: 1 }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
 };
diff --git a/test/fixtures/bench-runner/load-error-after-declaration.cjs b/test/fixtures/bench-runner/load-error-after-declaration.cjs
index eca2188d41c5..6f2cf085742c 100644
--- a/test/fixtures/bench-runner/load-error-after-declaration.cjs
+++ b/test/fixtures/bench-runner/load-error-after-declaration.cjs
@@ -1,11 +1,10 @@
 'use strict';
 
+const { completeSample } = require('../../common/bench');
 const { bench } = require('node:bench');
 
 bench('declared before load error', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
 });
 
 throw new Error('load failed after declaration');
diff --git a/test/fixtures/bench-runner/tools.cjs b/test/fixtures/bench-runner/tools.cjs
index 108a6f81dd63..073a090d8829 100644
--- a/test/fixtures/bench-runner/tools.cjs
+++ b/test/fixtures/bench-runner/tools.cjs
@@ -1,5 +1,6 @@
 'use strict';
 
+const { completeSample } = require('../../common/bench');
 const { bench } = require('node:bench');
 
 if (process.env.NODE_BENCH_PID_LOG !== undefined) {
@@ -10,11 +11,5 @@ if (process.env.NODE_BENCH_PID_LOG !== undefined) {
 for (const size of [1, 2]) {
   bench('tools/simple.js', {
     params: { method: 'loop', size },
-  }, (b) => {
-    let value = 0;
-    b.start();
-    for (let i = 0; i < 1_000; i++) value += size;
-    b.end(1_000);
-    if (value === 0) throw new Error('unreachable');
-  });
+  }, (b) => completeSample(b, 1_000));
 }
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
index b847e926ffcd..6ee095f94eae 100644
--- a/test/parallel/test-bench-context-control.js
+++ b/test/parallel/test-bench-context-control.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
 
@@ -16,9 +17,7 @@ const { createRunner } = require('node:bench');
   }, common.mustCall((b) => {
     invocations.push(`${b.phase}:${b.index}`);
     const detail = { index: b.index, phase: b.phase };
-    b.start();
-    process.hrtime.bigint();
-    const sample = b.end(2, { detail });
+    const sample = completeSample(b, 2, { detail });
     detail.index = -1;
 
     assert.strictEqual(sample.operations, 2);
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
index 9ba104443ad6..995330c5faef 100644
--- a/test/parallel/test-bench-context-errors.js
+++ b/test/parallel/test-bench-context-errors.js
@@ -2,15 +2,14 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
 
 const runner = createRunner({ yieldBetweenSamples: false });
 
 runner.bench('done during warmup', { samples: 1, warmup: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
   b.done();
 });
 runner.bench('invalid record', { samples: 1 }, (b) => b.record(null));
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
index 5540a189ad52..51474af3d99c 100644
--- a/test/parallel/test-bench-create-runner.js
+++ b/test/parallel/test-bench-create-runner.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
 const { setImmediate } = require('timers/promises');
@@ -18,16 +19,12 @@ const { setImmediate } = require('timers/promises');
   const firstCompletion = first.bench(
     'same name', { samples: 2 }, common.mustCall((b) => {
       firstCalls++;
-      b.start();
-      process.hrtime.bigint();
-      b.end(1);
+      completeSample(b);
     }, 2));
   const secondCompletion = second.bench(
     'same name', { samples: 1 }, common.mustCall((b) => {
       secondCalls++;
-      b.start();
-      process.hrtime.bigint();
-      b.end(1);
+      completeSample(b);
     }));
 
   await setImmediate();
@@ -74,9 +71,7 @@ const { setImmediate } = require('timers/promises');
 
   const retry = createRunner({ yieldBetweenSamples: false });
   retry.bench('not filtered', { samples: 1 }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
   assert.throws(() => retry.run({
     namePattern: 'filtered',
@@ -90,9 +85,7 @@ const { setImmediate } = require('timers/promises');
 
   const reentrant = createRunner({ yieldBetweenSamples: false });
   reentrant.bench('reentrant options', { samples: 1 }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
   const reentrantOptions = {};
   Object.defineProperty(reentrantOptions, 'samples', {
diff --git a/test/parallel/test-bench-custom-reporter.js b/test/parallel/test-bench-custom-reporter.js
index 9589834baf3a..1d4ec8bed191 100644
--- a/test/parallel/test-bench-custom-reporter.js
+++ b/test/parallel/test-bench-custom-reporter.js
@@ -2,15 +2,14 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { Writable } = require('stream');
 const { finished } = require('stream/promises');
 const { bench, run } = require('node:bench');
 
 bench('completed', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
 });
 bench.skip('skipped', { samples: 1 }, common.mustNotCall());
 
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
index 2124720fee63..e540d5d847c5 100644
--- a/test/parallel/test-bench-errors.js
+++ b/test/parallel/test-bench-errors.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { bench, run, suite } = require('node:bench');
 const { setTimeout } = require('timers/promises');
@@ -40,21 +41,15 @@ bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
 });
 bench('after late timeout', options, common.mustCall((b) => {
   assert.strictEqual(lateTimeoutActive, false);
-  complete(b);
+  completeSample(b);
 }));
 
 const signal = AbortSignal.abort(new Error('stop'));
 bench('aborted', { samples: 1, signal }, () => {});
 
-function complete(b) {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
-}
-
-bench('duplicate', { samples: 1, params: { value: 1 } }, complete);
-bench('duplicate', { samples: 1, params: { value: 1 } }, complete);
-bench('continues', options, complete);
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('continues', options, completeSample);
 bench('timeout', { samples: 1, timeout: 10 }, async () => {
   await new Promise(() => {});
 });
diff --git a/test/parallel/test-bench-filtering.js b/test/parallel/test-bench-filtering.js
index 39f5368d26a0..da580dcdafc0 100644
--- a/test/parallel/test-bench-filtering.js
+++ b/test/parallel/test-bench-filtering.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { bench, run, suite } = require('node:bench');
 
@@ -10,9 +11,7 @@ const calls = [];
 function complete(name) {
   return (b) => {
     calls.push(name);
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   };
 }
 
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
index 1cb0b505689f..4fd6ec739488 100644
--- a/test/parallel/test-bench-harness-errors.js
+++ b/test/parallel/test-bench-harness-errors.js
@@ -2,16 +2,11 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
 const { setImmediate } = require('timers/promises');
 
-function complete(b) {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
-}
-
 async function testSynchronousSuiteFailure() {
   const runner = createRunner({ yieldBetweenSamples: false });
   const completion = runner.suite('outer', () => {
@@ -43,7 +38,7 @@ async function testRunSignal() {
     samples: 3,
   }, (b) => {
     invocations++;
-    complete(b);
+    completeSample(b);
     if (b.index === 0) {
       abortPromise = setImmediate().then(() => {
         controller.abort(new Error('run aborted'));
@@ -65,7 +60,7 @@ async function testRunSignalAfterSample() {
   const reason = new Error('sample aborted');
   const completion = runner.bench('aborted after sample', {
     samples: 2,
-  }, complete);
+  }, completeSample);
   const stream = runner.run({ signal: controller.signal });
   stream.once('bench:sample', common.mustCall(() => {
     controller.abort(reason);
@@ -80,7 +75,7 @@ async function testRunSignalAfterSample() {
 
 async function testStringNamePattern() {
   const runner = createRunner({ yieldBetweenSamples: false });
-  runner.bench('included', { samples: 1 }, complete);
+  runner.bench('included', { samples: 1 }, completeSample);
   runner.bench('excluded', { samples: 1 }, common.mustNotCall());
   const records = await runner.run({ namePattern: 'included' }).toArray();
   const excluded = records.find(
@@ -97,7 +92,7 @@ async function testStringNamePattern() {
 async function testTopLevelRecovery() {
   const runner = createRunner({ yieldBetweenSamples: false });
   const suiteCompletion = runner.suite('nested', () => {
-    runner.bench('listener failure', { samples: 1 }, complete);
+    runner.bench('listener failure', { samples: 1 }, completeSample);
   });
   const stream = runner.run();
   const failure = new Error();
@@ -123,7 +118,7 @@ async function testRepeatedReportingFailure() {
   const summary = new Error('summary listener failed');
   const completion = runner.bench('reporting failures', {
     samples: 1,
-  }, complete);
+  }, completeSample);
   const stream = runner.run();
   stream.on('bench:start', common.mustCall(() => { throw original; }));
   stream.on('bench:diagnostic', common.mustCall(() => {
diff --git a/test/parallel/test-bench-hook-errors.js b/test/parallel/test-bench-hook-errors.js
index c4615419674a..f2977f241deb 100644
--- a/test/parallel/test-bench-hook-errors.js
+++ b/test/parallel/test-bench-hook-errors.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { setImmediate } = require('timers/promises');
 const {
@@ -14,12 +15,6 @@ const {
   suite,
 } = require('node:bench');
 
-function complete(b) {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
-}
-
 suite('before failure', () => {
   before(() => { throw new Error('before failure'); });
   after(common.mustCall());
@@ -34,7 +29,7 @@ suite('beforeEach failure', () => {
 
 suite('after failure', () => {
   after(() => { throw new Error('after failure'); });
-  bench('completes before after', { samples: 1 }, complete);
+  bench('completes before after', { samples: 1 }, completeSample);
 });
 
 suite('build failure', async () => {
@@ -42,7 +37,7 @@ suite('build failure', async () => {
   throw new Error('build failure');
 });
 
-bench('continues after suite failures', { samples: 1 }, complete);
+bench('continues after suite failures', { samples: 1 }, completeSample);
 
 const completions = [];
 const diagnostics = [];
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
index 44e43bd5be78..f383e2cf5213 100644
--- a/test/parallel/test-bench-reporters.js
+++ b/test/parallel/test-bench-reporters.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { Readable } = require('stream');
 const { bench, run } = require('node:bench');
@@ -11,9 +12,7 @@ bench('json completed', {
   params: { size: 'small' },
   samples: 1,
 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
 });
 
 bench('json failed', { samples: 1 }, () => {
diff --git a/test/parallel/test-bench-run-options.js b/test/parallel/test-bench-run-options.js
index e04bc15ef335..bbb89f5fdc99 100644
--- a/test/parallel/test-bench-run-options.js
+++ b/test/parallel/test-bench-run-options.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { bench, run } = require('node:bench');
 
@@ -9,9 +10,7 @@ let invocations = 0;
 const timeout = common.platformTimeout(1000);
 bench('overridden', { samples: 8, timeout, warmup: 8 }, (b) => {
   invocations++;
-  b.start();
-  process.hrtime.bigint();
-  b.end(invocations);
+  completeSample(b, invocations);
 });
 
 const plans = [];
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
index 0e152342bcaa..e79411f83e1d 100644
--- a/test/parallel/test-bench-run.js
+++ b/test/parallel/test-bench-run.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { setImmediate } = require('timers/promises');
 const {
@@ -42,9 +43,7 @@ const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
     contexts.add(b);
     calls.push('sync sample');
     assert.deepStrictEqual(b.params, { __proto__: null, a: true, z: 2 });
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
     active = false;
   }, 3));
 
@@ -54,9 +53,7 @@ const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
     contexts.add(b);
     calls.push('async sample');
     await setImmediate();
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
     await setImmediate();
     active = false;
   }, 2));
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
index fa7a579aa60c..39edc5d411cc 100644
--- a/test/parallel/test-bench-validation.js
+++ b/test/parallel/test-bench-validation.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { bench, createRunner, run } = require('node:bench');
 
@@ -11,17 +12,13 @@ let objectOverloadCalls = 0;
 
 function functionOverload(b) {
   functionOverloadCalls++;
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
   b.done();
 }
 
 function objectOverload(b) {
   objectOverloadCalls++;
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
 }
 
 assert.throws(() => bench('', noop), { code: 'ERR_INVALID_ARG_VALUE' });
@@ -69,9 +66,7 @@ bench(functionOverload);
 bench({ samples: 1 }, objectOverload);
 
 bench('valid', { samples: 1 }, (b) => {
-  b.start();
-  process.hrtime.bigint();
-  b.end(1);
+  completeSample(b);
 });
 
 const stream = run();
diff --git a/test/parallel/test-bench-yield-between-samples.js b/test/parallel/test-bench-yield-between-samples.js
index 7d08318a027a..aceb381d1a57 100644
--- a/test/parallel/test-bench-yield-between-samples.js
+++ b/test/parallel/test-bench-yield-between-samples.js
@@ -2,6 +2,7 @@
 'use strict';
 
 const common = require('../common');
+const { completeSample } = require('../common/bench');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
 const { setImmediate } = require('timers/promises');
@@ -16,9 +17,7 @@ async function observe(factoryOptions, runOptions) {
 
   runner.bench('yielding', { samples: 2 }, (b) => {
     observed.push(turnOccurred);
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
 
   await runner.run(runOptions).toArray();
@@ -55,9 +54,7 @@ async function observeAfterEachTimeout() {
     samples: 1,
     timeout: 5,
   }, (b) => {
-    b.start();
-    process.hrtime.bigint();
-    b.end(1);
+    completeSample(b);
   });
   await runner.run().toArray();
   const result = await completion;

From f16b556950dc1944df36bafe5eae27ae91899afe Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Sun, 6 Sep 2026 17:44:07 +0900
Subject: [PATCH 123/202] typings: add stream_pipe internal binding types

Add a StreamPipeBinding declaration for internalBinding('stream_pipe')
and wire it into InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65664
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 typings/globals.d.ts                     |  2 ++
 typings/internalBinding/stream_pipe.d.ts | 17 +++++++++++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 typings/internalBinding/stream_pipe.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 2e4617c6d692..b48a35117c20 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -32,6 +32,7 @@ import { ProfilerBinding } from './internalBinding/profiler';
 import { SeaBinding } from './internalBinding/sea';
 import { SerdesBinding } from './internalBinding/serdes';
 import { SignalWrapBinding } from './internalBinding/signal_wrap';
+import { StreamPipeBinding } from './internalBinding/stream_pipe';
 import { StringDecoderBinding } from './internalBinding/string_decoder';
 import { SymbolsBinding } from './internalBinding/symbols';
 import { TimersBinding } from './internalBinding/timers';
@@ -80,6 +81,7 @@ interface InternalBindingMap {
   sea: SeaBinding;
   serdes: SerdesBinding;
   signal_wrap: SignalWrapBinding;
+  stream_pipe: StreamPipeBinding;
   string_decoder: StringDecoderBinding;
   symbols: SymbolsBinding;
   timers: TimersBinding;
diff --git a/typings/internalBinding/stream_pipe.d.ts b/typings/internalBinding/stream_pipe.d.ts
new file mode 100644
index 000000000000..17568409af54
--- /dev/null
+++ b/typings/internalBinding/stream_pipe.d.ts
@@ -0,0 +1,17 @@
+declare namespace InternalStreamPipeBinding {
+  class StreamPipe {
+    constructor(source: object, sink: object);
+    readonly source: object | null;
+    readonly sink: object | null;
+    onunpipe?: () => void;
+    oncomplete?: () => void;
+    unpipe(): void;
+    start(): void;
+    isClosed(): boolean;
+    pendingWrites(): number;
+  }
+}
+
+export interface StreamPipeBinding {
+  StreamPipe: typeof InternalStreamPipeBinding.StreamPipe;
+}

From 1b271ee64203aa09233c9a69bb3f48e47a85be57 Mon Sep 17 00:00:00 2001
From: leah-1ee <selee3196@gmail.com>
Date: Sun, 30 Aug 2026 16:10:15 +0900
Subject: [PATCH 124/202] typings: add fs_event_wrap internal binding types

Add a FsEventWrapBinding declaration for
internalBinding('fs_event_wrap') and wire it into InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65661
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 typings/globals.d.ts                       |  2 ++
 typings/internalBinding/fs_event_wrap.d.ts | 28 ++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 typings/internalBinding/fs_event_wrap.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index b48a35117c20..d8270a6a7fea 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -13,6 +13,7 @@ import { EncodingBinding } from './internalBinding/encoding_binding';
 import { FFIBinding } from './internalBinding/ffi';
 import { FsBinding } from './internalBinding/fs';
 import { FsDirBinding } from './internalBinding/fs_dir';
+import { FsEventWrapBinding } from './internalBinding/fs_event_wrap';
 import { HeapUtilsBinding } from './internalBinding/heap_utils';
 import { HttpParserBinding } from './internalBinding/http_parser';
 import { ICUBinding } from './internalBinding/icu';
@@ -62,6 +63,7 @@ interface InternalBindingMap {
   ffi: FFIBinding;
   fs: FsBinding;
   fs_dir: FsDirBinding;
+  fs_event_wrap: FsEventWrapBinding;
   heap_utils: HeapUtilsBinding;
   http_parser: HttpParserBinding;
   icu: ICUBinding;
diff --git a/typings/internalBinding/fs_event_wrap.d.ts b/typings/internalBinding/fs_event_wrap.d.ts
new file mode 100644
index 000000000000..ee839cedb4f6
--- /dev/null
+++ b/typings/internalBinding/fs_event_wrap.d.ts
@@ -0,0 +1,28 @@
+import { owner_symbol } from './symbols';
+
+declare namespace InternalFsEventWrapBinding {
+  class FSEvent {
+    constructor();
+    [owner_symbol]?: object;
+    readonly initialized: boolean;
+    onchange?: (
+      status: number,
+      eventType: string,
+      filename: string | Uint8Array | null,
+    ) => void;
+    start(
+      filename: string,
+      persistent: boolean,
+      recursive: boolean,
+      encoding: string,
+    ): number;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+  }
+}
+
+export interface FsEventWrapBinding {
+  FSEvent: typeof InternalFsEventWrapBinding.FSEvent;
+}

From 2dfdb6a42065304ec0e7e879167a43d70532e9ba Mon Sep 17 00:00:00 2001
From: leah-1ee <selee3196@gmail.com>
Date: Sun, 30 Aug 2026 21:32:45 +0900
Subject: [PATCH 125/202] typings: fix fs_event_wrap start filename type

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65661
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 typings/internalBinding/fs_event_wrap.d.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/typings/internalBinding/fs_event_wrap.d.ts b/typings/internalBinding/fs_event_wrap.d.ts
index ee839cedb4f6..b1b815e8a35e 100644
--- a/typings/internalBinding/fs_event_wrap.d.ts
+++ b/typings/internalBinding/fs_event_wrap.d.ts
@@ -11,7 +11,7 @@ declare namespace InternalFsEventWrapBinding {
       filename: string | Uint8Array | null,
     ) => void;
     start(
-      filename: string,
+      filename: string | Uint8Array,
       persistent: boolean,
       recursive: boolean,
       encoding: string,

From 7147a3e8e7eb486bf01ffba670b9d2af96e601f1 Mon Sep 17 00:00:00 2001
From: Soul Lee <alus20x@gmail.com>
Date: Mon, 7 Sep 2026 00:20:42 +0900
Subject: [PATCH 126/202] ffi: throw on missing memory helper arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ffi.getInt8() through ffi.getFloat64(), ffi.setInt8() through
ffi.setFloat64(), ffi.toBuffer() and ffi.toArrayBuffer() return
undefined instead of throwing when a required argument is omitted, so a
call that read or wrote nothing cannot be told apart from one that read
a zero byte. All 22 helpers behave this way.

GetValidatedPointerAddress() and GetValidatedSize() already reject the
same argument when it is passed explicitly as undefined. The
args.Length() test in front of them short-circuits the call and returns
Nothing without scheduling an exception. These six are the only tests in
src/ where args.Length() can skip a call that throws; the only other
Length() tests that guard a call at all guard Buffer::HasInstance(),
which cannot throw. The remaining tests in this file guard an inline
predicate and throw in the branch, which is why setUint8(ptr) reports
"Expected an offset argument" while setUint8() reports nothing at all.

Drop those tests. FunctionCallbackInfo::operator[] returns Undefined for
an out-of-range index, which is exactly the value these validators
reject, so each missing argument now produces the error its explicit
undefined counterpart produces. The documentation already describes this
behavior: the signatures are ffi.getInt8(pointer[, offset]),
ffi.setInt8(pointer, offset, value) and
ffi.toBuffer(pointer, length[, copy]), and the getters are documented to
return a number or a bigint.

ExportBytes() carried the same two tests. They are unreachable through
the public API because exportBytes is not exported and its three callers
all validate len in JavaScript first, but they are the same shape.

Signed-off-by: Soul Lee <alus20x@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65500
Fixes: https://github.com/nodejs/node/issues/65499
Refs: https://github.com/nodejs/node/pull/62072
Refs: https://github.com/nodejs/node/pull/62858
Refs: https://github.com/nodejs/node/pull/65842
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/ffi/data.cc             | 15 ++++++---------
 test/ffi/test-ffi-memory.js | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 8bd2c0d9f352..bc287ddd13f9 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -163,8 +163,7 @@ Maybe<void> ValidateStringLength(Environment* env, size_t len) {
 Maybe<std::pair<uint8_t*, size_t>> GetValidatedPointerAndOffset(
     Environment* env, const FunctionCallbackInfo<Value>& args) {
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -204,8 +203,7 @@ Maybe<PointerOffsetAndValue> GetValidatedPointerOffsetAndValue(
   size_t offset;
   Local<Value> value;
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -556,7 +554,7 @@ void ToBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -618,7 +616,7 @@ void ToArrayBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -696,13 +694,12 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   }
 
   uintptr_t ptr;
-  if (args.Length() < 2 ||
-      !GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
+  if (!GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
     return;
   }
 
   size_t len;
-  if (args.Length() < 3 || !GetValidatedSize(env, args[2], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[2], "length").To(&len)) {
     return;
   }
 
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index 5e667af2eb13..6d47200db187 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -318,3 +318,23 @@ test('ffi validates memory access arguments', () => {
     }
   }));
 });
+
+test('ffi memory helpers reject missing required arguments', () => {
+  const widths = ['Int8', 'Uint8', 'Int16', 'Uint16', 'Int32', 'Uint32',
+                  'Int64', 'Uint64', 'Float32', 'Float64'];
+
+  // Calling a helper with no arguments must report the missing pointer the
+  // same way an explicitly passed `undefined` does, instead of returning
+  // `undefined` as if the read or the write had succeeded.
+  for (const width of widths) {
+    for (const name of [`get${width}`, `set${width}`]) {
+      assert.throws(() => ffi[name](), { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => ffi[name](undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+  }
+
+  assert.throws(() => ffi.toBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+});

From 8af75451e9041cd6058080ad3d4a65546797b418 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Sun, 6 Sep 2026 11:42:44 -0400
Subject: [PATCH 127/202] deps: update undici to 8.10.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/65788
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 deps/undici/src/docs/docs/api/Client.md       |    4 +
 .../src/docs/docs/api/EnvHttpProxyAgent.md    |    5 +-
 deps/undici/src/docs/docs/api/EventSource.md  |    4 +
 deps/undici/src/docs/docs/api/Interceptors.md |   10 +-
 .../src/docs/docs/api/Socks5ProxyAgent.md     |    8 +-
 .../src/lib/cache/memory-cache-store.js       |    4 +-
 deps/undici/src/lib/core/symbols.js           |    2 +
 deps/undici/src/lib/dispatcher/agent.js       |    9 +-
 .../src/lib/dispatcher/balanced-pool.js       |   11 +-
 deps/undici/src/lib/dispatcher/client-h1.js   |   16 +-
 deps/undici/src/lib/dispatcher/client-h2.js   |   46 +-
 deps/undici/src/lib/dispatcher/client.js      |    5 +-
 .../src/lib/dispatcher/dispatcher-base.js     |   14 +-
 deps/undici/src/lib/dispatcher/dispatcher.js  |   16 +-
 .../src/lib/dispatcher/dispatcher1-wrapper.js |    3 +
 .../lib/dispatcher/env-http-proxy-agent.js    |   13 +-
 deps/undici/src/lib/dispatcher/proxy-agent.js |   19 +-
 deps/undici/src/lib/dispatcher/retry-agent.js |    3 +
 .../src/lib/dispatcher/round-robin-pool.js    |    2 +-
 .../src/lib/dispatcher/socks5-proxy-agent.js  |  112 +-
 deps/undici/src/lib/handler/cache-handler.js  |   34 +-
 .../src/lib/handler/decorator-handler.js      |    8 +-
 .../src/lib/handler/deduplication-handler.js  |   18 +-
 .../src/lib/handler/redirect-handler.js       |   25 +-
 deps/undici/src/lib/handler/retry-handler.js  |  178 +-
 deps/undici/src/lib/interceptor/cache.js      |   77 +-
 deps/undici/src/lib/interceptor/decompress.js |  128 +-
 .../undici/src/lib/interceptor/deduplicate.js |    9 +-
 deps/undici/src/lib/interceptor/dns.js        |    7 +
 deps/undici/src/lib/interceptor/dump.js       |   33 +-
 deps/undici/src/lib/llhttp/wasm_build_env.txt |    2 +-
 deps/undici/src/lib/mock/mock-agent.js        |   14 +-
 deps/undici/src/lib/mock/mock-utils.js        |   21 +-
 deps/undici/src/lib/util/cache.js             |   48 +-
 deps/undici/src/lib/web/cookies/parse.js      |  297 ++-
 .../lib/web/eventsource/eventsource-stream.js |   29 +-
 .../src/lib/web/eventsource/eventsource.js    |   16 +-
 deps/undici/src/lib/web/fetch/index.js        |    6 +
 deps/undici/src/lib/web/fetch/request.js      |    5 +-
 deps/undici/src/lib/web/fetch/util.js         |    7 +-
 deps/undici/src/lib/web/webidl/index.js       |    6 +-
 .../src/lib/web/websocket/connection.js       |    2 +-
 .../lib/web/websocket/permessage-deflate.js   |    5 +
 .../web/websocket/stream/websocketstream.js   |   18 +-
 deps/undici/src/package-lock.json             | 2370 ++++++++++-------
 deps/undici/src/package.json                  |    6 +-
 deps/undici/src/types/client.d.ts             |   10 +
 deps/undici/src/types/interceptors.d.ts       |    2 +
 deps/undici/src/types/mock-agent.d.ts         |   21 +-
 deps/undici/src/types/socks5-proxy-agent.d.ts |    2 +
 deps/undici/undici.js                         |  262 +-
 src/undici_version.h                          |    2 +-
 52 files changed, 2672 insertions(+), 1302 deletions(-)

diff --git a/deps/undici/src/docs/docs/api/Client.md b/deps/undici/src/docs/docs/api/Client.md
index d48b2303f287..5f44ae42db86 100644
--- a/deps/undici/src/docs/docs/api/Client.md
+++ b/deps/undici/src/docs/docs/api/Client.md
@@ -147,6 +147,10 @@ added: v1.0.0
       WebSocket messages. Applied to uncompressed messages, compressed frame
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
+  * `eventSource` {Object} (optional) EventSource-specific configuration.
+    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
+      EventSource messages. Set to `0` to disable the limit.
+      **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 
 Instantiating a `Client` does not open a connection; the connection is
diff --git a/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md b/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
index 8a6b75a3d67b..f14b8760964e 100644
--- a/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
+++ b/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
@@ -25,8 +25,9 @@ it is used only for HTTPS requests.
 proxied. Each entry may include a leading dot or `*.` wildcard (for example
 `.example.com`) to match subdomains, and an optional `:port` suffix to restrict
 the match to a specific port. A request bypasses the proxy when its host equals
-an entry or is a subdomain of one. Setting `no_proxy` to `*` bypasses the proxy
-for every request.
+an entry or is a subdomain of one. A trailing dot is ignored on both sides, so
+`example.com.` and `example.com` match each other. Setting `no_proxy` to `*`
+bypasses the proxy for every request.
 
 The uppercase variants `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are also
 honored. When both the lowercase and uppercase forms of a variable are set, the
diff --git a/deps/undici/src/docs/docs/api/EventSource.md b/deps/undici/src/docs/docs/api/EventSource.md
index 938a7a8c6f2b..285a983379f7 100644
--- a/deps/undici/src/docs/docs/api/EventSource.md
+++ b/deps/undici/src/docs/docs/api/EventSource.md
@@ -66,6 +66,9 @@ added: v6.5.0
       wait before re-establishing a dropped connection. The server may override
       this value with a `retry` field. **Default:** `3000`.
 
+EventSource-specific limits can be configured on the dispatcher using the
+`eventSource` option. See [`Client`][] for details.
+
 Creates a new `EventSource` and immediately begins connecting to `url`. The
 request is sent with the `Accept: text/event-stream` header, a cache mode of
 `no-store`, and an initiator type of `other`.
@@ -349,6 +352,7 @@ eventSource.onerror = () => {
 ```
 
 [WHATWG-conformant]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
+[`Client`]: Client.md#new-clienturl-options
 [`Dispatcher`]: Dispatcher.md#class-dispatcher
 [`addEventListener()`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener
 [server-sent events]: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events
diff --git a/deps/undici/src/docs/docs/api/Interceptors.md b/deps/undici/src/docs/docs/api/Interceptors.md
index c692442d7f04..856877c3e4ae 100644
--- a/deps/undici/src/docs/docs/api/Interceptors.md
+++ b/deps/undici/src/docs/docs/api/Interceptors.md
@@ -101,8 +101,8 @@ body yourself.
 
 * `opts` {Object} (optional)
   * `maxSize` {number} Maximum number of bytes to read and discard. Responses
-    whose `Content-Length` exceeds this value are aborted. **Default:**
-    `1_048_576` (1 MiB).
+    whose declared or received body size exceeds this value are aborted.
+    **Default:** `1_048_576` (1 MiB).
 
 Per-request override: set `dumpMaxSize` on the dispatch options to override
 the global `maxSize` for a specific request.
@@ -210,6 +210,9 @@ Automatically decompresses response bodies encoded with `gzip`, `x-gzip`,
     skipped. **Default:** `[204, 304]`.
   * `skipErrorResponses` {boolean} When `true`, responses with a status code
     >= 400 are not decompressed. **Default:** `true`.
+  * `maxSize` {number} Maximum decompressed response size in bytes. The request
+    fails with a `ResponseExceededMaxSizeError` if the decoded body exceeds
+    this limit. **Default:** `67108864` (64 MiB).
 
 **Returns:** {Dispatcher.DispatcherComposeInterceptor}
 
@@ -221,7 +224,8 @@ import { Agent, interceptors } from 'undici'
 const agent = new Agent().compose(
   interceptors.decompress({
     skipStatusCodes: [204, 304],
-    skipErrorResponses: false // decompress error bodies too
+    skipErrorResponses: false, // decompress error bodies too
+    maxSize: 16 * 1024 * 1024 // limit decoded bodies to 16 MiB
   })
 )
 ```
diff --git a/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md b/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
index 21fec19b141e..783424da5114 100644
--- a/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
+++ b/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
@@ -60,6 +60,11 @@ added: v7.23.0
     a password embedded in `proxyUrl`. **Default:** the URL password, if any.
   * `connect` {Function} Custom connector used to open the socket to the proxy.
     **Default:** a connector built from `proxyTls`.
+  * `connectTimeout` {number} Maximum time in milliseconds for each proxy
+    connection, SOCKS5 negotiation, and target TLS negotiation stage. A value of
+    `0` disables these stage timeouts. `proxyTls.timeout` and
+    `requestTls.timeout` override it for their respective TLS stages.
+    **Default:** `5000`.
   * `proxyTls` {BuildOptions} TLS options for the connection to the proxy itself
     (SOCKS5 over TLS). When set, the proxy connection is established over TLS and
     `servername` defaults to the proxy host name.
@@ -69,7 +74,8 @@ added: v7.23.0
     host name.
 
 Throws an `InvalidArgumentError` if `proxyUrl` is missing or does not use the
-`socks5:` or `socks:` protocol.
+`socks5:` or `socks:` protocol, or if `connectTimeout`, `proxyTls.timeout`, or
+`requestTls.timeout` is not a finite, non-negative number.
 
 ```mjs
 import { Socks5ProxyAgent } from 'undici'
diff --git a/deps/undici/src/lib/cache/memory-cache-store.js b/deps/undici/src/lib/cache/memory-cache-store.js
index 5ea0f7247dd7..07dba9c3988e 100644
--- a/deps/undici/src/lib/cache/memory-cache-store.js
+++ b/deps/undici/src/lib/cache/memory-cache-store.js
@@ -87,7 +87,7 @@ class MemoryCacheStore extends EventEmitter {
   }
 
   /**
-   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} req
+   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} key
    * @returns {import('../../types/cache-interceptor.d.ts').default.GetResult | undefined}
    */
   get (key) {
@@ -179,7 +179,7 @@ class MemoryCacheStore extends EventEmitter {
 
           // Perform eviction
           for (const [key, entries] of store.#entries) {
-            for (const entry of entries.splice(0, entries.length / 2)) {
+            for (const entry of entries.splice(0, Math.ceil(entries.length / 2))) {
               store.#size -= entry.size
               store.#count -= 1
             }
diff --git a/deps/undici/src/lib/core/symbols.js b/deps/undici/src/lib/core/symbols.js
index badecb709086..5186052881bf 100644
--- a/deps/undici/src/lib/core/symbols.js
+++ b/deps/undici/src/lib/core/symbols.js
@@ -5,6 +5,8 @@ module.exports = {
   kDestroy: Symbol('destroy'),
   kDispatch: Symbol('dispatch'),
   kUrl: Symbol('url'),
+  kRequestOrigin: Symbol('request origin'),
+  kOriginless: Symbol('originless'),
   kWriting: Symbol('writing'),
   kResuming: Symbol('resuming'),
   kQueue: Symbol('queue'),
diff --git a/deps/undici/src/lib/dispatcher/agent.js b/deps/undici/src/lib/dispatcher/agent.js
index 1e670746e8e9..95c1b0923f08 100644
--- a/deps/undici/src/lib/dispatcher/agent.js
+++ b/deps/undici/src/lib/dispatcher/agent.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const { InvalidArgumentError, MaxOriginsReachedError } = require('../core/errors')
-const { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
+const { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
 const DispatcherBase = require('./dispatcher-base')
 const Pool = require('./pool')
 const Client = require('./client')
@@ -97,7 +97,12 @@ class Agent extends DispatcherBase {
           return
         }
 
-        if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+        // A GOAWAY detaches the HTTP/2 session before requeued requests are
+        // dispatched on a replacement connection. At that point the pool has
+        // no connected clients and is not busy, but it still has pending work.
+        // Closing it here lets the replacement Client finish those requests
+        // and then destroys that new connection with ClientDestroyedError.
+        if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
           return
         }
 
diff --git a/deps/undici/src/lib/dispatcher/balanced-pool.js b/deps/undici/src/lib/dispatcher/balanced-pool.js
index ca14bf6ed1d5..dbd9ebc8a552 100644
--- a/deps/undici/src/lib/dispatcher/balanced-pool.js
+++ b/deps/undici/src/lib/dispatcher/balanced-pool.js
@@ -13,7 +13,7 @@ const {
   kGetDispatcher
 } = require('./pool-base')
 const Pool = require('./pool')
-const { kUrl } = require('../core/symbols')
+const { kOriginless, kUrl } = require('../core/symbols')
 const util = require('../core/util')
 const kFactory = Symbol('factory')
 
@@ -49,14 +49,17 @@ function defaultFactory (origin, opts) {
 }
 
 class BalancedPool extends PoolBase {
-  constructor (upstreams = [], { factory = defaultFactory, ...opts } = {}) {
+  constructor (upstreams = [], { factory = defaultFactory, connect, tls, ...opts } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
 
-    super()
+    super(opts)
 
-    this[kOptions] = { ...util.deepClone(opts) }
+    this[kOriginless] = true
+    if (connect && typeof connect !== 'function') connect = { ...connect }
+    if (tls && typeof tls !== 'function') tls = { ...tls }
+    this[kOptions] = { ...util.deepClone(opts), connect, tls }
     this[kIndex] = -1
     this[kCurrentWeight] = 0
 
diff --git a/deps/undici/src/lib/dispatcher/client-h1.js b/deps/undici/src/lib/dispatcher/client-h1.js
index 9f6f17c1579b..f06ca74bfe53 100644
--- a/deps/undici/src/lib/dispatcher/client-h1.js
+++ b/deps/undici/src/lib/dispatcher/client-h1.js
@@ -1052,7 +1052,7 @@ function onSocketClose () {
 
 function clearIdleSocketValidation (socket) {
   if (socket[kIdleSocketValidationTimeout]) {
-    clearTimeout(socket[kIdleSocketValidationTimeout])
+    clearImmediate(socket[kIdleSocketValidationTimeout])
     socket[kIdleSocketValidationTimeout] = null
   }
 
@@ -1061,15 +1061,23 @@ function clearIdleSocketValidation (socket) {
 
 function scheduleIdleSocketValidation (client, socket) {
   socket[kIdleSocketValidation] = 1
-  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+  // Yield to the check phase (after poll) so unsolicited bytes / FIN / RST
+  // already pending on this idle keep-alive socket are processed before the
+  // next request is written (GHSA-35p6-xmwp-9g52).
+  //
+  // setTimeout(0) pays Node's ~1ms timer floor on every sequential reuse
+  // (#5493). setImmediate avoids that, but an *unref'd* Immediate lets poll
+  // block for ~500ms when the event loop is otherwise idle (#5600 / #5606).
+  // A ref'd Immediate both keeps the pending request alive and makes poll
+  // return immediately — the hybrid those issues asked for.
+  socket[kIdleSocketValidationTimeout] = setImmediate(() => {
     socket[kIdleSocketValidationTimeout] = null
     socket[kIdleSocketValidation] = 2
 
     if (client[kSocket] === socket && !socket.destroyed) {
       client[kResume]()
     }
-  }, 0)
-  socket[kIdleSocketValidationTimeout].unref?.()
+  })
 }
 
 /**
diff --git a/deps/undici/src/lib/dispatcher/client-h2.js b/deps/undici/src/lib/dispatcher/client-h2.js
index bc401008f004..55179000ebaf 100644
--- a/deps/undici/src/lib/dispatcher/client-h2.js
+++ b/deps/undici/src/lib/dispatcher/client-h2.js
@@ -10,7 +10,8 @@ const {
   InformationalError,
   InvalidArgumentError,
   HeadersTimeoutError,
-  BodyTimeoutError
+  BodyTimeoutError,
+  ResponseExceededMaxSizeError
 } = require('../core/errors.js')
 const {
   kUrl,
@@ -39,7 +40,8 @@ const {
   kRemoteSettings,
   kHTTP2Stream,
   kHTTP2SessionState,
-  kHTTP2Options
+  kHTTP2Options,
+  kMaxResponseSize
 } = require('../core/symbols.js')
 const { channels } = require('../core/diagnostics.js')
 
@@ -1022,9 +1024,11 @@ function writeH2 (client, request) {
   const state = {
     abort: null,
     body: request.body,
+    bytesRead: 0,
     client,
     contentLength: null,
     expectsPayload: false,
+    maxResponseSize: client[kMaxResponseSize],
     request,
     headersTimeout,
     bodyTimeout,
@@ -1260,6 +1264,7 @@ function writeH2 (client, request) {
   // become unreachable once the stream closes, so plain `on` avoids the
   // per-listener `once` wrapper allocation.
   stream.on('response', onResponse)
+  stream.on('headers', onInterimResponse)
   stream.on('end', onEnd)
   stream.on('error', onError)
   stream.on('frameError', onFrameError)
@@ -1280,6 +1285,7 @@ function removeRequestStreamListeners (stream) {
   stream.off('error', noop)
   stream.off('continue', writeBodyH2)
   stream.off('response', onResponse)
+  stream.off('headers', onInterimResponse)
   stream.off('end', onEnd)
   stream.off('error', onError)
   stream.off('frameError', onFrameError)
@@ -1322,17 +1328,51 @@ function onData (chunk) {
     return
   }
 
-  const { request } = state
+  const { request, maxResponseSize } = state
 
   if (request.aborted || request.completed) {
     return
   }
 
+  if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+    // Unlike HTTP/1.1, which destroys the socket because it cannot abandon one
+    // response without losing framing, resetting the offending stream leaves
+    // the session usable for its siblings.
+    state.abort(new ResponseExceededMaxSizeError())
+    return
+  }
+
+  state.bytesRead += chunk.length
+
   if (request.onResponseData(chunk) === false) {
     stream.pause()
   }
 }
 
+function onInterimResponse (headers) {
+  const stream = this
+  const state = stream[kRequestStreamState]
+
+  if (state == null) {
+    return
+  }
+
+  const { request } = state
+
+  if (request.aborted || request.completed) {
+    return
+  }
+
+  // node http2 emits 'headers' for interim (1xx) informational responses,
+  // while the final response arrives via 'response'. Forward these to the
+  // handler so that onInfo is invoked, matching the HTTP/1 behaviour and the
+  // documented onInfo contract.
+  const statusCode = headers[HTTP2_HEADER_STATUS]
+  delete headers[HTTP2_HEADER_STATUS]
+
+  request.onResponseStart(Number(statusCode), headers, noop, '')
+}
+
 function onResponse (headers) {
   const stream = this
   const state = stream[kRequestStreamState]
diff --git a/deps/undici/src/lib/dispatcher/client.js b/deps/undici/src/lib/dispatcher/client.js
index d620e8310cfb..ec81541f9a59 100644
--- a/deps/undici/src/lib/dispatcher/client.js
+++ b/deps/undici/src/lib/dispatcher/client.js
@@ -137,7 +137,8 @@ class Client extends DispatcherBase {
     connectionWindowSize,
     pingInterval,
     webSocket,
-    h2Options
+    h2Options,
+    eventSource
   } = {}) {
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -276,7 +277,7 @@ class Client extends DispatcherBase {
       }
     }
 
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (typeof connect !== 'function') {
       connect = buildConnector({
diff --git a/deps/undici/src/lib/dispatcher/dispatcher-base.js b/deps/undici/src/lib/dispatcher/dispatcher-base.js
index 21b5e346acad..d9d15d6441a9 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher-base.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher-base.js
@@ -1,5 +1,6 @@
 'use strict'
 
+const buffer = require('node:buffer')
 const Dispatcher = require('./dispatcher')
 const {
   ClientDestroyedError,
@@ -11,6 +12,7 @@ const { kDestroy, kClose, kClosed, kDestroyed, kDispatch } = require('../core/sy
 const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   /** @type {boolean} */
@@ -31,10 +33,11 @@ class DispatcherBase extends Dispatcher {
   constructor (opts) {
     super()
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   /**
-   * @returns {import('../../types/dispatcher').WebSocketOptions}
+   * @returns {import('../../types/client').Client.WebSocketOptions}
    */
   get webSocketOptions () {
     return {
@@ -43,6 +46,15 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  /**
+   * @returns {import('../../types/client').Client.EventSourceOptions}
+   */
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   /** @returns {boolean} */
   get destroyed () {
     return this[kDestroyed]
diff --git a/deps/undici/src/lib/dispatcher/dispatcher.js b/deps/undici/src/lib/dispatcher/dispatcher.js
index ecff2a9b1685..11a7ab2b4476 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher.js
@@ -1,5 +1,6 @@
 'use strict'
 const EventEmitter = require('node:events')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class Dispatcher extends EventEmitter {
   dispatch () {
@@ -17,6 +18,10 @@ class Dispatcher extends EventEmitter {
   compose (...args) {
     // So we handle [interceptor1, interceptor2] or interceptor1, interceptor2, ...
     const interceptors = Array.isArray(args[0]) ? args[0] : args
+    // null disables origin-dependent interceptors; undefined uses opts.origin.
+    const interceptorOrigin = this[kOriginless] === true
+      ? null
+      : this[kUrl]?.origin
     let dispatch = this.dispatch.bind(this)
 
     for (const interceptor of interceptors) {
@@ -28,13 +33,22 @@ class Dispatcher extends EventEmitter {
         throw new TypeError(`invalid interceptor, expected function received ${typeof interceptor}`)
       }
 
-      dispatch = interceptor(dispatch)
+      dispatch = interceptor(dispatch, interceptorOrigin)
 
       if (dispatch == null || typeof dispatch !== 'function' || dispatch.length !== 2) {
         throw new TypeError('invalid interceptor')
       }
     }
 
+    const originalDispatch = dispatch
+    const self = this
+    dispatch = function (opts, handler) {
+      if (opts && typeof opts === 'object' && !opts.origin && self[kUrl]) {
+        opts = Object.assign({}, opts, { origin: self[kUrl].origin })
+      }
+      return originalDispatch(opts, handler)
+    }
+
     return new Proxy(this, {
       get: (target, key) => key === 'dispatch' ? dispatch : target[key]
     })
diff --git a/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js b/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
index f5813288cb33..e206984d5a47 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
@@ -3,6 +3,7 @@
 const Dispatcher = require('./dispatcher')
 const { InvalidArgumentError } = require('../core/errors')
 const { toRawHeaders } = require('../core/util')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class LegacyHandlerWrapper {
   #handler
@@ -71,6 +72,8 @@ class Dispatcher1Wrapper extends Dispatcher {
     }
 
     this.#dispatcher = dispatcher
+    this[kUrl] = dispatcher[kUrl]
+    this[kOriginless] = dispatcher[kOriginless]
   }
 
   static wrapHandler (handler) {
diff --git a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
index 51c50601714b..5d943dbd250e 100644
--- a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
@@ -16,7 +16,7 @@ class EnvHttpProxyAgent extends DispatcherBase {
   #opts = null
 
   constructor (opts = {}) {
-    super()
+    super(opts)
     this.#opts = opts
 
     const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts
@@ -69,6 +69,13 @@ class EnvHttpProxyAgent extends DispatcherBase {
     // brackets from IPv6 literals (e.g. "[::1]" -> "::1") so that the
     // result matches the unbracketed form stored by #parseNoProxy.
     hostname = hostname.replace(/:\d*$/, '').replace(/^\[(.+)\]$/, '$1').toLowerCase()
+    // Drop a trailing dot: it only marks the fully qualified form of a domain
+    // name ("example.com." and "example.com" are the same name, RFC 1034 root
+    // label). This runs on every dispatch, so it is a charCode check rather
+    // than a third regex. `length > 1` leaves the degenerate host "." alone.
+    if (hostname.length > 1 && hostname.charCodeAt(hostname.length - 1) === 46) {
+      hostname = hostname.slice(0, -1)
+    }
     port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0
     if (!this.#shouldProxy(hostname, port)) {
       return this[kNoProxyAgent]
@@ -143,8 +150,8 @@ class EnvHttpProxyAgent extends DispatcherBase {
       }
 
       noProxyEntries.push({
-        // strip leading dot or asterisk with dot
-        hostname: hostname.replace(/^\*?\./, '').toLowerCase(),
+        // strip leading dot or asterisk with dot, and any trailing dot
+        hostname: hostname.replace(/^\*?\./, '').replace(/^(.+)\.$/, '$1').toLowerCase(),
         port
       })
     }
diff --git a/deps/undici/src/lib/dispatcher/proxy-agent.js b/deps/undici/src/lib/dispatcher/proxy-agent.js
index 0b07b2fe8fe0..2b118581eec8 100644
--- a/deps/undici/src/lib/dispatcher/proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/proxy-agent.js
@@ -9,6 +9,7 @@ const buildConnector = require('../core/connect')
 const Client = require('./client')
 const { channels } = require('../core/diagnostics')
 const Socks5ProxyAgent = require('./socks5-proxy-agent')
+const { hasSafeIterator } = require('../core/util')
 
 const kAgent = Symbol('proxy agent')
 const kClient = Symbol('proxy client')
@@ -120,7 +121,7 @@ class ProxyAgent extends DispatcherBase {
 
     const { proxyTunnel, connectTimeout } = opts
 
-    super()
+    super(opts)
 
     const url = this.#getUrl(opts)
     const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url
@@ -161,6 +162,7 @@ class ProxyAgent extends DispatcherBase {
           factory: agentFactory,
           username: opts.username || username,
           password: opts.password || password,
+          connectTimeout,
           proxyTls: opts.proxyTls,
           requestTls: opts.requestTls
         })
@@ -344,6 +346,21 @@ function buildHeaders (headers) {
     return headersPair
   }
 
+  // Materialize iterable header containers (e.g. Map, Headers) into a record so
+  // that throwIfProxyAuthIsSent() can inspect their entries. Object.keys and
+  // for...in see nothing on a Map/Headers instance, so without this the
+  // Proxy-Authorization guard is bypassed and proxy credentials can reach the
+  // origin server (GHSA-6cv7-626c-qhqw).
+  if (headers && typeof headers === 'object' && hasSafeIterator(headers)) {
+    const headersPair = {}
+
+    for (const [key, value] of headers) {
+      headersPair[key] = value
+    }
+
+    return headersPair
+  }
+
   return headers
 }
 
diff --git a/deps/undici/src/lib/dispatcher/retry-agent.js b/deps/undici/src/lib/dispatcher/retry-agent.js
index 0c2120d6f26a..0b50f22a3181 100644
--- a/deps/undici/src/lib/dispatcher/retry-agent.js
+++ b/deps/undici/src/lib/dispatcher/retry-agent.js
@@ -2,6 +2,7 @@
 
 const Dispatcher = require('./dispatcher')
 const RetryHandler = require('../handler/retry-handler')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class RetryAgent extends Dispatcher {
   #agent = null
@@ -10,6 +11,8 @@ class RetryAgent extends Dispatcher {
     super(options)
     this.#agent = agent
     this.#options = options
+    this[kUrl] = agent[kUrl]
+    this[kOriginless] = agent[kOriginless]
   }
 
   dispatch (opts, handler) {
diff --git a/deps/undici/src/lib/dispatcher/round-robin-pool.js b/deps/undici/src/lib/dispatcher/round-robin-pool.js
index b1f4763530f5..1db82a9ccb3b 100644
--- a/deps/undici/src/lib/dispatcher/round-robin-pool.js
+++ b/deps/undici/src/lib/dispatcher/round-robin-pool.js
@@ -65,7 +65,7 @@ class RoundRobinPool extends PoolBase {
       })
     }
 
-    super()
+    super(options)
 
     this[kConnections] = connections || null
     this[kUrl] = util.parseOrigin(origin)
diff --git a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
index 909c7f502478..e380005ffb61 100644
--- a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
@@ -4,22 +4,33 @@ const { URL } = require('node:url')
 
 let tls // include tls conditionally since it is not always available
 const DispatcherBase = require('./dispatcher-base')
-const { InvalidArgumentError } = require('../core/errors')
+const { ConnectTimeoutError, InvalidArgumentError } = require('../core/errors')
 const { Socks5Client, STATES } = require('../core/socks5-client')
 const { kBusy, kConnected, kDispatch, kClose, kDestroy } = require('../core/symbols')
 const Pool = require('./pool')
 const buildConnector = require('../core/connect')
+const { setupConnectTimeout } = require('../core/util')
 const { debuglog } = require('node:util')
 
 const debug = debuglog('undici:socks5-proxy')
 
+const DEFAULT_SOCKS5_CONNECT_TIMEOUT = 5000
+
 const kProxyUrl = Symbol('proxy url')
 const kProxyHeaders = Symbol('proxy headers')
 const kProxyAuth = Symbol('proxy auth')
 const kProxyProtocol = Symbol('proxy protocol')
 const kPools = Symbol('pools')
 const kConnector = Symbol('connector')
+const kConnectTimeout = Symbol('connect timeout')
 const kRequestTls = Symbol('request tls settings')
+const kRequestTlsTimeout = Symbol('request tls timeout')
+
+function createConnectTimeoutError (hostname, port, timeout) {
+  return new ConnectTimeoutError(
+    `Connect Timeout Error (attempted address: ${hostname}:${port}, timeout: ${timeout}ms)`
+  )
+}
 
 // Static flag to ensure warning is only emitted once per process
 let experimentalWarningEmitted = false
@@ -29,7 +40,7 @@ let experimentalWarningEmitted = false
  */
 class Socks5ProxyAgent extends DispatcherBase {
   constructor (proxyUrl, options = {}) {
-    super()
+    super(options)
 
     // Emit experimental warning only once
     if (!experimentalWarningEmitted) {
@@ -54,7 +65,20 @@ class Socks5ProxyAgent extends DispatcherBase {
     this[kProxyUrl] = url
     this[kProxyHeaders] = options.headers || {}
     this[kProxyProtocol] = options.proxyTls ? 'https:' : 'http:'
-    this[kRequestTls] = options.requestTls
+
+    const connectTimeout = options.connectTimeout ?? DEFAULT_SOCKS5_CONNECT_TIMEOUT
+    if (!Number.isFinite(connectTimeout) || connectTimeout < 0) {
+      throw new InvalidArgumentError('invalid connectTimeout')
+    }
+    this[kConnectTimeout] = connectTimeout
+
+    const { timeout, ...requestTls } = options.requestTls || {}
+    const requestTlsTimeout = timeout ?? connectTimeout
+    if (!Number.isFinite(requestTlsTimeout) || requestTlsTimeout < 0) {
+      throw new InvalidArgumentError('invalid requestTls.timeout')
+    }
+    this[kRequestTls] = requestTls
+    this[kRequestTlsTimeout] = requestTlsTimeout
 
     // Extract auth from URL or options
     this[kProxyAuth] = {
@@ -63,8 +87,13 @@ class Socks5ProxyAgent extends DispatcherBase {
     }
 
     // Create connector for proxy connection
+    const proxyTlsTimeout = options.proxyTls?.timeout ?? connectTimeout
+    if (!Number.isFinite(proxyTlsTimeout) || proxyTlsTimeout < 0) {
+      throw new InvalidArgumentError('invalid proxyTls.timeout')
+    }
     this[kConnector] = options.connect || buildConnector({
       ...options.proxyTls,
+      timeout: proxyTlsTimeout,
       servername: options.proxyTls?.servername || url.hostname
     })
 
@@ -113,20 +142,29 @@ class Socks5ProxyAgent extends DispatcherBase {
 
     // Wait for authentication (if required)
     const authenticationReady = Promise.withResolvers()
-
-    const authenticationTimeout = setTimeout(() => {
-      authenticationReady.reject(new Error('SOCKS5 authentication timeout'))
-    }, 5000)
-
-    const onAuthenticated = () => {
+    const authenticationTimeout = this[kConnectTimeout] === 0
+      ? null
+      : setTimeout(() => {
+        cleanupAuthenticationListeners()
+        socks5Client.destroy()
+        authenticationReady.reject(
+          createConnectTimeoutError(proxyHost, proxyPort, this[kConnectTimeout])
+        )
+      }, this[kConnectTimeout])
+
+    const cleanupAuthenticationListeners = () => {
       clearTimeout(authenticationTimeout)
+      socks5Client.removeListener('authenticated', onAuthenticated)
       socks5Client.removeListener('error', onAuthenticationError)
+    }
+
+    const onAuthenticated = () => {
+      cleanupAuthenticationListeners()
       authenticationReady.resolve()
     }
 
     const onAuthenticationError = (err) => {
-      clearTimeout(authenticationTimeout)
-      socks5Client.removeListener('authenticated', onAuthenticated)
+      cleanupAuthenticationListeners()
       authenticationReady.reject(err)
     }
 
@@ -146,21 +184,30 @@ class Socks5ProxyAgent extends DispatcherBase {
 
     // Wait for connection
     const connectionReady = Promise.withResolvers()
-
-    const connectionTimeout = setTimeout(() => {
-      connectionReady.reject(new Error('SOCKS5 connection timeout'))
-    }, 5000)
+    const connectionTimeout = this[kConnectTimeout] === 0
+      ? null
+      : setTimeout(() => {
+        cleanupConnectionListeners()
+        socks5Client.destroy()
+        connectionReady.reject(
+          createConnectTimeoutError(targetHost, targetPort, this[kConnectTimeout])
+        )
+      }, this[kConnectTimeout])
+
+    const cleanupConnectionListeners = () => {
+      clearTimeout(connectionTimeout)
+      socks5Client.removeListener('connected', onConnected)
+      socks5Client.removeListener('error', onConnectionError)
+    }
 
     const onConnected = (info) => {
       debug('SOCKS5 tunnel established to', targetHost, targetPort, 'via', info)
-      clearTimeout(connectionTimeout)
-      socks5Client.removeListener('error', onConnectionError)
+      cleanupConnectionListeners()
       connectionReady.resolve()
     }
 
     const onConnectionError = (err) => {
-      clearTimeout(connectionTimeout)
-      socks5Client.removeListener('connected', onConnected)
+      cleanupConnectionListeners()
       connectionReady.reject(err)
     }
 
@@ -213,8 +260,31 @@ class Socks5ProxyAgent extends DispatcherBase {
                 })
 
                 const tlsReady = Promise.withResolvers()
-                finalSocket.once('secureConnect', tlsReady.resolve)
-                finalSocket.once('error', tlsReady.reject)
+
+                const cleanupTlsListeners = () => {
+                  queueMicrotask(clearTlsTimeout)
+                  finalSocket.removeListener('secureConnect', onSecureConnect)
+                  finalSocket.removeListener('error', onTlsError)
+                }
+
+                const onSecureConnect = () => {
+                  cleanupTlsListeners()
+                  tlsReady.resolve()
+                }
+
+                const onTlsError = (err) => {
+                  cleanupTlsListeners()
+                  tlsReady.reject(err)
+                }
+
+                const clearTlsTimeout = setupConnectTimeout(new WeakRef(finalSocket), {
+                  timeout: this[kRequestTlsTimeout],
+                  hostname: targetHost,
+                  port: targetPort
+                })
+
+                finalSocket.once('secureConnect', onSecureConnect)
+                finalSocket.once('error', onTlsError)
                 await tlsReady.promise
               }
 
diff --git a/deps/undici/src/lib/handler/cache-handler.js b/deps/undici/src/lib/handler/cache-handler.js
index bdfc0d94a433..2ec550b431ad 100644
--- a/deps/undici/src/lib/handler/cache-handler.js
+++ b/deps/undici/src/lib/handler/cache-handler.js
@@ -173,6 +173,14 @@ class CacheHandler {
     this.#handler.onRequestStart?.(controller, context)
   }
 
+  onBodySent (chunk) {
+    this.#handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.#handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (controller, statusCode, headers, socket) {
     this.#handler.onRequestUpgrade?.(controller, statusCode, headers, socket)
   }
@@ -210,6 +218,13 @@ class CacheHandler {
     }
 
     const cacheControlHeader = resHeaders['cache-control']
+    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
+
+    if (revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives)) {
+      deleteCachedValue(this.#store, this.#cacheKey)
+      return downstreamOnHeaders()
+    }
+
     const heuristicallyCacheable = resHeaders['last-modified'] && arrayIncludes(HEURISTICALLY_CACHEABLE_STATUS_CODES, statusCode)
     if (
       !cacheControlHeader &&
@@ -226,8 +241,7 @@ class CacheHandler {
       return downstreamOnHeaders()
     }
 
-    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
-    if (!canCacheResponse(this.#cacheType, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
+    if (!canCacheResponse(this.#cacheType, this.#cacheKey.method, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
       if (statusCode === 304 && (cacheControlHeader || revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives))) {
         deleteCachedValue(this.#store, this.#cacheKey)
       }
@@ -476,7 +490,10 @@ function deleteCachedValueIfNotModified (statusCode, store, cacheKey) {
  */
 function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheControlDirectives) {
   return cacheControlDirectives['no-store'] === true ||
-    (cacheType === 'shared' && cacheControlDirectives.private === true) ||
+    (cacheType === 'shared' && (
+      cacheControlDirectives.private === true ||
+      Object.hasOwn(resHeaders, 'set-cookie')
+    )) ||
     (resHeaders.vary ? isInvalidOrWildcardVaryHeader(resHeaders.vary) : false)
 }
 
@@ -484,12 +501,16 @@ function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheC
  * @see https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-to-authen
  *
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+ * @param {string} method
  * @param {number} statusCode
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} resHeaders
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives} cacheControlDirectives
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} [reqHeaders]
  */
-function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+function canCacheResponse (cacheType, method, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+  if (!arrayIncludes(util.safeHTTPMethods, method)) {
+    return false
+  }
   // Status code must be final and understood.
   if (statusCode < 200 || arrayIncludes(NOT_UNDERSTOOD_STATUS_CODES, statusCode)) {
     return false
@@ -510,7 +531,10 @@ function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirect
     return false
   }
 
-  if (cacheType === 'shared' && cacheControlDirectives.private === true) {
+  if (cacheType === 'shared' && (
+    cacheControlDirectives.private === true ||
+    Object.hasOwn(resHeaders, 'set-cookie')
+  )) {
     return false
   }
 
diff --git a/deps/undici/src/lib/handler/decorator-handler.js b/deps/undici/src/lib/handler/decorator-handler.js
index 1b53c711324a..bc99893cda0b 100644
--- a/deps/undici/src/lib/handler/decorator-handler.js
+++ b/deps/undici/src/lib/handler/decorator-handler.js
@@ -62,5 +62,11 @@ module.exports = class DecoratorHandler {
   /**
    * @deprecated
    */
-  onBodySent () {}
+  onBodySent (...args) {
+    return this.#handler.onBodySent?.(...args)
+  }
+
+  onRequestSent (...args) {
+    return this.#handler.onRequestSent?.(...args)
+  }
 }
diff --git a/deps/undici/src/lib/handler/deduplication-handler.js b/deps/undici/src/lib/handler/deduplication-handler.js
index 537c4f70e974..4d85e9cde3bf 100644
--- a/deps/undici/src/lib/handler/deduplication-handler.js
+++ b/deps/undici/src/lib/handler/deduplication-handler.js
@@ -365,12 +365,22 @@ class DeduplicationHandler {
       get aborted () { return state.aborted },
       get reason () { return state.reason },
       abort: (reason) => {
+        if (state.aborted) {
+          return
+        }
+
         state.aborted = true
         state.reason = reason ?? null
         waitingHandler.done = true
         waitingHandler.pendingTrailers = null
         waitingHandler.bufferedChunks = []
         waitingHandler.bufferedBytes = 0
+
+        try {
+          handler.onResponseError?.(waitingHandler.controller, state.reason ?? new RequestAbortedError())
+        } catch {
+          // Ignore errors from waiting handlers
+        }
       }
     }
 
@@ -444,12 +454,8 @@ class DeduplicationHandler {
     waitingHandler.bufferedChunks = []
     waitingHandler.bufferedBytes = 0
 
-    try {
-      waitingHandler.controller.abort(err)
-      waitingHandler.handler.onResponseError?.(waitingHandler.controller, err)
-    } catch {
-      // Ignore errors from waiting handlers
-    }
+    // controller.abort(err) notifies the handler via onResponseError
+    waitingHandler.controller.abort(err)
   }
 
   #pruneDoneWaitingHandlers () {
diff --git a/deps/undici/src/lib/handler/redirect-handler.js b/deps/undici/src/lib/handler/redirect-handler.js
index 1b813dac98b9..a5d925086319 100644
--- a/deps/undici/src/lib/handler/redirect-handler.js
+++ b/deps/undici/src/lib/handler/redirect-handler.js
@@ -3,6 +3,7 @@
 const util = require('../core/util')
 const assert = require('node:assert')
 const { InvalidArgumentError } = require('../core/errors')
+const { kRequestOrigin } = require('../core/symbols')
 
 const redirectableStatusCodes = [300, 301, 302, 303, 307, 308]
 
@@ -43,6 +44,14 @@ class RedirectHandler {
     this.handler.onRequestStart?.(controller, { ...context, history: this.history })
   }
 
+  onBodySent (chunk) {
+    this.handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (controller, statusCode, headers, socket) {
     this.handler.onRequestUpgrade?.(controller, statusCode, headers, socket)
   }
@@ -81,8 +90,12 @@ class RedirectHandler {
       ? null
       : headers.location
 
-    if (this.opts.origin) {
-      this.history.push(new URL(this.opts.path, this.opts.origin))
+    const requestOrigin = this.opts[kRequestOrigin] === undefined
+      ? this.opts.origin
+      : this.opts[kRequestOrigin]
+
+    if (requestOrigin) {
+      this.history.push(new URL(this.opts.path, requestOrigin))
     }
 
     if (!this.location) {
@@ -90,7 +103,10 @@ class RedirectHandler {
       return
     }
 
-    const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)))
+    const baseUrl = requestOrigin
+      ? new URL(this.opts.path, requestOrigin)
+      : undefined
+    const { origin, pathname, search } = util.parseURL(new URL(this.location, baseUrl))
     const path = search ? `${pathname}${search}` : pathname
 
     // Check for redirect loops by seeing if we've already visited this URL in our history
@@ -106,9 +122,10 @@ class RedirectHandler {
     // Remove headers referring to the original URL.
     // By default it is Host only. A 303 or a 301/302 POST-to-GET redirect also removes all Content-* headers.
     // https://tools.ietf.org/html/rfc7231#section-6.4
-    this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, this.opts.origin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect)
+    this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, requestOrigin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect)
     this.opts.path = path
     this.opts.origin = origin
+    this.opts[kRequestOrigin] = origin
     this.opts.query = null
   }
 
diff --git a/deps/undici/src/lib/handler/retry-handler.js b/deps/undici/src/lib/handler/retry-handler.js
index c098b510c26c..5703f145d74c 100644
--- a/deps/undici/src/lib/handler/retry-handler.js
+++ b/deps/undici/src/lib/handler/retry-handler.js
@@ -2,7 +2,7 @@
 const assert = require('node:assert')
 
 const { kRetryHandlerDefaultRetry } = require('../core/symbols')
-const { RequestRetryError } = require('../core/errors')
+const { RequestRetryError, RequestAbortedError } = require('../core/errors')
 const {
   isDisturbed,
   parseRangeHeader,
@@ -41,19 +41,42 @@ function validatePartialResponseContentLength (headers, range, statusCode, retry
 // new one: backpressure pauses the new connection's controller, but the
 // consumer's resume() targets the old one, so the resumed body stalls forever.
 // The proxy always forwards to the controller of the currently active connection.
+// An abort is additionally reported to the handler so it can cancel a pending
+// retry backoff instead of letting the request hang until the backoff elapses.
+// The notification is a private callback the handler hands over on construction,
+// so nothing outside the handler can trigger it.
 class RetryController {
-  constructor () {
+  #onAbort
+
+  constructor (onAbort) {
+    this.#onAbort = onAbort
     this.target = null
   }
 
   pause () { this.target?.pause() }
   resume () { this.target?.resume() }
-  abort (reason) { this.target?.abort(reason) }
+
+  abort (reason) {
+    this.target?.abort(reason)
+    this.#onAbort(reason)
+  }
+
   get paused () { return this.target?.paused ?? false }
   get aborted () { return this.target?.aborted ?? false }
   get reason () { return this.target?.reason ?? null }
   get rawHeaders () { return this.target?.rawHeaders ?? null }
+  set rawHeaders (value) {
+    if (this.target) {
+      this.target.rawHeaders = value
+    }
+  }
+
   get rawTrailers () { return this.target?.rawTrailers ?? null }
+  set rawTrailers (value) {
+    if (this.target) {
+      this.target.rawTrailers = value
+    }
+  }
 }
 
 class RetryHandler {
@@ -112,15 +135,32 @@ class RetryHandler {
     this.etag = null
     this.statusCode = null
     this.headers = null
-    this.controllerProxy = new RetryController()
+    this.controllerProxy = new RetryController(reason => this.#onAbort(reason))
+    // A retry decision is in flight (the policy may be holding a backoff
+    // timer). While pending, a consumer abort cancels the wait.
+    this.retryPending = false
+    // Backoff timer returned by the retry policy, so #onAbort can cancel it.
+    // Null for custom policies that do not return their timer.
+    this.retryTimer = null
+    // Set once an abort during the backoff delivered the terminal error
+    // downstream; late policy callbacks and connection errors are then moot.
+    this.aborted = false
   }
 
   onResponseStartWithRetry (controller, statusCode, headers, statusMessage, err) {
     if (this.retryOpts.throwOnError) {
       // Preserve old behavior for status codes that are not eligible for retry
       if (this.retryOpts.statusCodes.includes(statusCode) === false) {
-        this.headersSent = true
-        this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        if (this.headersSent) {
+          // The downstream handler already received the response from an
+          // earlier attempt. Forwarding this response would replace the
+          // downstream body and leave the original body pending forever.
+          this.handler.onResponseError?.(this.controllerProxy, err)
+        } else {
+          this.headersSent = true
+          this.checkpointResponseEnd(headers)
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        }
       } else {
         this.error = err
       }
@@ -130,14 +170,30 @@ class RetryHandler {
 
     if (isDisturbed(this.opts.body)) {
       this.headersSent = true
+      this.checkpointResponseEnd(headers)
       this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
       return
     }
 
     function shouldRetry (passedErr) {
+      if (this.aborted) {
+        // Aborted while the policy was deciding; the decision is moot.
+        return
+      }
+      this.retryPending = false
+      this.retryTimer = null
+
       if (passedErr) {
-        this.headersSent = true
-        this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        if (this.headersSent) {
+          // The downstream handler already received the response from an
+          // earlier attempt. Forwarding this response would replace the
+          // downstream body and leave the original body pending forever.
+          this.handler.onResponseError?.(this.controllerProxy, passedErr)
+        } else {
+          this.headersSent = true
+          this.checkpointResponseEnd(headers)
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        }
         controller.resume()
         return
       }
@@ -154,14 +210,31 @@ class RetryHandler {
     // between, leaving this one paused forever -- the very stall the proxy exists
     // to prevent.
     controller.pause()
-    this.retryOpts.retry(
+    // The default policy returns its backoff timer so an abort can cancel it;
+    // a custom policy may return anything (or nothing), which is ignored.
+    this.retryPending = true
+    this.retryTimer = this.retryOpts.retry(
       err,
       {
         state: { counter: this.retryCount },
         opts: { retryOptions: this.retryOpts, ...this.opts }
       },
       shouldRetry.bind(this)
-    )
+    ) ?? null
+  }
+
+  checkpointResponseEnd (headers) {
+    if (this.end == null && this.opts.method !== 'HEAD') {
+      const contentLength = headers['content-length']
+      this.end = contentLength != null ? Number(contentLength) - 1 : null
+
+      assert(
+        this.end == null || Number.isFinite(this.end),
+        'invalid content-length'
+      )
+
+      this.resume = this.end != null
+    }
   }
 
   onRequestStart (controller, context) {
@@ -176,6 +249,14 @@ class RetryHandler {
     }
   }
 
+  onBodySent (chunk) {
+    this.handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (_controller, statusCode, headers, socket) {
     this.handler.onRequestUpgrade?.(this.controllerProxy, statusCode, headers, socket)
   }
@@ -190,7 +271,8 @@ class RetryHandler {
       timeoutFactor,
       statusCodes,
       errorCodes,
-      methods
+      methods,
+      retryAfter
     } = retryOptions
     const { counter } = state
 
@@ -222,7 +304,7 @@ class RetryHandler {
       return
     }
 
-    let retryAfterHeader = headers?.['retry-after']
+    let retryAfterHeader = retryAfter === false ? undefined : headers?.['retry-after']
     if (retryAfterHeader) {
       retryAfterHeader = Number(retryAfterHeader)
       retryAfterHeader = Number.isNaN(retryAfterHeader)
@@ -237,7 +319,9 @@ class RetryHandler {
           ? Math.min(retryAfterHeader, maxTimeout)
           : Math.min(minTimeout * timeoutFactor ** (counter - 1), maxTimeout)
 
-    setTimeout(() => cb(null), retryTimeout)
+    // Return the backoff timer so the handler can cancel it when the
+    // consumer aborts while the retry decision is pending.
+    return setTimeout(() => cb(null), retryTimeout)
   }
 
   onResponseStart (controller, statusCode, headers, statusMessage) {
@@ -251,18 +335,6 @@ class RetryHandler {
     this.statusCode = statusCode
     this.headers = headers
 
-    if (statusCode >= 300) {
-      const err = new RequestRetryError('Request failed', statusCode, {
-        headers,
-        data: {
-          count: this.retryCount
-        }
-      })
-
-      this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err)
-      return
-    }
-
     // Checkpoint for resume from where we left it
     if (this.headersSent) {
       // Only Partial Content 206 supposed to provide Content-Range,
@@ -299,12 +371,28 @@ class RetryHandler {
 
       const { start, size, end = size ? size - 1 : null } = contentRange
 
-      assert(this.start === start, 'content-range mismatch')
-      assert(this.end == null || this.end === end, 'content-range mismatch')
+      if (this.start !== start || (this.end != null && this.end !== end)) {
+        throw new RequestRetryError('Content-Range mismatch', statusCode, {
+          headers,
+          data: { count: this.retryCount }
+        })
+      }
 
       return
     }
 
+    if (statusCode >= 300) {
+      const err = new RequestRetryError('Request failed', statusCode, {
+        headers,
+        data: {
+          count: this.retryCount
+        }
+      })
+
+      this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err)
+      return
+    }
+
     if (this.end == null) {
       if (statusCode === 206) {
         // First time we receive 206
@@ -435,14 +523,27 @@ class RetryHandler {
   }
 
   onResponseError (controller, err) {
+    if (this.aborted) {
+      // #onAbort already delivered the terminal error downstream; the late
+      // error of the torn-down connection must not be forwarded twice.
+      return
+    }
+
     // controller is THIS failed connection (not the proxy): we inspect whether
     // the consumer aborted it to decide retry-vs-propagate.
-    if (controller?.aborted || isDisturbed(this.opts.body)) {
+    if (controller?.aborted || isDisturbed(this.opts.body) || (this.headersSent && !this.resume)) {
       this.handler.onResponseError?.(this.controllerProxy, err)
       return
     }
 
     function shouldRetry (returnedErr) {
+      if (this.aborted) {
+        // Aborted while the policy was deciding; the decision is moot.
+        return
+      }
+      this.retryPending = false
+      this.retryTimer = null
+
       if (!returnedErr) {
         this.retry()
         return
@@ -462,14 +563,31 @@ class RetryHandler {
       this.retryCount += 1
     }
 
-    this.retryOpts.retry(
+    this.retryPending = true
+    this.retryTimer = this.retryOpts.retry(
       err,
       {
         state: { counter: this.retryCount },
         opts: { retryOptions: this.retryOpts, ...this.opts }
       },
       shouldRetry.bind(this)
-    )
+    ) ?? null
+  }
+
+  #onAbort (reason) {
+    // A consumer abort lands on the controller proxy. If the retry policy is
+    // still deciding (typically holding a backoff timer), cancel the wait and
+    // surface the abort immediately instead of letting the request hang until
+    // the backoff elapses.
+    if (!this.retryPending) {
+      return
+    }
+
+    this.aborted = true
+    this.retryPending = false
+    clearTimeout(this.retryTimer)
+    this.retryTimer = null
+    this.handler.onResponseError?.(this.controllerProxy, reason ?? new RequestAbortedError())
   }
 }
 
diff --git a/deps/undici/src/lib/interceptor/cache.js b/deps/undici/src/lib/interceptor/cache.js
index 2d7d01f130aa..0b8593f7ee6d 100644
--- a/deps/undici/src/lib/interceptor/cache.js
+++ b/deps/undici/src/lib/interceptor/cache.js
@@ -6,7 +6,16 @@ const util = require('../core/util')
 const CacheHandler = require('../handler/cache-handler')
 const MemoryCacheStore = require('../cache/memory-cache-store')
 const CacheRevalidationHandler = require('../handler/cache-revalidation-handler')
-const { assertCacheStore, assertCacheMethods, makeCacheKey, normalizeHeaders, parseCacheControlHeader, isInvalidOrWildcardVaryHeader } = require('../util/cache.js')
+const {
+  assertCacheStore,
+  assertCacheMethods,
+  getInterceptorOrigin,
+  makeCacheKey,
+  normalizeHeaders,
+  parseCacheControlHeader,
+  isInvalidOrWildcardVaryHeader,
+  parseVaryHeader
+} = require('../util/cache.js')
 const { AbortError } = require('../core/errors.js')
 const { parseHttpDate } = require('../util/date.js')
 
@@ -117,7 +126,10 @@ function staleResponseRequiresRevalidation (result, cacheType) {
  * @returns {boolean}
  */
 function revalidationResponseDisallowsCachedReuse (cacheType, headers) {
-  if (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) {
+  if (
+    (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) ||
+    (cacheType === 'shared' && Object.hasOwn(headers, 'set-cookie'))
+  ) {
     return true
   }
 
@@ -135,6 +147,25 @@ function revalidationResponseUpdatesCacheControl (headers) {
   return headers['cache-control'] !== undefined
 }
 
+/**
+ * @param {import('../../types/cache-interceptor.d.ts').default.GetResult} result
+ * @param {Record<string, string | string[] | null> | undefined} varyDirectives
+ * @returns {boolean}
+ */
+function revalidationResponseAddsVary (result, varyDirectives) {
+  if (!varyDirectives) {
+    return false
+  }
+
+  for (const key in varyDirectives) {
+    if (result.vary == null || !Object.hasOwn(result.vary, key)) {
+      return true
+    }
+  }
+
+  return false
+}
+
 function deleteCachedValue (store, cacheKey) {
   try {
     store.delete(cacheKey)?.catch?.(nop)
@@ -389,6 +420,17 @@ function handleResult (
     return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl)
   }
 
+  // Shared stores may outlive the Undici version that wrote them. Do not
+  // re-serve a Set-Cookie header from an existing shared-cache entry.
+  if (globalOpts.type === 'shared' && Object.hasOwn(result.headers, 'set-cookie')) {
+    if (util.isStream(result.body)) {
+      result.body.on('error', nop).destroy()
+    }
+
+    deleteCachedValue(globalOpts.store, cacheKey)
+    return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl)
+  }
+
   const now = Date.now()
   if (now > result.deleteAt) {
     // Response is expired, cache store shouldn't have given this to us
@@ -471,6 +513,13 @@ function handleResult (
 
               if (revalidationResponseUpdatesCacheControl(headers)) {
                 deleteCachedValue(globalOpts.store, cacheKey)
+              } else if (revalidationResponseAddsVary(result, headers.vary ? parseVaryHeader(headers.vary, opts.headers) : undefined)) {
+                if (util.isStream(result.body)) {
+                  result.body.on('error', nop).destroy()
+                }
+
+                deleteCachedValue(globalOpts.store, cacheKey)
+                return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
               }
             }
 
@@ -538,29 +587,28 @@ module.exports = (opts = {}) => {
     }
   }
 
-  return dispatch => {
+  return (dispatch, interceptorOrigin) => {
     return (opts, handler) => {
-      if (arrayIncludes(safeMethodsToNotCache, opts.method)) {
-        // Not a method we want to cache, skip
+      const requestOrigin = getInterceptorOrigin(opts, interceptorOrigin)
+      if (!requestOrigin || arrayIncludes(safeMethodsToNotCache, opts.method)) {
+        // We cannot safely cache without an authoritative origin, or this is
+        // not a method we want to cache.
         return dispatch(opts, handler)
       }
 
       // Check if origin is in whitelist
       if (origins !== undefined) {
-        if (!opts.origin) {
-          return dispatch(opts, handler)
-        }
-        const requestOrigin = opts.origin.toString().toLowerCase()
+        const normalizedRequestOrigin = requestOrigin.toString().toLowerCase()
         let isAllowed = false
 
         for (let i = 0; i < origins.length; i++) {
           const allowed = origins[i]
           if (typeof allowed === 'string') {
-            if (allowed.toLowerCase() === requestOrigin) {
+            if (allowed.toLowerCase() === normalizedRequestOrigin) {
               isAllowed = true
               break
             }
-          } else if (allowed.test(requestOrigin)) {
+          } else if (allowed.test(normalizedRequestOrigin)) {
             isAllowed = true
             break
           }
@@ -589,7 +637,12 @@ module.exports = (opts = {}) => {
       /**
        * @type {import('../../types/cache-interceptor.d.ts').default.CacheKey}
        */
-      const cacheKey = makeCacheKey(opts)
+      const cacheKey = makeCacheKey(opts, requestOrigin)
+
+      if (!arrayIncludes(util.safeHTTPMethods, opts.method)) {
+        return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
+      }
+
       const result = store.get(cacheKey)
 
       if (result && typeof result.then === 'function') {
diff --git a/deps/undici/src/lib/interceptor/decompress.js b/deps/undici/src/lib/interceptor/decompress.js
index c675de4197c3..a0e77a37c8c4 100644
--- a/deps/undici/src/lib/interceptor/decompress.js
+++ b/deps/undici/src/lib/interceptor/decompress.js
@@ -1,7 +1,8 @@
 'use strict'
 
 const { createInflate, createGunzip, createBrotliDecompress, createZstdDecompress } = require('node:zlib')
-const { pipeline } = require('node:stream')
+const { pipeline, Transform: TransformStream } = require('node:stream')
+const { InvalidArgumentError, ResponseExceededMaxSizeError } = require('../core/errors')
 const DecoratorHandler = require('../handler/decorator-handler')
 
 /** @typedef {import('node:stream').Transform} Transform */
@@ -20,6 +21,31 @@ const supportedEncodings = {
 }
 
 const defaultSkipStatusCodes = /** @type {const} */ ([204, 304])
+const defaultMaxSize = 64 * 1024 * 1024
+
+/**
+ * Limits the output of one stage in a decompression chain.
+ * @param {number} maxSize - Maximum output size in bytes
+ * @returns {Transform}
+ */
+function createMaxSizeLimiter (maxSize) {
+  let size = 0
+
+  return new TransformStream({
+    transform (chunk, _encoding, callback) {
+      const decompressedSize = size + chunk.length
+      if (decompressedSize > maxSize) {
+        callback(new ResponseExceededMaxSizeError(
+          `Decompressed response size (${decompressedSize}) exceeded maxSize (${maxSize})`
+        ))
+        return
+      }
+
+      size = decompressedSize
+      callback(null, chunk)
+    }
+  })
+}
 
 let warningEmitted = /** @type {boolean} */ (false)
 
@@ -27,6 +53,7 @@ let warningEmitted = /** @type {boolean} */ (false)
  * @typedef {Object} DecompressHandlerOptions
  * @property {number[]|Readonly<number[]>} [skipStatusCodes=[204, 304]] - List of status codes to skip decompression for
  * @property {boolean} [skipErrorResponses] - Whether to skip decompression for error responses (status codes >= 400)
+ * @property {number} [maxSize=67108864] - Maximum decompressed response size in bytes
  */
 
 class DecompressHandler extends DecoratorHandler {
@@ -38,11 +65,24 @@ class DecompressHandler extends DecoratorHandler {
   #skipStatusCodes
   /** @type {boolean} */
   #skipErrorResponses
+  /** @type {number} */
+  #maxSize
+  /** @type {number} */
+  #decompressedSize = 0
+  /** @type {boolean} */
+  #terminated = false
+  /** @type {boolean} */
+  #inputEnded = false
+
+  constructor (handler, { skipStatusCodes = defaultSkipStatusCodes, skipErrorResponses = true, maxSize = defaultMaxSize } = {}) {
+    if (!Number.isSafeInteger(maxSize) || maxSize < 1) {
+      throw new InvalidArgumentError('maxSize must be a positive integer')
+    }
 
-  constructor (handler, { skipStatusCodes = defaultSkipStatusCodes, skipErrorResponses = true } = {}) {
     super(handler)
     this.#skipStatusCodes = skipStatusCodes
     this.#skipErrorResponses = skipErrorResponses
+    this.#maxSize = maxSize
   }
 
   /**
@@ -62,7 +102,7 @@ class DecompressHandler extends DecoratorHandler {
    * Creates a chain of decompressors for multiple content encodings
    *
    * @param {string} encodings - Comma-separated list of content encodings
-   * @returns {Array<DecompressorStream>} - Array of decompressor streams
+   * @returns {Array<Transform>} - Array of decompressor and limiting streams
    * @throws {Error} - If the number of content-encodings exceeds the maximum allowed
    */
   #createDecompressionChain (encodings) {
@@ -90,7 +130,40 @@ class DecompressHandler extends DecoratorHandler {
       decompressors.push(supportedEncodings[encoding]())
     }
 
-    return decompressors
+    if (decompressors.length < 2) {
+      return decompressors
+    }
+
+    /** @type {Transform[]} */
+    const streams = []
+    for (let i = 0; i < decompressors.length; i++) {
+      streams.push(decompressors[i])
+      if (i < decompressors.length - 1) {
+        streams.push(createMaxSizeLimiter(this.#maxSize))
+      }
+    }
+
+    return streams
+  }
+
+  /**
+   * Stops decompression and reports an error.
+   * @param {Controller} controller - The controller to coordinate with
+   * @param {Error} error - The decompression error
+   * @returns {void}
+   */
+  #fail (controller, error) {
+    if (this.#terminated) {
+      return
+    }
+
+    if (this.#inputEnded) {
+      // The request is already marked complete once the compressed input ends,
+      // so controller.abort() can no longer propagate decoder flush errors.
+      this.onResponseError(controller, error)
+    } else {
+      controller.abort(error)
+    }
   }
 
   /**
@@ -101,8 +174,21 @@ class DecompressHandler extends DecoratorHandler {
    */
   #setupDecompressorEvents (decompressor, controller) {
     decompressor.on('readable', () => {
+      if (this.#terminated) {
+        return
+      }
+
       let chunk
       while ((chunk = decompressor.read()) !== null) {
+        const decompressedSize = this.#decompressedSize + chunk.length
+        if (decompressedSize > this.#maxSize) {
+          this.#fail(controller, new ResponseExceededMaxSizeError(
+            `Decompressed response size (${decompressedSize}) exceeded maxSize (${this.#maxSize})`
+          ))
+          return
+        }
+
+        this.#decompressedSize = decompressedSize
         const result = super.onResponseData(controller, chunk)
         if (result === false) {
           break
@@ -111,7 +197,7 @@ class DecompressHandler extends DecoratorHandler {
     })
 
     decompressor.on('error', (error) => {
-      super.onResponseError(controller, error)
+      this.#fail(controller, error)
     })
   }
 
@@ -125,6 +211,12 @@ class DecompressHandler extends DecoratorHandler {
     this.#setupDecompressorEvents(decompressor, controller)
 
     decompressor.on('end', () => {
+      if (this.#terminated) {
+        return
+      }
+
+      this.#terminated = true
+      this.#cleanupDecompressors()
       super.onResponseEnd(controller, this.#trailers)
     })
   }
@@ -139,10 +231,17 @@ class DecompressHandler extends DecoratorHandler {
     this.#setupDecompressorEvents(lastDecompressor, controller)
 
     pipeline(this.#decompressors, (err) => {
+      if (this.#terminated) {
+        return
+      }
+
       if (err) {
-        super.onResponseError(controller, err)
+        this.#fail(controller, err)
         return
       }
+
+      this.#terminated = true
+      this.#cleanupDecompressors()
       super.onResponseEnd(controller, this.#trailers)
     })
   }
@@ -198,7 +297,7 @@ class DecompressHandler extends DecoratorHandler {
 
           filteredHeaders.push(rawHeaders[i], rawHeaders[i + 1])
         }
-        controller.rawHeaders = filteredHeaders
+        rawHeaders.splice(0, rawHeaders.length, ...filteredHeaders)
       } else if (typeof rawHeaders === 'object') {
         for (const name of Object.keys(rawHeaders)) {
           const lowerName = name.toLowerCase()
@@ -238,9 +337,9 @@ class DecompressHandler extends DecoratorHandler {
    */
   onResponseEnd (controller, trailers) {
     if (this.#decompressors.length > 0) {
+      this.#inputEnded = true
       this.#trailers = trailers
       this.#decompressors[0].end()
-      this.#cleanupDecompressors()
       return
     }
     super.onResponseEnd(controller, trailers)
@@ -252,12 +351,15 @@ class DecompressHandler extends DecoratorHandler {
    * @returns {void}
    */
   onResponseError (controller, err) {
-    if (this.#decompressors.length > 0) {
-      for (const decompressor of this.#decompressors) {
-        decompressor.destroy(err)
-      }
-      this.#cleanupDecompressors()
+    if (this.#terminated) {
+      return
+    }
+
+    this.#terminated = true
+    for (const decompressor of this.#decompressors) {
+      decompressor.destroy()
     }
+    this.#cleanupDecompressors()
     super.onResponseError(controller, err)
   }
 }
diff --git a/deps/undici/src/lib/interceptor/deduplicate.js b/deps/undici/src/lib/interceptor/deduplicate.js
index bacfeb3fb37e..12598130e8f9 100644
--- a/deps/undici/src/lib/interceptor/deduplicate.js
+++ b/deps/undici/src/lib/interceptor/deduplicate.js
@@ -3,7 +3,7 @@
 const diagnosticsChannel = require('node:diagnostics_channel')
 const util = require('../core/util')
 const DeduplicationHandler = require('../handler/deduplication-handler')
-const { normalizeHeaders, makeCacheKey, makeDeduplicationKey } = require('../util/cache.js')
+const { getInterceptorOrigin, normalizeHeaders, makeCacheKey, makeDeduplicationKey } = require('../util/cache.js')
 
 const pendingRequestsChannel = diagnosticsChannel.channel('undici:request:pending-requests')
 
@@ -57,9 +57,10 @@ module.exports = (opts = {}) => {
    */
   const pendingRequests = new Map()
 
-  return dispatch => {
+  return (dispatch, interceptorOrigin) => {
     return (opts, handler) => {
-      if (opts.upgrade || methods.includes(opts.method) === false) {
+      const requestOrigin = getInterceptorOrigin(opts, interceptorOrigin)
+      if (!requestOrigin || opts.upgrade || methods.includes(opts.method) === false) {
         return dispatch(opts, handler)
       }
 
@@ -77,7 +78,7 @@ module.exports = (opts = {}) => {
         }
       }
 
-      const cacheKey = makeCacheKey(opts)
+      const cacheKey = makeCacheKey(opts, requestOrigin)
       const dedupeKey = makeDeduplicationKey(cacheKey, excludeHeaderNamesSet)
 
       // Check if there's already a pending request for this key
diff --git a/deps/undici/src/lib/interceptor/dns.js b/deps/undici/src/lib/interceptor/dns.js
index ebc9a5383036..ecca6efeb660 100644
--- a/deps/undici/src/lib/interceptor/dns.js
+++ b/deps/undici/src/lib/interceptor/dns.js
@@ -3,6 +3,7 @@ const { isIP } = require('node:net')
 const { lookup } = require('node:dns')
 const DecoratorHandler = require('../handler/decorator-handler')
 const { InvalidArgumentError, InformationalError } = require('../core/errors')
+const { kRequestOrigin } = require('../core/symbols')
 const maxInt = Math.pow(2, 31) - 1
 
 function hasSafeIterator (headers) {
@@ -434,6 +435,9 @@ class DNSDispatchHandler extends DecoratorHandler {
             origin: `${this.#origin.protocol}//${
               ip.family === 6 ? `[${ip.address}]` : ip.address
             }${port}`,
+            [kRequestOrigin]: this.#opts[kRequestOrigin] === undefined
+              ? this.#origin
+              : this.#opts[kRequestOrigin],
             headers: withHostHeader(this.#origin.host, this.#opts.headers)
           }
           this.#dispatch(dispatchOpts, this)
@@ -557,6 +561,9 @@ module.exports = interceptorOpts => {
           ...origDispatchOpts,
           servername: origin.hostname, // For SNI on TLS
           origin: newOrigin.origin,
+          [kRequestOrigin]: origDispatchOpts[kRequestOrigin] === undefined
+            ? origin
+            : origDispatchOpts[kRequestOrigin],
           headers: withHostHeader(origin.host, origDispatchOpts.headers)
         }
 
diff --git a/deps/undici/src/lib/interceptor/dump.js b/deps/undici/src/lib/interceptor/dump.js
index 4810a09f3824..09b57f2163fb 100644
--- a/deps/undici/src/lib/interceptor/dump.js
+++ b/deps/undici/src/lib/interceptor/dump.js
@@ -7,7 +7,6 @@ class DumpHandler extends DecoratorHandler {
   #maxSize = 1024 * 1024
   #dumped = false
   #size = 0
-  #controller = null
   aborted = false
   reason = false
 
@@ -29,7 +28,6 @@ class DumpHandler extends DecoratorHandler {
 
   onRequestStart (controller, context) {
     controller.abort = this.#abort.bind(this)
-    this.#controller = controller
 
     return super.onRequestStart(controller, context)
   }
@@ -53,43 +51,32 @@ class DumpHandler extends DecoratorHandler {
   }
 
   onResponseError (controller, err) {
-    if (this.#dumped) {
-      return
-    }
-
-    // On network errors before connect, controller will be null
-    err = this.#controller?.reason ?? err
-
-    super.onResponseError(controller, err)
+    super.onResponseError(controller, this.aborted === true ? this.reason : err)
   }
 
   onResponseData (controller, chunk) {
     this.#size = this.#size + chunk.length
 
-    if (this.#size >= this.#maxSize) {
-      this.#dumped = true
+    if (this.#size > this.#maxSize) {
+      throw new RequestAbortedError(
+        `Response size (${this.#size}) larger than maxSize (${this.#maxSize})`
+      )
+    }
 
-      if (this.aborted === true) {
-        super.onResponseError(controller, this.reason)
-      } else {
-        super.onResponseEnd(controller, {})
-      }
+    if (this.#size === this.#maxSize) {
+      this.#dumped = true
     }
 
     return true
   }
 
   onResponseEnd (controller, trailers) {
-    if (this.#dumped) {
-      return
-    }
-
-    if (this.#controller.aborted === true) {
+    if (this.aborted === true) {
       super.onResponseError(controller, this.reason)
       return
     }
 
-    super.onResponseEnd(controller, trailers)
+    super.onResponseEnd(controller, this.#dumped ? {} : trailers)
   }
 }
 
diff --git a/deps/undici/src/lib/llhttp/wasm_build_env.txt b/deps/undici/src/lib/llhttp/wasm_build_env.txt
index 82569ca62dd1..9085bb4e260d 100644
--- a/deps/undici/src/lib/llhttp/wasm_build_env.txt
+++ b/deps/undici/src/lib/llhttp/wasm_build_env.txt
@@ -1,5 +1,5 @@
 
-> undici@8.10.0 build:wasm
+> undici@8.10.2 build:wasm
 > node build/wasm.js --docker
 
 > docker run --rm --platform=linux/x86_64  --user 1001:1001 --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/lib/llhttp,target=/home/node/build/lib/llhttp            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/build,target=/home/node/build/build            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/deps,target=/home/node/build/deps            -t ghcr.io/nodejs/wasm-builder@sha256:975f391d907e42a75b8c72eb77c782181e941608687d4d8694c3e9df415a0970 node build/wasm.js
diff --git a/deps/undici/src/lib/mock/mock-agent.js b/deps/undici/src/lib/mock/mock-agent.js
index 17a7b717c213..6051d5aab7c0 100644
--- a/deps/undici/src/lib/mock/mock-agent.js
+++ b/deps/undici/src/lib/mock/mock-agent.js
@@ -73,7 +73,7 @@ class MockAgent extends Dispatcher {
     opts.origin = normalizeOrigin(opts.origin)
 
     // Call MockAgent.get to perform additional setup before dispatching as normal
-    this.get(opts.origin)
+    const mockDispatcher = this.get(opts.origin)
 
     this[kMockAgentAddCallHistoryLog](opts)
 
@@ -81,6 +81,18 @@ class MockAgent extends Dispatcher {
 
     const dispatchOpts = { ...opts }
 
+    // Agent keeps HTTP/1.1-only dispatchers under a separate key. Legacy
+    // global dispatcher consumers use that path, so mirror the mock dispatches
+    // before delegating to the internal Agent.
+    if (dispatchOpts.allowH2 === false) {
+      const http1OnlyKey = `${dispatchOpts.origin}#http1-only`
+      if (!this[kClients].has(http1OnlyKey)) {
+        const http1OnlyDispatcher = this[kFactory](dispatchOpts.origin)
+        http1OnlyDispatcher[kDispatches] = mockDispatcher[kDispatches]
+        this[kMockAgentSet](http1OnlyKey, http1OnlyDispatcher)
+      }
+    }
+
     if (acceptNonStandardSearchParameters && dispatchOpts.path) {
       const [path, searchParams] = dispatchOpts.path.split('?')
       const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters)
diff --git a/deps/undici/src/lib/mock/mock-utils.js b/deps/undici/src/lib/mock/mock-utils.js
index e43f7218d0b4..00c1a0bbe13c 100644
--- a/deps/undici/src/lib/mock/mock-utils.js
+++ b/deps/undici/src/lib/mock/mock-utils.js
@@ -333,8 +333,7 @@ function mockDispatch (opts, handler) {
             handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
             return
           }
-          mockDispatch.data = { ...responseDefaults, ...resolvedData }
-          dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
+          dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler, { ...responseDefaults, ...resolvedData })
         },
         (error) => {
           handler.onResponseError(null, error)
@@ -347,7 +346,7 @@ function mockDispatch (opts, handler) {
       throw new InvalidArgumentError('reply options callback must return an object')
     }
 
-    mockDispatch.data = { ...responseDefaults, ...callbackResult }
+    return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler, { ...responseDefaults, ...callbackResult })
   }
 
   return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
@@ -356,9 +355,13 @@ function mockDispatch (opts, handler) {
 /**
  * Replies to a request once the mock dispatch data is fully resolved
  */
-function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
-  // Parse mockDispatch data
-  const { data: response, delay } = mockDispatch
+function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler, resolvedResponse) {
+  // Parse mockDispatch data. When a reply callback has already been resolved
+  // in mockDispatch() (i.e. no body lifecycle hooks are involved), the resolved
+  // response is passed in here, leaving mockDispatch.data untouched so the
+  // callback can be re-invoked for persistent / times() replies.
+  const { data: responseData, delay } = mockDispatch
+  const response = resolvedResponse ?? responseData
 
   // If specified, trigger dispatch error
   if (response.error !== null) {
@@ -454,8 +457,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
               handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
               return
             }
-            mockDispatch.data = { ...responseDefaults, ...resolvedData }
-            handleReply(dispatches, mockDispatch.data)
+            handleReply(dispatches, { ...responseDefaults, ...resolvedData })
           },
           (err) => {
             handler.onResponseError(null, err)
@@ -468,8 +470,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
         throw new InvalidArgumentError('reply options callback must return an object')
       }
 
-      mockDispatch.data = { ...responseDefaults, ...callbackResult }
-      handleReply(dispatches, mockDispatch.data)
+      handleReply(dispatches, { ...responseDefaults, ...callbackResult })
       return
     }
 
diff --git a/deps/undici/src/lib/util/cache.js b/deps/undici/src/lib/util/cache.js
index 1fac28af5d97..ad2524fad3a4 100644
--- a/deps/undici/src/lib/util/cache.js
+++ b/deps/undici/src/lib/util/cache.js
@@ -8,6 +8,7 @@ const {
 } = require('../core/util')
 
 const { serializePathWithQuery } = require('../core/util')
+const { kRequestOrigin } = require('../core/symbols')
 
 const MAX_DELTA_SECONDS = 2147483647
 const RESTRICTIVE_DIRECTIVE_NAMES = ['no-store', 'private', 'no-cache']
@@ -147,8 +148,47 @@ function getMalformedRestrictiveDirectiveName (key) {
 /**
  * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
  */
-function makeCacheKey (opts) {
-  const origin = opts.origin ? opts.origin.toString() : ''
+function getRequestOrigin (opts) {
+  const origin = opts[kRequestOrigin] === undefined
+    ? opts.origin
+    : opts[kRequestOrigin]
+  return typeof origin === 'string' || origin instanceof URL
+    ? origin
+    : null
+}
+
+/**
+ * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
+ * @param {string|null|undefined} interceptorOrigin
+ */
+function getInterceptorOrigin (opts, interceptorOrigin) {
+  const requestOrigin = getRequestOrigin(opts)
+  if (interceptorOrigin === undefined) {
+    return requestOrigin
+  }
+  if (interceptorOrigin === null) {
+    return null
+  }
+  if (requestOrigin) {
+    try {
+      if (new URL(requestOrigin).origin !== interceptorOrigin) {
+        return null
+      }
+    } catch {
+      return interceptorOrigin
+    }
+  }
+  return interceptorOrigin
+}
+
+/**
+ * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
+ * @param {string|URL|null} [origin]
+ */
+function makeCacheKey (opts, origin = getRequestOrigin(opts)) {
+  if (!origin) {
+    throw new Error('opts.origin is undefined')
+  }
 
   let fullPath = opts.path || '/'
 
@@ -157,7 +197,7 @@ function makeCacheKey (opts) {
   }
 
   return {
-    origin,
+    origin: origin.toString(),
     method: opts.method,
     path: fullPath,
     headers: opts.headers
@@ -700,6 +740,8 @@ function makeDeduplicationKey (cacheKey, excludeHeaders) {
 }
 
 module.exports = {
+  getInterceptorOrigin,
+  getRequestOrigin,
   makeCacheKey,
   normalizeHeaders,
   assertCacheKey,
diff --git a/deps/undici/src/lib/web/cookies/parse.js b/deps/undici/src/lib/web/cookies/parse.js
index 51854822a8b6..27606b230d1c 100644
--- a/deps/undici/src/lib/web/cookies/parse.js
+++ b/deps/undici/src/lib/web/cookies/parse.js
@@ -92,221 +92,224 @@ function parseSetCookie (header) {
  * @param {Object.<string, unknown>} [cookieAttributeList={}]
  */
 function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {}) {
-  // 1. If the unparsed-attributes string is empty, skip the rest of
-  //    these steps.
-  if (unparsedAttributes.length === 0) {
-    return cookieAttributeList
-  }
+  while (true) {
+    // 1. If the unparsed-attributes string is empty, skip the rest of
+    //    these steps.
+    if (unparsedAttributes.length === 0) {
+      return cookieAttributeList
+    }
 
-  // 2. Discard the first character of the unparsed-attributes (which
-  //    will be a %x3B (";") character).
-  assert(unparsedAttributes[0] === ';')
-  unparsedAttributes = unparsedAttributes.slice(1)
+    // 2. Discard the first character of the unparsed-attributes (which
+    //    will be a %x3B (";") character).
+    assert(unparsedAttributes[0] === ';')
+    unparsedAttributes = unparsedAttributes.slice(1)
 
-  let cookieAv = ''
+    let cookieAv = ''
 
-  // 3. If the remaining unparsed-attributes contains a %x3B (";")
-  //    character:
-  if (unparsedAttributes.includes(';')) {
+    // 3. If the remaining unparsed-attributes contains a %x3B (";")
+    //    character:
+    if (unparsedAttributes.includes(';')) {
     // 1. Consume the characters of the unparsed-attributes up to, but
     //    not including, the first %x3B (";") character.
-    cookieAv = collectASequenceOfCodePointsFast(
-      ';',
-      unparsedAttributes,
-      { position: 0 }
-    )
-    unparsedAttributes = unparsedAttributes.slice(cookieAv.length)
-  } else {
+      cookieAv = collectASequenceOfCodePointsFast(
+        ';',
+        unparsedAttributes,
+        { position: 0 }
+      )
+      unparsedAttributes = unparsedAttributes.slice(cookieAv.length)
+    } else {
     // Otherwise:
 
-    // 1. Consume the remainder of the unparsed-attributes.
-    cookieAv = unparsedAttributes
-    unparsedAttributes = ''
-  }
+      // 1. Consume the remainder of the unparsed-attributes.
+      cookieAv = unparsedAttributes
+      unparsedAttributes = ''
+    }
 
-  // Let the cookie-av string be the characters consumed in this step.
+    // Let the cookie-av string be the characters consumed in this step.
 
-  let attributeName = ''
-  let attributeValue = ''
+    let attributeName = ''
+    let attributeValue = ''
 
-  // 4. If the cookie-av string contains a %x3D ("=") character:
-  if (cookieAv.includes('=')) {
+    // 4. If the cookie-av string contains a %x3D ("=") character:
+    if (cookieAv.includes('=')) {
     // 1. The (possibly empty) attribute-name string consists of the
     //    characters up to, but not including, the first %x3D ("=")
     //    character, and the (possibly empty) attribute-value string
     //    consists of the characters after the first %x3D ("=")
     //    character.
-    const position = { position: 0 }
-
-    attributeName = collectASequenceOfCodePointsFast(
-      '=',
-      cookieAv,
-      position
-    )
-    attributeValue = cookieAv.slice(position.position + 1)
-  } else {
+      const position = { position: 0 }
+
+      attributeName = collectASequenceOfCodePointsFast(
+        '=',
+        cookieAv,
+        position
+      )
+      attributeValue = cookieAv.slice(position.position + 1)
+    } else {
     // Otherwise:
 
-    // 1. The attribute-name string consists of the entire cookie-av
-    //    string, and the attribute-value string is empty.
-    attributeName = cookieAv
-  }
+      // 1. The attribute-name string consists of the entire cookie-av
+      //    string, and the attribute-value string is empty.
+      attributeName = cookieAv
+    }
 
-  // 5. Remove any leading or trailing WSP characters from the attribute-
-  //    name string and the attribute-value string.
-  attributeName = attributeName.trim()
-  attributeValue = attributeValue.trim()
+    // 5. Remove any leading or trailing WSP characters from the attribute-
+    //    name string and the attribute-value string.
+    attributeName = attributeName.trim()
+    attributeValue = attributeValue.trim()
 
-  // 6. If the attribute-value is longer than 1024 octets, ignore the
-  //    cookie-av string and return to Step 1 of this algorithm.
-  if (attributeValue.length > maxAttributeValueSize) {
-    return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-  }
+    // 6. If the attribute-value is longer than 1024 octets, ignore the
+    //    cookie-av string and return to Step 1 of this algorithm.
+    if (attributeValue.length > maxAttributeValueSize) {
+      continue
+    }
 
-  // 7. Process the attribute-name and attribute-value according to the
-  //    requirements in the following subsections.  (Notice that
-  //    attributes with unrecognized attribute-names are ignored.)
-  const attributeNameLowercase = attributeName.toLowerCase()
+    // 7. Process the attribute-name and attribute-value according to the
+    //    requirements in the following subsections.  (Notice that
+    //    attributes with unrecognized attribute-names are ignored.)
+    const attributeNameLowercase = attributeName.toLowerCase()
 
-  // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.1
-  // If the attribute-name case-insensitively matches the string
-  // "Expires", the user agent MUST process the cookie-av as follows.
-  if (attributeNameLowercase === 'expires') {
+    // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.1
+    // If the attribute-name case-insensitively matches the string
+    // "Expires", the user agent MUST process the cookie-av as follows.
+    if (attributeNameLowercase === 'expires') {
     // 1. Let the expiry-time be the result of parsing the attribute-value
     //    as cookie-date (see Section 5.1.1).
-    const expiryTime = new Date(attributeValue)
-
-    // 2. If the attribute-value failed to parse as a cookie date, ignore
-    //    the cookie-av.
-    if (!Number.isNaN(expiryTime.getTime())) {
-      cookieAttributeList.expires = expiryTime
-    }
-  } else if (attributeNameLowercase === 'max-age') {
+      const expiryTime = new Date(attributeValue)
+
+      // 2. If the attribute-value failed to parse as a cookie date, ignore
+      //    the cookie-av.
+      if (!Number.isNaN(expiryTime.getTime())) {
+        cookieAttributeList.expires = expiryTime
+      }
+    } else if (attributeNameLowercase === 'max-age') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.2
     // If the attribute-name case-insensitively matches the string "Max-
     // Age", the user agent MUST process the cookie-av as follows.
 
-    // 1. If the first character of the attribute-value is not a DIGIT or a
-    //    "-" character, ignore the cookie-av.
-    const charCode = attributeValue.charCodeAt(0)
-
-    if ((charCode < 48 || charCode > 57) && attributeValue[0] !== '-') {
-      return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-    }
-
-    // 2. If the remainder of attribute-value contains a non-DIGIT
-    //    character, ignore the cookie-av.
-    if (!/^\d+$/.test(attributeValue)) {
-      return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-    }
-
-    // 3. Let delta-seconds be the attribute-value converted to an integer.
-    const deltaSeconds = Number(attributeValue)
-
-    // 4. Let cookie-age-limit be the maximum age of the cookie (which
-    //    SHOULD be 400 days or less, see Section 4.1.2.2).
-
-    // 5. Set delta-seconds to the smaller of its present value and cookie-
-    //    age-limit.
-    // deltaSeconds = Math.min(deltaSeconds * 1000, maxExpiresMs)
-
-    // 6. If delta-seconds is less than or equal to zero (0), let expiry-
-    //    time be the earliest representable date and time.  Otherwise, let
-    //    the expiry-time be the current date and time plus delta-seconds
-    //    seconds.
-    // const expiryTime = deltaSeconds <= 0 ? Date.now() : Date.now() + deltaSeconds
-
-    // 7. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Max-Age and an attribute-value of expiry-time.
-    cookieAttributeList.maxAge = deltaSeconds
-  } else if (attributeNameLowercase === 'domain') {
+      // 1. If the first character of the attribute-value is not a DIGIT or a
+      //    "-" character, ignore the cookie-av.
+      const charCode = attributeValue.charCodeAt(0)
+      const startsWithDigit = charCode >= 48 && charCode <= 57
+      const startsWithSignedDigit = attributeValue[0] === '-' && attributeValue.length > 1
+
+      if (!startsWithDigit && !startsWithSignedDigit) {
+        continue
+      }
+
+      // 2. If the remainder of attribute-value contains a non-DIGIT
+      //    character, ignore the cookie-av.
+      if (/[^\d]/.test(attributeValue.slice(1))) {
+        continue
+      }
+
+      // 3. Let delta-seconds be the attribute-value converted to an integer.
+      const deltaSeconds = Number(attributeValue)
+
+      // 4. Let cookie-age-limit be the maximum age of the cookie (which
+      //    SHOULD be 400 days or less, see Section 4.1.2.2).
+
+      // 5. Set delta-seconds to the smaller of its present value and cookie-
+      //    age-limit.
+      // deltaSeconds = Math.min(deltaSeconds * 1000, maxExpiresMs)
+
+      // 6. If delta-seconds is less than or equal to zero (0), let expiry-
+      //    time be the earliest representable date and time.  Otherwise, let
+      //    the expiry-time be the current date and time plus delta-seconds
+      //    seconds.
+      // const expiryTime = deltaSeconds <= 0 ? Date.now() : Date.now() + deltaSeconds
+
+      // 7. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Max-Age and an attribute-value of expiry-time.
+      cookieAttributeList.maxAge = deltaSeconds
+    } else if (attributeNameLowercase === 'domain') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.3
     // If the attribute-name case-insensitively matches the string "Domain",
     // the user agent MUST process the cookie-av as follows.
 
-    // 1. Let cookie-domain be the attribute-value.
-    let cookieDomain = attributeValue
+      // 1. Let cookie-domain be the attribute-value.
+      let cookieDomain = attributeValue
 
-    // 2. If cookie-domain starts with %x2E ("."), let cookie-domain be
-    //    cookie-domain without its leading %x2E (".").
-    if (cookieDomain[0] === '.') {
-      cookieDomain = cookieDomain.slice(1)
-    }
+      // 2. If cookie-domain starts with %x2E ("."), let cookie-domain be
+      //    cookie-domain without its leading %x2E (".").
+      if (cookieDomain[0] === '.') {
+        cookieDomain = cookieDomain.slice(1)
+      }
 
-    // 3. Convert the cookie-domain to lower case.
-    cookieDomain = cookieDomain.toLowerCase()
+      // 3. Convert the cookie-domain to lower case.
+      cookieDomain = cookieDomain.toLowerCase()
 
-    // 4. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Domain and an attribute-value of cookie-domain.
-    cookieAttributeList.domain = cookieDomain
-  } else if (attributeNameLowercase === 'path') {
+      // 4. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Domain and an attribute-value of cookie-domain.
+      cookieAttributeList.domain = cookieDomain
+    } else if (attributeNameLowercase === 'path') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.4
     // If the attribute-name case-insensitively matches the string "Path",
     // the user agent MUST process the cookie-av as follows.
 
-    // 1. If the attribute-value is empty or if the first character of the
-    //    attribute-value is not %x2F ("/"):
-    let cookiePath = ''
-    if (attributeValue.length === 0 || attributeValue[0] !== '/') {
+      // 1. If the attribute-value is empty or if the first character of the
+      //    attribute-value is not %x2F ("/"):
+      let cookiePath = ''
+      if (attributeValue.length === 0 || attributeValue[0] !== '/') {
       // 1. Let cookie-path be the default-path.
-      cookiePath = '/'
-    } else {
+        cookiePath = '/'
+      } else {
       // Otherwise:
 
-      // 1. Let cookie-path be the attribute-value.
-      cookiePath = attributeValue
-    }
+        // 1. Let cookie-path be the attribute-value.
+        cookiePath = attributeValue
+      }
 
-    // 2. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Path and an attribute-value of cookie-path.
-    cookieAttributeList.path = cookiePath
-  } else if (attributeNameLowercase === 'secure') {
+      // 2. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Path and an attribute-value of cookie-path.
+      cookieAttributeList.path = cookiePath
+    } else if (attributeNameLowercase === 'secure') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.5
     // If the attribute-name case-insensitively matches the string "Secure",
     // the user agent MUST append an attribute to the cookie-attribute-list
     // with an attribute-name of Secure and an empty attribute-value.
 
-    cookieAttributeList.secure = true
-  } else if (attributeNameLowercase === 'httponly') {
+      cookieAttributeList.secure = true
+    } else if (attributeNameLowercase === 'httponly') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.6
     // If the attribute-name case-insensitively matches the string
     // "HttpOnly", the user agent MUST append an attribute to the cookie-
     // attribute-list with an attribute-name of HttpOnly and an empty
     // attribute-value.
 
-    cookieAttributeList.httpOnly = true
-  } else if (attributeNameLowercase === 'samesite') {
+      cookieAttributeList.httpOnly = true
+    } else if (attributeNameLowercase === 'samesite') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.7
     // If the attribute-name case-insensitively matches the string
     // "SameSite", the user agent MUST process the cookie-av as follows:
 
-    const attributeValueLowercase = attributeValue.toLowerCase()
+      const attributeValueLowercase = attributeValue.toLowerCase()
 
-    // 1. If cookie-av's attribute-value is a case-insensitive match for
-    //    "None", append an attribute to the cookie-attribute-list with an
-    //    attribute-name of "SameSite" and an attribute-value of "None".
-    if (attributeValueLowercase === 'none') {
-      cookieAttributeList.sameSite = 'None'
-    } else if (attributeValueLowercase === 'strict') {
+      // 1. If cookie-av's attribute-value is a case-insensitive match for
+      //    "None", append an attribute to the cookie-attribute-list with an
+      //    attribute-name of "SameSite" and an attribute-value of "None".
+      if (attributeValueLowercase === 'none') {
+        cookieAttributeList.sameSite = 'None'
+      } else if (attributeValueLowercase === 'strict') {
       // 2. If cookie-av's attribute-value is a case-insensitive match for
       //    "Strict", append an attribute to the cookie-attribute-list with
       //    an attribute-name of "SameSite" and an attribute-value of
       //    "Strict".
-      cookieAttributeList.sameSite = 'Strict'
-    } else if (attributeValueLowercase === 'lax') {
+        cookieAttributeList.sameSite = 'Strict'
+      } else if (attributeValueLowercase === 'lax') {
       // 3. If cookie-av's attribute-value is a case-insensitive match for
       //    "Lax", append an attribute to the cookie-attribute-list with an
       //    attribute-name of "SameSite" and an attribute-value of "Lax".
-      cookieAttributeList.sameSite = 'Lax'
-    }
-  } else {
-    cookieAttributeList.unparsed ??= []
+        cookieAttributeList.sameSite = 'Lax'
+      }
+    } else {
+      cookieAttributeList.unparsed ??= []
 
-    cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`)
-  }
+      cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`)
+    }
 
   // 8. Return to Step 1 of this algorithm.
-  return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
+  }
 }
 
 module.exports = {
diff --git a/deps/undici/src/lib/web/eventsource/eventsource-stream.js b/deps/undici/src/lib/web/eventsource/eventsource-stream.js
index 7b9e2f8cbba8..03000e67dd0f 100644
--- a/deps/undici/src/lib/web/eventsource/eventsource-stream.js
+++ b/deps/undici/src/lib/web/eventsource/eventsource-stream.js
@@ -1,4 +1,5 @@
 'use strict'
+const buffer = require('node:buffer')
 const { Transform } = require('node:stream')
 const { isASCIINumber, isValidLastEventId } = require('./util')
 
@@ -23,6 +24,8 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
@@ -66,6 +69,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -114,6 +123,8 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  eventDataSize = 0
+  maxEventSize
 
   event = {
     data: undefined,
@@ -125,6 +136,7 @@ class EventSourceStream extends Transform {
   /**
    * @param {object} options
    * @param {boolean} [options.readableObjectMode]
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} [options.eventSourceSettings]
    * @param {(chunk: any, encoding?: BufferEncoding | undefined) => boolean} [options.push]
    */
@@ -136,6 +148,7 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
     if (options.push) {
       this.push = options.push
     }
@@ -231,7 +244,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
-        this.parseLine(this.readLine(), this.event)
+        try {
+          this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -282,6 +300,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      const valueBytes = line.length - valueStart
+      const eventDataSize = this.eventDataSize + (event.data === undefined ? 0 : 1) + valueBytes
+
+      if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+        throw createMaxEventSizeExceededError()
+      }
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -289,6 +314,7 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.eventDataSize = eventDataSize
       return
     }
 
@@ -345,6 +371,7 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventDataSize = 0
   }
 
   hasPendingEvent () {
diff --git a/deps/undici/src/lib/web/eventsource/eventsource.js b/deps/undici/src/lib/web/eventsource/eventsource.js
index 17a1de7b7ba6..657c0643ca88 100644
--- a/deps/undici/src/lib/web/eventsource/eventsource.js
+++ b/deps/undici/src/lib/web/eventsource/eventsource.js
@@ -7,9 +7,13 @@ const { EventSourceStream } = require('./eventsource-stream')
 const { parseMIMEType } = require('../fetch/data-url')
 const { createFastMessageEvent } = require('../websocket/events')
 const { isNetworkError } = require('../fetch/response')
-const { kEnumerableProperty } = require('../../core/util')
+const { isValidHeaderValue, kEnumerableProperty } = require('../../core/util')
 const { environmentSettingsObject } = require('../fetch/util')
 const { createPotentialCORSRequest } = require('./util')
+const { getGlobalDispatcher } = require('../../global')
+const { isomorphicDecode } = require('../infra')
+
+const textEncoder = new TextEncoder()
 
 let experimentalWarned = false
 
@@ -281,6 +285,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -340,8 +345,12 @@ class EventSource extends EventTarget {
       //         string, encoded as UTF-8.
       //      2. Set (`Last-Event-ID`, lastEventIDValue) in request's header
       //         list.
+      this.#request.headersList.delete('last-event-id', true)
       if (this.#state.lastEventId.length) {
-        this.#request.headersList.set('last-event-id', this.#state.lastEventId, true)
+        const lastEventId = isomorphicDecode(textEncoder.encode(this.#state.lastEventId))
+        if (isValidHeaderValue(lastEventId)) {
+          this.#request.headersList.set('last-event-id', lastEventId, true)
+        }
       }
 
       //   4. Fetch request and process the response obtained in this fashion, if any, as described earlier in this section.
@@ -465,7 +474,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   },
   {
     key: 'node', // undici only
diff --git a/deps/undici/src/lib/web/fetch/index.js b/deps/undici/src/lib/web/fetch/index.js
index 935bc9d4c90e..4ac812ad6220 100644
--- a/deps/undici/src/lib/web/fetch/index.js
+++ b/deps/undici/src/lib/web/fetch/index.js
@@ -59,6 +59,7 @@ const {
 const EE = require('node:events')
 const { Readable, pipeline, finished, isErrored, isReadable } = require('node:stream')
 const { addAbortListener, bufferToLowerCasedHeaderName } = require('../../core/util')
+const { SocketError } = require('../../core/errors')
 const { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require('./data-url')
 const { getGlobalDispatcher } = require('../../global')
 const { webidl } = require('../webidl')
@@ -2396,6 +2397,11 @@ async function httpNetworkFetch (
             // We need to support 200 for websocket over h2 as per RFC-8441
             // Absence of session means H1
             if ((socket.session != null && status !== 200) || (socket.session == null && status !== 101)) {
+              if (socket.session != null) {
+                // The server refused the extended CONNECT, and nothing further
+                // will settle this request. Fail the opening handshake here.
+                controller.abort(new SocketError('bad upgrade', null))
+              }
               return false
             }
 
diff --git a/deps/undici/src/lib/web/fetch/request.js b/deps/undici/src/lib/web/fetch/request.js
index dbe809c289c7..56945ec02ee5 100644
--- a/deps/undici/src/lib/web/fetch/request.js
+++ b/deps/undici/src/lib/web/fetch/request.js
@@ -923,7 +923,7 @@ function makeRequest (init) {
     serviceWorkers: init.serviceWorkers ?? 'all',
     initiator: init.initiator ?? '',
     destination: init.destination ?? '',
-    priority: init.priority ?? null,
+    priority: init.priority ?? 'auto',
     origin: init.origin ?? 'client',
     policyContainer: init.policyContainer ?? 'client',
     referrer: init.referrer ?? 'client',
@@ -1129,8 +1129,7 @@ webidl.converters.RequestInit = webidl.dictionaryConverter([
   {
     key: 'priority',
     converter: webidl.converters.DOMString,
-    allowedValues: ['high', 'low', 'auto'],
-    defaultValue: () => 'auto'
+    allowedValues: ['high', 'low', 'auto']
   }
 ])
 
diff --git a/deps/undici/src/lib/web/fetch/util.js b/deps/undici/src/lib/web/fetch/util.js
index eb0ece355b7e..20cbb5c58f6c 100644
--- a/deps/undici/src/lib/web/fetch/util.js
+++ b/deps/undici/src/lib/web/fetch/util.js
@@ -227,14 +227,19 @@ function TAOCheck () {
   return 'success'
 }
 
+// https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-append-the-fetch-metadata-headers-for-a-request
 function appendFetchMetadata (httpRequest) {
+  //  1. If r’s url is not a potentially trustworthy URL, return.
+  if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+    return
+  }
+
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-dest-header
   //  TODO
 
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header
 
   //  1. Assert: r’s url is a potentially trustworthy URL.
-  //  TODO
 
   //  2. Let header be a Structured Header whose value is a token.
   let header = null
diff --git a/deps/undici/src/lib/web/webidl/index.js b/deps/undici/src/lib/web/webidl/index.js
index 05a6a4bce580..ce81c1e323af 100644
--- a/deps/undici/src/lib/web/webidl/index.js
+++ b/deps/undici/src/lib/web/webidl/index.js
@@ -26,9 +26,9 @@ const webidl = {
 /**
  * @description Instantiate an error.
  *
- * @param {Object} opts
- * @param {string} opts.header
- * @param {string} opts.message
+ * @param {Object} message
+ * @param {string} message.header
+ * @param {string} message.message
  * @returns {TypeError}
  */
 webidl.errors.exception = function (message) {
diff --git a/deps/undici/src/lib/web/websocket/connection.js b/deps/undici/src/lib/web/websocket/connection.js
index 4ecc8a195fcd..cd95d2ca76ec 100644
--- a/deps/undici/src/lib/web/websocket/connection.js
+++ b/deps/undici/src/lib/web/websocket/connection.js
@@ -200,7 +200,7 @@ function establishWebSocketConnection (url, protocols, client, handler, options)
         // is specified, the server needs to include the same field and one of
         // the selected subprotocol values in its response for the connection to
         // be established.
-        if (!requestProtocols.includes(secProtocol)) {
+        if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
           failWebsocketConnection(handler, 1002, 'Protocol was not set in the opening handshake.')
           return
         }
diff --git a/deps/undici/src/lib/web/websocket/permessage-deflate.js b/deps/undici/src/lib/web/websocket/permessage-deflate.js
index 6a6e43899c5a..0b3d493db820 100644
--- a/deps/undici/src/lib/web/websocket/permessage-deflate.js
+++ b/deps/undici/src/lib/web/websocket/permessage-deflate.js
@@ -63,7 +63,12 @@ class PerMessageDeflate {
 
         if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
           callback(new MessageSizeExceededError())
+          // The inflater may still hold buffered input that can emit a late
+          // zlib error. Remove the data listener, then deterministically stop
+          // the stream so a subsequent 'error' cannot fire without a listener
+          // (which would terminate the process as an unhandled error event).
           this.#inflate.removeAllListeners()
+          this.#inflate.destroy()
           this.#inflate = null
           return
         }
diff --git a/deps/undici/src/lib/web/websocket/stream/websocketstream.js b/deps/undici/src/lib/web/websocket/stream/websocketstream.js
index 383fd0bf7aab..1c13a30677dc 100644
--- a/deps/undici/src/lib/web/websocket/stream/websocketstream.js
+++ b/deps/undici/src/lib/web/websocket/stream/websocketstream.js
@@ -34,9 +34,9 @@ class WebSocketStream {
   /** @type {ReadableStreamDefaultController} */
   #readableStreamController
 
-  // Each WebSocketStream object has an associated writable stream , which is a WritableStream .
-  /** @type {WritableStream} */
-  #writableStream
+  // Retain the controller so the writable stream can be errored while locked.
+  /** @type {WritableStreamDefaultController} */
+  #writableStreamController
 
   // Each WebSocketStream object has an associated boolean handshake aborted , which is initially false.
   #handshakeAborted = false
@@ -300,6 +300,9 @@ class WebSocketStream {
     // 12. Let writable be a new WritableStream .
     // 13. Set up writable with writeAlgorithm , closeAlgorithm , and abortAlgorithm .
     const writable = new WritableStream({
+      start: (controller) => {
+        this.#writableStreamController = controller
+      },
       write: (chunk) => this.#write(chunk),
       close: () => closeWebSocketConnection(this.#handler, null, null),
       abort: (reason) => this.#closeUsingReason(reason)
@@ -308,9 +311,6 @@ class WebSocketStream {
     // Set stream ’s readable stream to readable .
     this.#readableStream = readable
 
-    // Set stream ’s writable stream to writable .
-    this.#writableStream = writable
-
     // Resolve stream ’s opened promise with WebSocketOpenInfo «[ " extensions " → extensions , " protocol " → protocol , " readable " → readable , " writable " → writable ]».
     this.#openedPromise.resolve({
       extensions,
@@ -396,9 +396,7 @@ class WebSocketStream {
       readableStreamClose(this.#readableStreamController)
 
       // 6.2. Error stream ’s writable stream with an " InvalidStateError " DOMException indicating that a closed WebSocketStream cannot be written to.
-      if (!this.#writableStream.locked) {
-        this.#writableStream.abort(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
-      }
+      this.#writableStreamController.error(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
 
       // 6.3. Resolve stream ’s closed promise with WebSocketCloseInfo «[ " closeCode " → code , " reason " → reason ]».
       this.#closedPromise.resolve({
@@ -415,7 +413,7 @@ class WebSocketStream {
       this.#readableStreamController?.error(error)
 
       // 7.3. Error stream ’s writable stream with error .
-      this.#writableStream?.abort(error)
+      this.#writableStreamController?.error(error)
 
       // 7.4. Reject stream ’s closed promise with error .
       this.#closedPromise.reject(error)
diff --git a/deps/undici/src/package-lock.json b/deps/undici/src/package-lock.json
index 28d9db8de52e..c0f6d19a83a8 100644
--- a/deps/undici/src/package-lock.json
+++ b/deps/undici/src/package-lock.json
@@ -1,15 +1,15 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "undici",
-      "version": "8.10.0",
+      "version": "8.10.2",
       "license": "MIT",
       "devDependencies": {
-        "@fastify/busboy": "3.2.0",
+        "@fastify/busboy": "3.2.2",
         "@matteo.collina/tspl": "^0.2.0",
         "@metcoder95/https-pem": "^1.0.0",
         "@sinonjs/fake-timers": "^12.0.0",
@@ -76,13 +76,13 @@
       "license": "MIT"
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -91,9 +91,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -101,21 +101,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -132,14 +132,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -149,14 +149,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -166,9 +166,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -176,29 +176,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -208,9 +208,9 @@
       }
     },
     "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -218,9 +218,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -238,9 +238,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -248,27 +248,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -333,13 +333,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-import-attributes": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.28.6.tgz",
-      "integrity": "sha512-jiLC0ma9XkQT3TKJ9uYvlakm66Pamywo+qwL+oL8HJOvc6TWdZXVfhqJr8CCzbSGUAbDOzlGHJC1U+vRfLQDvw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz",
+      "integrity": "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -375,13 +375,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-jsx": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.28.6.tgz",
-      "integrity": "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz",
+      "integrity": "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -501,13 +501,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-typescript": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.28.6.tgz",
-      "integrity": "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz",
+      "integrity": "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -517,33 +517,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -551,14 +551,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -623,9 +623,9 @@
       "license": "MIT"
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
       "cpu": [
         "ppc64"
       ],
@@ -640,9 +640,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
       "cpu": [
         "arm"
       ],
@@ -657,9 +657,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
       "cpu": [
         "arm64"
       ],
@@ -674,9 +674,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
       "cpu": [
         "x64"
       ],
@@ -691,9 +691,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
       "cpu": [
         "arm64"
       ],
@@ -708,9 +708,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
       "cpu": [
         "x64"
       ],
@@ -725,9 +725,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
       "cpu": [
         "arm64"
       ],
@@ -742,9 +742,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
       "cpu": [
         "x64"
       ],
@@ -759,9 +759,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
       "cpu": [
         "arm"
       ],
@@ -776,9 +776,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
       "cpu": [
         "arm64"
       ],
@@ -793,9 +793,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
       "cpu": [
         "ia32"
       ],
@@ -810,9 +810,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
       "cpu": [
         "loong64"
       ],
@@ -827,9 +827,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
       "cpu": [
         "mips64el"
       ],
@@ -844,9 +844,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
       "cpu": [
         "ppc64"
       ],
@@ -861,9 +861,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
       "cpu": [
         "riscv64"
       ],
@@ -878,9 +878,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
       "cpu": [
         "s390x"
       ],
@@ -895,9 +895,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
       "cpu": [
         "x64"
       ],
@@ -912,9 +912,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
       "cpu": [
         "arm64"
       ],
@@ -929,9 +929,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
       "cpu": [
         "x64"
       ],
@@ -946,9 +946,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
       "cpu": [
         "arm64"
       ],
@@ -963,9 +963,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
       "cpu": [
         "x64"
       ],
@@ -980,9 +980,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
       "cpu": [
         "arm64"
       ],
@@ -997,9 +997,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
       "cpu": [
         "x64"
       ],
@@ -1014,9 +1014,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
       "cpu": [
         "arm64"
       ],
@@ -1031,9 +1031,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
       "cpu": [
         "ia32"
       ],
@@ -1048,9 +1048,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
       "cpu": [
         "x64"
       ],
@@ -1209,36 +1209,50 @@
       }
     },
     "node_modules/@fastify/busboy": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.0.tgz",
-      "integrity": "sha512-m9FVDXU3GT2ITSe0UaMA5rU3QkfC/UXtCU8y0gSN/GugTqtVldOBWIB5V6V3sbmenVZUIpU6f+mPEO2+m5iTaA==",
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.2.tgz",
+      "integrity": "sha512-yXSS27qPExaXeuLvMRMXOLtpipzfQYNjG3FkunDWKGfMYjKuhFXko9CVzqxm8jcF+lmtS9Fd89QNdh9XDjnbNg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/gitignore-to-minimatch": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/gitignore-to-minimatch/-/gitignore-to-minimatch-1.0.2.tgz",
@@ -1338,9 +1352,9 @@
       }
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1424,17 +1438,17 @@
       }
     },
     "node_modules/@jest/console": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.4.1.tgz",
-      "integrity": "sha512-v3bhyxUh9Hgmo5p6hAOXe14/R3ZxZDOsvHleh4B07z3m/x4/ngPUXEm9XwK4sF4u+f+P2ORb0Ge+MgpaqRMVDA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.5.0.tgz",
+      "integrity": "sha512-BI1DpOedrJqbrYVi9yNhDWGjqphR/+gsM4STmg2+VaeXm7851hvpBDyKOZGMXATTrGEnFuEseQvLCtrrRmG0GQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1442,18 +1456,18 @@
       }
     },
     "node_modules/@jest/core": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.4.2.tgz",
-      "integrity": "sha512-TZJA6cPJUFxoWhxaLo8t0VX/MZX2wPWr0uIDvLSHIvN4gu9h02vSzqI2kBADG1ExqQlC+cY09xKMSreivvrChQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.5.0.tgz",
+      "integrity": "sha512-DLjRME+NY//j+UDTSfWnjoP0srrdR3DrJRy7yFZktGIwzpN2iVy2vMo0jziZ5c2Ij7bOwlJRXKVWtxZusazOJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/pattern": "30.4.0",
-        "@jest/reporters": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/pattern": "30.5.0",
+        "@jest/reporters": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "ansi-escapes": "^4.3.2",
         "chalk": "^4.1.2",
@@ -1461,20 +1475,20 @@
         "exit-x": "^0.2.2",
         "fast-json-stable-stringify": "^2.1.0",
         "graceful-fs": "^4.2.11",
-        "jest-changed-files": "30.4.1",
-        "jest-config": "30.4.2",
-        "jest-haste-map": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-resolve-dependencies": "30.4.2",
-        "jest-runner": "30.4.2",
-        "jest-runtime": "30.4.2",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
-        "jest-watcher": "30.4.1",
-        "pretty-format": "30.4.1",
+        "jest-changed-files": "30.5.0",
+        "jest-config": "30.5.0",
+        "jest-haste-map": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-resolve-dependencies": "30.5.0",
+        "jest-runner": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
+        "jest-watcher": "30.5.0",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1490,9 +1504,9 @@
       }
     },
     "node_modules/@jest/diff-sequences": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.4.0.tgz",
-      "integrity": "sha512-zOpzlfUs45l6u7jm39qr87JCHUDsaeCtvL+kQe/Vn9jSnRB4/5IPXISm0h9I1vZW/o00Kn4UTJ2MOlhnUGwv3g==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.5.0.tgz",
+      "integrity": "sha512-OsqBjHXCn8cadasoAZBP6nWYvMsRhpMzGXTpxJ5aO04NlbdhIz+FVe3q49l0AwVhsz/cEmIpBes6gAFl1/dWQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1500,61 +1514,61 @@
       }
     },
     "node_modules/@jest/environment": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.4.1.tgz",
-      "integrity": "sha512-AK9yNRqgKxiabqMoe4oW+3/TSSeV8vkdC7BGaxZdU0AFXfOpofTLqdru2GXKZghP3sdgwE9XXpnVwfZ8JnFV4w==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.5.0.tgz",
+      "integrity": "sha512-HUaqexIauIh69IQ4NTuPDEUCB8g8T4TOPSIzQOS18mwI/KEHKQk1j013K2o6ra031szZE2t5jGmVx3xbzdjgKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/fake-timers": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-mock": "30.4.1"
+        "jest-mock": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.4.1.tgz",
-      "integrity": "sha512-ginrj6TMgh2GshLUGCjO94Ptx9HhdZA/I6A9iUfyeLKFtdAjnKzHDgzgP9HYQgbxM1lbXScQ2eUBz2lGeVDPWA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.5.0.tgz",
+      "integrity": "sha512-jEmgmgJEobJ3zEhDOGp1VAJ6JkoVelpS8uZ1ae1Ul/5lP78UKJKmmU0lciJwd6JdnqOXHaaS/QCKwbf1dHI9MA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "expect": "30.4.1",
-        "jest-snapshot": "30.4.1"
+        "expect": "30.5.0",
+        "jest-snapshot": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.4.1.tgz",
-      "integrity": "sha512-ZBn5CglH8fBsQsvs4VWNzD4aWfUYks+IdOOQU3MEK71ol/BcVm+P+rtb1KpiFBpSWSCE27uOahyyf1vfqOVbcQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.5.0.tgz",
+      "integrity": "sha512-5j0ztPxSy3McUJihjkDdCyCfjvT2hxykFTWsgEBZKB8qsw9ALdCiGTpTRH5gnf/d+qI4SflYUJ0dWNbzjQCWbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0"
+        "@jest/get-type": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/fake-timers": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.4.1.tgz",
-      "integrity": "sha512-iW5umdmfPeWzehrVhugFQZqCchSCud5S1l2YT0O9ZhjRR0ExclANDZkiSBwzqtnlOn0J1JXvO+HZ6rkuyOVOgQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.5.0.tgz",
+      "integrity": "sha512-sg8xIbYwe5GdB/vT3/0qrDIpO7Ov9mazHi++M95uynmDKEZ70G1r169AWct73H07VrTZhrz1SJEfLtjYv8tE3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@sinonjs/fake-timers": "^15.4.0",
         "@types/node": "*",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1"
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -1571,9 +1585,9 @@
       }
     },
     "node_modules/@jest/get-type": {
-      "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
-      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.5.0.tgz",
+      "integrity": "sha512-9/2VUPitAjmBzbvDvqrxmvB7BzWsBW0WmkkojX1ODuxX1NLGxx9gfaZpHB0z8DtJ9uhGNmZG/VXBhf8uO0OV8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1581,62 +1595,78 @@
       }
     },
     "node_modules/@jest/globals": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.4.1.tgz",
-      "integrity": "sha512-ZbuY4cmXC8DkxYjfvT2DbcHWL2T6vmsMhXCDcmTB2T0y0gaezBI77ufq5ZAIdcRkYZ7NEQEDg1xFeKbxUJ5v5Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.5.0.tgz",
+      "integrity": "sha512-h7eJx534czwL8lQMYB0hwLT4/HquO8EX/RtYL7RNUHyUyWWVciYjoudN4Ns5JmNvn2/jh0Vm9UstZjEzJJ5EsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/expect": "30.4.1",
-        "@jest/types": "30.4.1",
-        "jest-mock": "30.4.1"
+        "@jest/environment": "30.5.0",
+        "@jest/expect": "30.5.0",
+        "@jest/types": "30.5.0",
+        "jest-mock": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/pattern": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.4.0.tgz",
-      "integrity": "sha512-RAWn3+f9u8BsHijKJ71uHcFp6vmyEt6VvoWXkl6hKF3qVIuWNmudVjg12DlBPGup/frIl5UcUlH5HfEuvHpEXg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.5.0.tgz",
+      "integrity": "sha512-HdNQYSdRTEBNrginaqzQtTjG0HRMfrra/z6Ok7uL3S87vSlarIVohEsJsSj5edu3MiHoHjAkvPROz5ZjoKai+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
-        "jest-regex-util": "30.4.0"
+        "jest-regex-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/@jest/react-is-18": {
+      "name": "react-is",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jest/react-is-19": {
+      "name": "react-is",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.8.tgz",
+      "integrity": "sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@jest/reporters": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.4.1.tgz",
-      "integrity": "sha512-/SnkPCzEQpUaBH81kjdEdDdo2WZl5hxw+BmLDGWjRkm8o7XlhjwsU36cqwe5PGBE5WYpBvDzRSdXx9rbGuJtNA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.5.0.tgz",
+      "integrity": "sha512-FEAuusWm+PUOn9ydjaHhpOpyPmS6IbGE04HaKTuUI4zd8eqYZiXiNLoCsdCog/l2XnNj53E9pFy64UltcvfJKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^0.2.3",
-        "@jest/console": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@jest/console": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "collect-v8-coverage": "^1.0.2",
         "exit-x": "^0.2.2",
-        "glob": "^10.5.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
         "istanbul-lib-coverage": "^3.0.0",
         "istanbul-lib-instrument": "^6.0.0",
         "istanbul-lib-report": "^3.0.0",
         "istanbul-lib-source-maps": "^5.0.0",
         "istanbul-reports": "^3.1.3",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-worker": "30.4.1",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-worker": "30.5.0",
         "slash": "^3.0.0",
         "string-length": "^4.0.2",
         "v8-to-istanbul": "^9.0.1"
@@ -1660,10 +1690,94 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@jest/reporters/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@jest/schemas": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.4.1.tgz",
-      "integrity": "sha512-i6b4qw5qnP8c5FEeBJg/uZQ4ddrkN6Ca8qISJh0pr7a5hfn3h3v5x60BEbOC7OYAGZNMs1LfFLwnW2CuK8F57Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.5.0.tgz",
+      "integrity": "sha512-/hunigyNpc4RCjC0VaW3f5RCUZVM2+WQ65qP7z083Gmvac7or2LI50XVNOtE4YPgBpV0yxYiAgorAPGniCoJmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1674,13 +1788,13 @@
       }
     },
     "node_modules/@jest/snapshot-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.4.1.tgz",
-      "integrity": "sha512-ObY4ljvQ95mt6iwKtVLetR/4yXiAgl3H4nJxhztr0MTjrN97TwDYrnCp/kF60Ec9HdhkWTHSu+Hg05aXfngpOA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.5.0.tgz",
+      "integrity": "sha512-iWQtIsi2dRsO2oWzVceOeynuRJiYTW8gsDVp5wFQ02ipHluQsNgBpasWSHiawVxukIlsGLdCtCSbIEK7fPtpvQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
         "natural-compare": "^1.4.0"
@@ -1690,14 +1804,15 @@
       }
     },
     "node_modules/@jest/source-map": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.0.1.tgz",
-      "integrity": "sha512-MIRWMUUR3sdbP36oyNyhbThLHyJ2eEDClPCiHVbrYAe5g3CHRArIVpBw7cdSB5fr+ofSfIb2Tnsw8iEHL0PYQg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.5.0.tgz",
+      "integrity": "sha512-xWpTJP9D0bDFGbPGT8XuWSwwha/iHADyyKzUnMx4UbdgnHugxrDaQFO4RZ8x4ZsFzRP6pNii8uvlgKCDxCIuDg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "callsites": "^3.1.0",
+        "convert-source-map": "^2.0.0",
         "graceful-fs": "^4.2.11"
       },
       "engines": {
@@ -1705,14 +1820,14 @@
       }
     },
     "node_modules/@jest/test-result": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.4.1.tgz",
-      "integrity": "sha512-/ZG7pgEiOmmWkN9TplKbOu4id2N5lh7FHwRwlkgBVAzGdRH+OkkQ8wX/kIxg4zmd3ZQvAL1RwL2yWsvNYYECTw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.5.0.tgz",
+      "integrity": "sha512-9IlPqUzUMkVDmoDqSSrVVLroVotgN3hTUPWPwq24XWXhh1Zpg915RXZ5pgRJ/7j4YE/kng5nqjSn4p3S68SZJA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "collect-v8-coverage": "^1.0.2"
       },
@@ -1721,15 +1836,15 @@
       }
     },
     "node_modules/@jest/test-sequencer": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.4.1.tgz",
-      "integrity": "sha512-PeYE+4td5rKjoRPxztObrXU+H8hsjZfxKMXOcmrr34JerSyB/ROOxbbicz8B7A5j9R9VayDnVPvBmedqCsFCdw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.5.0.tgz",
+      "integrity": "sha512-TXlvSDIVv482b83hD8A8WtxDJEmGF47f60W6jRXOQL0Isfs3hKtk4rZIm9R/jLzAibg8+c56y+Q00BQs8R7Xcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/test-result": "30.4.1",
+        "@jest/test-result": "30.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
+        "jest-haste-map": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1737,23 +1852,23 @@
       }
     },
     "node_modules/@jest/transform": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.4.1.tgz",
-      "integrity": "sha512-Wz0LyktlTvRefoymh+n64hQ84KNXsRGcwdoZ8CSa0Ea+fgYcHZlnk+hDP7v2MS7il2bQ5uTEIxf4/NNfhMN4KQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.5.0.tgz",
+      "integrity": "sha512-n1cYhoByyULEIXi64wbT4Lq91qeT1E6bwpM//sprFXhw955qaiHTdAmy1c1rNFGB6fCf1J+nxDUSf3RGwgZP5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.27.4",
-        "@jest/types": "30.4.1",
-        "@jridgewell/trace-mapping": "^0.3.25",
-        "babel-plugin-istanbul": "^7.0.1",
+        "@jest/types": "30.5.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "babel-plugin-istanbul": "^8.0.0",
         "chalk": "^4.1.2",
         "convert-source-map": "^2.0.0",
         "fast-json-stable-stringify": "^2.1.0",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-util": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-util": "30.5.0",
         "pirates": "^4.0.7",
         "slash": "^3.0.0",
         "write-file-atomic": "^5.0.1"
@@ -1763,14 +1878,14 @@
       }
     },
     "node_modules/@jest/types": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
-      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.5.0.tgz",
+      "integrity": "sha512-s1N+79S4Yp9ZgklCauZXi+YPJdCdtStNYQT32stuD6EeQaIBGHoUfyj2P0YWy8RmuQfaJboO+ulxEvEheR/POQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/pattern": "30.4.0",
-        "@jest/schemas": "30.4.1",
+        "@jest/pattern": "30.5.0",
+        "@jest/schemas": "30.5.0",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "@types/istanbul-reports": "^3.0.4",
         "@types/node": "*",
@@ -1860,16 +1975,25 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
-      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.3.tgz",
+      "integrity": "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.4.3",
-        "@emnapi/runtime": "^1.4.3",
-        "@tybys/wasm-util": "^0.10.0"
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4"
       }
     },
     "node_modules/@nodelib/fs.scandir": {
@@ -1910,6 +2034,311 @@
         "node": ">= 8"
       }
     },
+    "node_modules/@parcel/watcher": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.6.0.tgz",
+      "integrity": "sha512-7FNeNl8NCE7aINx7WXiKQrPYZWC/hvrTsmk6zmxbI7LTXE7hVek/n8AfVgpe2y82zl3w0HvCHN0bVKMBoJcC0w==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.3",
+        "is-glob": "^4.0.3",
+        "node-addon-api": "^7.0.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher-android-arm64": "2.6.0",
+        "@parcel/watcher-darwin-arm64": "2.6.0",
+        "@parcel/watcher-darwin-x64": "2.6.0",
+        "@parcel/watcher-freebsd-x64": "2.6.0",
+        "@parcel/watcher-linux-arm-glibc": "2.6.0",
+        "@parcel/watcher-linux-arm-musl": "2.6.0",
+        "@parcel/watcher-linux-arm64-glibc": "2.6.0",
+        "@parcel/watcher-linux-arm64-musl": "2.6.0",
+        "@parcel/watcher-linux-x64-glibc": "2.6.0",
+        "@parcel/watcher-linux-x64-musl": "2.6.0",
+        "@parcel/watcher-win32-arm64": "2.6.0",
+        "@parcel/watcher-win32-x64": "2.6.0"
+      }
+    },
+    "node_modules/@parcel/watcher-android-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.6.0.tgz",
+      "integrity": "sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.6.0.tgz",
+      "integrity": "sha512-Y3QV0gl7Q1zbfueunkWIERICbEojQFCgpyG7YqOGNFLsckXyI1xu9mAIUpKY9QBYzBtSkN8dBPwd3yiAO9ovMw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.6.0.tgz",
+      "integrity": "sha512-Ohv6OpzhUfKYD7Beb8kDvG0jbIxORCYY1JRdZnaBtnjjkJxgD7ZVL0nw2sCYd0yTMKTvz3nnTnOF3cDifK+kvw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-freebsd-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.6.0.tgz",
+      "integrity": "sha512-5HmXvDgs8VK+74jF9y9/2FE3/OnlcKmc56tjmSrEuZjpSZOGL+fvAu+HKJBdPs9uwoP2hE6TlSUpXZ/C5jUFmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.6.0.tgz",
+      "integrity": "sha512-Ps/hui3A+vMbjdqlqAowK2ZL8+BO8dBjxeWXj6npTBs3jx4wWmbPpaLuqwrQrSqIVMCnpWo238bJ1U37GhQOYg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.6.0.tgz",
+      "integrity": "sha512-9c6AUHgHoG+IY88MRIHupztQiQnrbqHYQjkM2btA+Bf/wQnQMuiD0Wfk1EVv3TlNT3x41uU71rn6E4xh/+zvkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.6.0.tgz",
+      "integrity": "sha512-yHRqS2owEXe6Hic9z6Mh1ECsCd+ODVOGvZDyciqRd21+v+o+DnXMOrw50DSpIG2sb8GPEaPPmfeCAWKPJdq46g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.6.0.tgz",
+      "integrity": "sha512-WhB2e/V7rqdHHWZusBSPuy5Ei8S6lSz6FE5TKKQz5h3a0O+C+mhY7vxU9b/stqvMb8beLnPY82ZrFTLKs+SrKA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.6.0.tgz",
+      "integrity": "sha512-ulGE6x6Oz6iAwg75T8YQSoguBWasniIbX+QWpaYPcCnDOpdWX3k+4xbEYPZVLxOuoJI+svJJPD3sEj8G7lrQ3A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.6.0.tgz",
+      "integrity": "sha512-tkBYKt7YQrjIJWYDnto2YgO8MRkjlMTSNoRHzsXinBqbLdeOM3L32wPZJvIZxqaLMfSlS/4sUjH/6STVP/XDLw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.6.0.tgz",
+      "integrity": "sha512-gIZAP23jaHjGWasY/TY6yL7NHFClf0Ga7FN+iINvk+KN94rhm94lYZhFsbYFNcA04/onvGD9kKmiJLJB2HbNwQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.6.0.tgz",
+      "integrity": "sha512-cA+/pXV2YkfxlIcXOQ5fSWqAzzPyD78/x5qbK/I0vUkrlYHA8TIz+MXjAbGouguKVSI4bOmkTSJ1/poVSsgt+A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -1922,13 +2351,13 @@
       }
     },
     "node_modules/@pkgr/core": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
+      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+        "node": "^14.18.0 || >=16.0.0"
       },
       "funding": {
         "url": "https://opencollective.com/pkgr"
@@ -1953,9 +2382,9 @@
       "license": "MIT"
     },
     "node_modules/@sinclair/typebox": {
-      "version": "0.34.49",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
-      "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==",
+      "version": "0.34.52",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
+      "integrity": "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==",
       "dev": true,
       "license": "MIT"
     },
@@ -2023,9 +2452,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2377,16 +2806,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
@@ -2474,16 +2903,16 @@
       }
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/@unrs/resolver-binding-android-arm-eabi": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.11.1.tgz",
-      "integrity": "sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.12.2.tgz",
+      "integrity": "sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==",
       "cpu": [
         "arm"
       ],
@@ -2495,9 +2924,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-android-arm64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.11.1.tgz",
-      "integrity": "sha512-lCxkVtb4wp1v+EoN+HjIG9cIIzPkX5OtM03pQYkG+U5O/wL53LC4QbIeazgiKqluGeVEeBlZahHalCaBvU1a2g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.12.2.tgz",
+      "integrity": "sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==",
       "cpu": [
         "arm64"
       ],
@@ -2509,9 +2938,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-darwin-arm64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.11.1.tgz",
-      "integrity": "sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.12.2.tgz",
+      "integrity": "sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==",
       "cpu": [
         "arm64"
       ],
@@ -2523,9 +2952,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-darwin-x64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.11.1.tgz",
-      "integrity": "sha512-cFzP7rWKd3lZaCsDze07QX1SC24lO8mPty9vdP+YVa3MGdVgPmFc59317b2ioXtgCMKGiCLxJ4HQs62oz6GfRQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.12.2.tgz",
+      "integrity": "sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==",
       "cpu": [
         "x64"
       ],
@@ -2537,9 +2966,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-freebsd-x64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.11.1.tgz",
-      "integrity": "sha512-fqtGgak3zX4DCB6PFpsH5+Kmt/8CIi4Bry4rb1ho6Av2QHTREM+47y282Uqiu3ZRF5IQioJQ5qWRV6jduA+iGw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.12.2.tgz",
+      "integrity": "sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==",
       "cpu": [
         "x64"
       ],
@@ -2551,9 +2980,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm-gnueabihf": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.11.1.tgz",
-      "integrity": "sha512-u92mvlcYtp9MRKmP+ZvMmtPN34+/3lMHlyMj7wXJDeXxuM0Vgzz0+PPJNsro1m3IZPYChIkn944wW8TYgGKFHw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.12.2.tgz",
+      "integrity": "sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==",
       "cpu": [
         "arm"
       ],
@@ -2565,9 +2994,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm-musleabihf": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.11.1.tgz",
-      "integrity": "sha512-cINaoY2z7LVCrfHkIcmvj7osTOtm6VVT16b5oQdS4beibX2SYBwgYLmqhBjA1t51CarSaBuX5YNsWLjsqfW5Cw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.12.2.tgz",
+      "integrity": "sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==",
       "cpu": [
         "arm"
       ],
@@ -2579,13 +3008,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.11.1.tgz",
-      "integrity": "sha512-34gw7PjDGB9JgePJEmhEqBhWvCiiWCuXsL9hYphDF7crW7UgI05gyBAi6MF58uGcMOiOqSJ2ybEeCvHcq0BCmQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.12.2.tgz",
+      "integrity": "sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2593,13 +3025,50 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.11.1.tgz",
-      "integrity": "sha512-RyMIx6Uf53hhOtJDIamSbTskA99sPHS96wxVE/bJtePJJtpdKGXO1wY90oRdXuYOGOTuqjT8ACccMc4K6QmT3w==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.12.2.tgz",
+      "integrity": "sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-gnu/-/resolver-binding-linux-loong64-gnu-1.12.2.tgz",
+      "integrity": "sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-musl/-/resolver-binding-linux-loong64-musl-1.12.2.tgz",
+      "integrity": "sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2607,13 +3076,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-ppc64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.11.1.tgz",
-      "integrity": "sha512-D8Vae74A4/a+mZH0FbOkFJL9DSK2R6TFPC9M+jCWYia/q2einCubX10pecpDiTmkJVUH+y8K3BZClycD8nCShA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.12.2.tgz",
+      "integrity": "sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2621,13 +3093,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-riscv64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.11.1.tgz",
-      "integrity": "sha512-frxL4OrzOWVVsOc96+V3aqTIQl1O2TjgExV4EKgRY09AJ9leZpEg8Ak9phadbuX0BA4k8U5qtvMSQQGGmaJqcQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.12.2.tgz",
+      "integrity": "sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2635,13 +3110,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-riscv64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.11.1.tgz",
-      "integrity": "sha512-mJ5vuDaIZ+l/acv01sHoXfpnyrNKOk/3aDoEdLO/Xtn9HuZlDD6jKxHlkN8ZhWyLJsRBxfv9GYM2utQ1SChKew==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.12.2.tgz",
+      "integrity": "sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2649,13 +3127,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-s390x-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.11.1.tgz",
-      "integrity": "sha512-kELo8ebBVtb9sA7rMe1Cph4QHreByhaZ2QEADd9NzIQsYNQpt9UkM9iqr2lhGr5afh885d/cB5QeTXSbZHTYPg==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.12.2.tgz",
+      "integrity": "sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==",
       "cpu": [
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2663,13 +3144,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-x64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.11.1.tgz",
-      "integrity": "sha512-C3ZAHugKgovV5YvAMsxhq0gtXuwESUKc5MhEtjBpLoHPLYM+iuwSj3lflFwK3DPm68660rZ7G8BMcwSro7hD5w==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.12.2.tgz",
+      "integrity": "sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2677,23 +3161,40 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-x64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.11.1.tgz",
-      "integrity": "sha512-rV0YSoyhK2nZ4vEswT/QwqzqQXw5I6CjoaYMOX0TqBlWhojUf8P94mvI7nuJTeaCkkds3QE4+zS8Ko+GdXuZtA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.12.2.tgz",
+      "integrity": "sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ]
     },
+    "node_modules/@unrs/resolver-binding-openharmony-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-openharmony-arm64/-/resolver-binding-openharmony-arm64-1.12.2.tgz",
+      "integrity": "sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
     "node_modules/@unrs/resolver-binding-wasm32-wasi": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.11.1.tgz",
-      "integrity": "sha512-5u4RkfxJm+Ng7IWgkzi3qrFOvLvQYnPBmjmZQ8+szTK/b31fQCnleNl1GgEt7nIsZRIf5PLhPwT0WM+q45x/UQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.12.2.tgz",
+      "integrity": "sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==",
       "cpu": [
         "wasm32"
       ],
@@ -2701,16 +3202,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@napi-rs/wasm-runtime": "^0.2.11"
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.11.1.tgz",
-      "integrity": "sha512-nRcz5Il4ln0kMhfL8S3hLkxI85BXs3o8EYoattsJNdsX4YUU89iOkVn7g0VHSRxFuVMdM4Q1jEpIId1Ihim/Uw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
+      "integrity": "sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==",
       "cpu": [
         "arm64"
       ],
@@ -2722,9 +3225,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-win32-ia32-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.11.1.tgz",
-      "integrity": "sha512-DCEI6t5i1NmAZp6pFonpD5m7i6aFrpofcp4LA2i8IIq60Jyo28hamKBxNrZcyOwVOZkgsRp9O2sXWBWP8MnvIQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.12.2.tgz",
+      "integrity": "sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==",
       "cpu": [
         "ia32"
       ],
@@ -2736,9 +3239,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.11.1.tgz",
-      "integrity": "sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
+      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
       "cpu": [
         "x64"
       ],
@@ -3180,16 +3683,16 @@
       }
     },
     "node_modules/babel-jest": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.4.1.tgz",
-      "integrity": "sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.5.0.tgz",
+      "integrity": "sha512-PrhPHlKC+MsLnuNzgIH/y1dkz1f6cSfKWaQeaG8WxLMuG44dYWQ8E9uRrsBbAGCU/3+BEFYPN4d6G3Zc5Y+waA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/transform": "30.4.1",
+        "@jest/transform": "30.5.0",
         "@types/babel__core": "^7.20.5",
-        "babel-plugin-istanbul": "^7.0.1",
-        "babel-preset-jest": "30.4.0",
+        "babel-plugin-istanbul": "^8.0.0",
+        "babel-preset-jest": "30.5.0",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
         "slash": "^3.0.0"
@@ -3202,9 +3705,9 @@
       }
     },
     "node_modules/babel-plugin-istanbul": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-7.0.1.tgz",
-      "integrity": "sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-8.0.0.tgz",
+      "integrity": "sha512-18wCskrN3DgbuBmp1gr7LBGT8xdz5xhQQqFvFhVxbkl8VBCrMKQ2YtqBWtUal1Zrc1HTuX0011+Brjw78TCFkg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "workspaces": [
@@ -3215,53 +3718,70 @@
         "@istanbuljs/load-nyc-config": "^1.0.0",
         "@istanbuljs/schema": "^0.1.3",
         "istanbul-lib-instrument": "^6.0.2",
-        "test-exclude": "^6.0.0"
+        "test-exclude": "^7.0.1"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
-    "node_modules/babel-plugin-istanbul/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+    "node_modules/babel-plugin-istanbul/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/babel-plugin-istanbul/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "*"
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/babel-plugin-istanbul/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/babel-plugin-istanbul/node_modules/test-exclude": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.2.tgz",
+      "integrity": "sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
+        "glob": "^10.4.1",
+        "minimatch": "^10.2.2"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
     "node_modules/babel-plugin-jest-hoist": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz",
-      "integrity": "sha512-9EdtWM/sSfXLOGLwSn+GS6pIXyBnL07/8gyJlwFXjWy4DxMOyItqyUT29d4lQiS380EZwYlX7/At4PgBS+m2aA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.5.0.tgz",
+      "integrity": "sha512-gtGo1B+u14jrZQv6TdSWIWkTqclboo7Qn+dFAGUOIuXLFuJKAdg3U5MIWzZnW4vfUb4dX9skmAMiby86e/SF4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3299,20 +3819,20 @@
       }
     },
     "node_modules/babel-preset-jest": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.4.0.tgz",
-      "integrity": "sha512-lBY4jxsNmCnSiu7kquw8ZC9F4+XLMOKypT3RnNHPvU2Kpd4W0xaPuLr5ZkRyOsvLYAY4yaW1ZwTW4xB7NIiZzg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.5.0.tgz",
+      "integrity": "sha512-ZGPn5ClP4lBDpuOK8W1yQIOy359HmbnZv3suucAlIe+SEE9yDsxV4S2PjSbH2Vc97U+WmzYD7vw3kr8NsQ/i6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "babel-plugin-jest-hoist": "30.4.0",
+        "babel-plugin-jest-hoist": "30.5.0",
         "babel-preset-current-node-syntax": "^1.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       },
       "peerDependencies": {
-        "@babel/core": "^7.11.0 || ^8.0.0-beta.1"
+        "@babel/core": "^7.11.0 || ^8.0.0-beta.1 || ^8.0.0"
       }
     },
     "node_modules/balanced-match": {
@@ -3323,9 +3843,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.29",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.29.tgz",
-      "integrity": "sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3367,16 +3887,16 @@
       }
     },
     "node_modules/borp/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/borp/node_modules/c8": {
@@ -3504,9 +4024,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3528,9 +4048,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "dev": true,
       "funding": [
         {
@@ -3548,11 +4068,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -3571,13 +4091,6 @@
         "node-int64": "^0.4.0"
       }
     },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/c8": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/c8/-/c8-12.0.0.tgz",
@@ -3859,9 +4372,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001792",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001792.tgz",
-      "integrity": "sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -3923,9 +4436,9 @@
       }
     },
     "node_modules/cjs-module-lexer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
-      "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.1.tgz",
+      "integrity": "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -4269,6 +4782,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/detect-newline": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -4351,9 +4874,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.354",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.354.tgz",
-      "integrity": "sha512-JaBHwWcfIdmSAfWM5l3uwjGd431j8YEMikZ+K/2nXVuBqJKyZ0f+2h4n4JY5AyNiZmnY9qQr2RU3v9DxDmHMNg==",
+      "version": "1.5.416",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.416.tgz",
+      "integrity": "sha512-K6bvB2BjnNrugtIih6ewlbBI9DXa976jIdiIlRLHhBoEI9a4JaQjjHyF+A1IQI543aQYR4LnmOrT/K5fZj0aPA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4518,6 +5041,13 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
@@ -4579,9 +5109,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -4592,32 +5122,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.1",
-        "@esbuild/android-arm": "0.28.1",
-        "@esbuild/android-arm64": "0.28.1",
-        "@esbuild/android-x64": "0.28.1",
-        "@esbuild/darwin-arm64": "0.28.1",
-        "@esbuild/darwin-x64": "0.28.1",
-        "@esbuild/freebsd-arm64": "0.28.1",
-        "@esbuild/freebsd-x64": "0.28.1",
-        "@esbuild/linux-arm": "0.28.1",
-        "@esbuild/linux-arm64": "0.28.1",
-        "@esbuild/linux-ia32": "0.28.1",
-        "@esbuild/linux-loong64": "0.28.1",
-        "@esbuild/linux-mips64el": "0.28.1",
-        "@esbuild/linux-ppc64": "0.28.1",
-        "@esbuild/linux-riscv64": "0.28.1",
-        "@esbuild/linux-s390x": "0.28.1",
-        "@esbuild/linux-x64": "0.28.1",
-        "@esbuild/netbsd-arm64": "0.28.1",
-        "@esbuild/netbsd-x64": "0.28.1",
-        "@esbuild/openbsd-arm64": "0.28.1",
-        "@esbuild/openbsd-x64": "0.28.1",
-        "@esbuild/openharmony-arm64": "0.28.1",
-        "@esbuild/sunos-x64": "0.28.1",
-        "@esbuild/win32-arm64": "0.28.1",
-        "@esbuild/win32-ia32": "0.28.1",
-        "@esbuild/win32-x64": "0.28.1"
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
       }
     },
     "node_modules/escalade": {
@@ -5149,18 +5679,18 @@
       }
     },
     "node_modules/expect": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-30.4.1.tgz",
-      "integrity": "sha512-PMARsyh/JtqC20HoGqlFcIlQAyqUtW4PlI1rup1uhYJtKuwAjbvWi3GQMAn+STdHum/dk8xrKfUM1+5SAwpolA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-30.5.0.tgz",
+      "integrity": "sha512-8fiMWcEjPU7B9nErC4FtFcCzf2tC6I75Qf7m8wzBAWC2taZmcno3yAFEjIQL34SwoGZNgPf63UDiJLyh4SMPaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/expect-utils": "30.4.1",
-        "@jest/get-type": "30.1.0",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1"
+        "@jest/expect-utils": "30.5.0",
+        "@jest/get-type": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -5392,28 +5922,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@ -5631,9 +6139,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5971,25 +6479,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/internal-slot": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -6515,9 +7004,9 @@
       }
     },
     "node_modules/istanbul-lib-instrument/node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -6606,16 +7095,16 @@
       }
     },
     "node_modules/jest": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-30.4.2.tgz",
-      "integrity": "sha512-Yi1jqNC/Oq0N4hBgNH/YvBpP1P57QqundgytzYqy3yqAa7NZPNjSoi4SGbRAXDMdBzNE6xBCi5U7RgfrvMEUVQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest/-/jest-30.5.0.tgz",
+      "integrity": "sha512-HeFeOUEKh5gjnp1rjuSCse8Dhj0Y3KA8lsZ3azr4Wnq1nCxwMBu35MDc9mp8iblZxmeAz6wV4P241tyUB7J2Ew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/core": "30.4.2",
-        "@jest/types": "30.4.1",
+        "@jest/core": "30.5.0",
+        "@jest/types": "30.5.0",
         "import-local": "^3.2.0",
-        "jest-cli": "30.4.2"
+        "jest-cli": "30.5.0"
       },
       "bin": {
         "jest": "bin/jest.js"
@@ -6633,14 +7122,14 @@
       }
     },
     "node_modules/jest-changed-files": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.4.1.tgz",
-      "integrity": "sha512-IuctmYrxi21iOSOaIXpJWalHyPAsVv0GeBHKDn8C1CA4W5htHn7INL+wdnL4Bo0+olEndvAFkmb++tIQJG+vvg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.5.0.tgz",
+      "integrity": "sha512-dq1x8JiEnHkJDxxOrF6UJDivBRAQMwAa5tzr+VX3um0SfyMFseUPQUbe51wLwggfoa5h/EmOtSpdJxxkzSlNRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "execa": "^5.1.1",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "p-limit": "^3.1.0"
       },
       "engines": {
@@ -6738,29 +7227,29 @@
       }
     },
     "node_modules/jest-circus": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.4.2.tgz",
-      "integrity": "sha512-rvHH7VlY6LgbJXJTQ87GW62g1FntOtbhh0zT+v04kC+pgL6aBKyYINXxWukCpj3dcIBMw5/XUbtDS9dU9JTXeQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.5.0.tgz",
+      "integrity": "sha512-T3v7uM4wwCu+RQicjsAWCgoL3CiyuX3THSKwv2uMb9N2bMUgb+HfwDWEUma85vOGbvQNQ/YfoCXF1OCZot0ZEw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/expect": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/expect": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "co": "^4.6.0",
         "dedent": "^1.6.0",
         "is-generator-fn": "^2.1.0",
-        "jest-each": "30.4.1",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-runtime": "30.4.2",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-each": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
         "p-limit": "^3.1.0",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "pure-rand": "^7.0.0",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
@@ -6787,21 +7276,21 @@
       "license": "MIT"
     },
     "node_modules/jest-cli": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.4.2.tgz",
-      "integrity": "sha512-jfA2ocvVHMXS2QijrJ0d31ektP+d/W0T5RpcTX2Pq+3sVqHlsXVCM2+FmwpL+bdY8OfHpIg9xMxLF17Zg0U49Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.5.0.tgz",
+      "integrity": "sha512-QHZMiy32x2K+NzJ1AuuoCAVc1Y5co0VXib3R7kD9MWcWFflzsD1eJN0wR+mkNlM+ts7C+Bjz0oOoFE5IiHylCg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/core": "30.4.2",
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/core": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
         "exit-x": "^0.2.2",
         "import-local": "^3.2.0",
-        "jest-config": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-config": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "yargs": "^17.7.2"
       },
       "bin": {
@@ -6820,33 +7309,33 @@
       }
     },
     "node_modules/jest-config": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.4.2.tgz",
-      "integrity": "sha512-rNHAShJQqQwFNoL0hbf3BphSBOWnpOUAKvidLS/AjNVLPfoj5mSf4jQMfW3cYOs6hXeZC7nF7mDHaBnbxELOzg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.5.0.tgz",
+      "integrity": "sha512-gYQl2FqYgiVpyuB7DutBIbJRWaq5VcHdzOXJJ51HNa8J5JrsZehIlzNFW0/9s5uvvcbzM5/LTUizYSbsFErv+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.27.4",
-        "@jest/get-type": "30.1.0",
-        "@jest/pattern": "30.4.0",
-        "@jest/test-sequencer": "30.4.1",
-        "@jest/types": "30.4.1",
-        "babel-jest": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/pattern": "30.5.0",
+        "@jest/test-sequencer": "30.5.0",
+        "@jest/types": "30.5.0",
+        "babel-jest": "30.5.0",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
         "deepmerge": "^4.3.1",
-        "glob": "^10.5.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "jest-circus": "30.4.2",
-        "jest-docblock": "30.4.0",
-        "jest-environment-node": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-runner": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-circus": "30.5.0",
+        "jest-docblock": "30.5.0",
+        "jest-environment-node": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-runner": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "parse-json": "^5.2.0",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0",
         "strip-json-comments": "^3.1.1"
       },
@@ -6870,26 +7359,110 @@
         }
       }
     },
+    "node_modules/jest-config/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-config/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-config/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jest-diff": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz",
-      "integrity": "sha512-CRpFK0RtLriVDGcPPAnR6HMVI8bSR2jnUIgralhauzYQZIb4RH9AtEInTuQr65LmmGggGcRT6HIASxwqsVsmlA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.5.0.tgz",
+      "integrity": "sha512-QjCfDMwdPFvLxTQmS4/Dswx3PUCiqmSXVLGljMC3SU7YG1qHVoR6b86IH/O2G9k9OMyKXz2vS2Q60VnAozNDwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/diff-sequences": "30.4.0",
-        "@jest/get-type": "30.1.0",
+        "@jest/diff-sequences": "30.5.0",
+        "@jest/get-type": "30.5.0",
         "chalk": "^4.1.2",
-        "pretty-format": "30.4.1"
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-docblock": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.4.0.tgz",
-      "integrity": "sha512-ZPMabUZCx5MpbZ2eBYSvZ0J8fvo3dR9oM+eeUpb3aKNQFuS2tu3Duw1TNlMoP8k3WQgKGJuhcMFvwcVuq6T7oA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.5.0.tgz",
+      "integrity": "sha512-NwDqcxtoZi33RhuW+zJS/RVA3rmheQ8BnwpYZuc/Eruaz6seQb7+aoCeDZu/3X7W2XmD8DbSo9Pn72DbKsBFYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6900,36 +7473,36 @@
       }
     },
     "node_modules/jest-each": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.4.1.tgz",
-      "integrity": "sha512-/8MJbH6fuj48TstjrMf+u/pd06Qezz5xOXvZA6442heNOWr8bdeoGZX2d9fCn028CoMgYmroH9//zky5GfyYmA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.5.0.tgz",
+      "integrity": "sha512-NiMFNhRygJEFqYNt8pnkxppUF6CR486GEpt9rSU6lPBf7KeccaOL0zbjxG8fgJgD//6e7zYdssnlt6j+1kI31A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "@jest/types": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
-        "jest-util": "30.4.1",
-        "pretty-format": "30.4.1"
+        "jest-util": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-environment-node": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.4.1.tgz",
-      "integrity": "sha512-4FZYVOk85hz2AyT6BbarKy9u37g6DbrDyCdFhsnDdXqyrueYQvB+0zO4f/kqLCRD0BsPRXPMNJeQwihKZV8naw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.5.0.tgz",
+      "integrity": "sha512-bTc79ywKLz0ogbT3JIYuEhgWV4Ffd/cJe06co4v8CyRtlmju8x5gokMlGFR8ARWhmk5SnbDRxmf50XWnlZVhDg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/fake-timers": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1"
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -6946,75 +7519,73 @@
       }
     },
     "node_modules/jest-haste-map": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.4.1.tgz",
-      "integrity": "sha512-rFrcONd8jeFsyw+Z9CrScJgglRf2+NFmNam8dKu7n+SoHqNYT47mn0DdEcVUZJpvh7Iz6/si7f7yUH7GJHVgnw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.5.0.tgz",
+      "integrity": "sha512-0FStogBslBVOEqTOJr4oXMtFitmrWp9WscG6Gbns88i0YAuMXijCT2G5VMfg/HCR4QAnL+OF2C2ednag+HlDuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
+        "@parcel/watcher": "^2.6.0",
         "@types/node": "*",
         "anymatch": "^3.1.3",
         "fb-watchman": "^2.0.2",
+        "fdir": "^6.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-regex-util": "30.4.0",
-        "jest-util": "30.4.1",
-        "jest-worker": "30.4.1",
-        "picomatch": "^4.0.3",
-        "walker": "^1.0.8"
+        "jest-regex-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-worker": "30.5.0",
+        "picomatch": "^4.0.3"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "^2.3.3"
       }
     },
     "node_modules/jest-leak-detector": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.4.1.tgz",
-      "integrity": "sha512-IpmyiioeHxiWDhesHnUFmOxcTzwCwKpgACgWajtAP+nYQXiY7DakTxB6Bx9JFiRMljr0AX1PvnQdaU1KFoz6NQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.5.0.tgz",
+      "integrity": "sha512-Mq11ceAkNR250Iv45RoOwuG9fb4kYbJ02qoyL7A0nCI8FV5+aG/THmcEUx5uR2dNSa4KOtz+xBKrJ8cZPhPpuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "pretty-format": "30.4.1"
+        "@jest/get-type": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-matcher-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.4.1.tgz",
-      "integrity": "sha512-zvYfX5CaeEkFrrLS9suWe9rvJrm9J1Iv3ua8kIBv9GEPzcnsfBf0bob37la7s67fs0nlBC3EuvkOLnXQKxtx4A==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.5.0.tgz",
+      "integrity": "sha512-EfaYMC9f9ds7fahB/LYFTgd1Z2RS9Vpm2e46gazij0onkpoQG7Daq+MLm8/gQVqWwRVjL/RNDggbFx9MsrJEmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
+        "@jest/get-type": "30.5.0",
         "chalk": "^4.1.2",
-        "jest-diff": "30.4.1",
-        "pretty-format": "30.4.1"
+        "jest-diff": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-message-util": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.4.1.tgz",
-      "integrity": "sha512-kwCKIvq0MCW1HzLoGola9Te6JUdzgV0loyKJ3Qghrkz9i5/RRIHsL95BMQc2HBBhlBKC4j22K9p11TGHH8RBpQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.5.0.tgz",
+      "integrity": "sha512-dBYMhplGfspKaCnVk9TUy1cZnknWubpuPNEputjz0YJk1G/92R45rn45BvbPMPMtC5LVcIdxJGPOaOSQTiuzJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/stack-utils": "^2.0.3",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "picomatch": "^4.0.3",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
       },
@@ -7023,42 +7594,25 @@
       }
     },
     "node_modules/jest-mock": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.4.1.tgz",
-      "integrity": "sha512-/i8SVb8/NSB7RfNi8gfqu8gxLV23KaL5EpAttyb9iz8qWRIqXRLflycz/32wXsYkOnaUlx8NAKnJYtpsmXUmfw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.5.0.tgz",
+      "integrity": "sha512-bP5MHZpkYrV7xpV+yvhl36DPcXoEmTR57Un5EACcdVpMY7mpkDefCBq+V4mhcjE/3rwUajT6OTrcJTN7EwN1BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/expect-utils": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-util": "30.4.1"
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/jest-pnp-resolver": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
-      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "peerDependencies": {
-        "jest-resolve": "*"
-      },
-      "peerDependenciesMeta": {
-        "jest-resolve": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/jest-regex-util": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.4.0.tgz",
-      "integrity": "sha512-mWlvLviKIgIQ8VCuM1xRdD0TWp3zlzionlmDBjuXVBs+VkmXq6FgW9T4Emr7oGz/Rk6feDCGyiugolcQEyp3mg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.5.0.tgz",
+      "integrity": "sha512-Mg0WK7A6xRHLSA1udJ8y9f3lM0uUhFTBnLKzwPmqB9AylvpleJ6BLemR8K9dK27DY+cesDryoA7yLZCAHsPG1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7066,100 +7620,100 @@
       }
     },
     "node_modules/jest-resolve": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.4.1.tgz",
-      "integrity": "sha512-Zry8Yq/yJcNAZ7dJ5F2heic8AheXvbFZ7XI5V+h28nrYZ7Qoyy4dItq8OodjnYD270mvX+ZudmrNV9cysqhW5Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.5.0.tgz",
+      "integrity": "sha512-NFvQWJ4G7e2kN5712iG+12Xr325NRFGAIhovrwLfgq5Oqd4bFHITw4CzcFkZGp1GTCqemC4v1l8/yZzedKZkjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-pnp-resolver": "^1.2.3",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "slash": "^3.0.0",
-        "unrs-resolver": "^1.7.11"
+        "unrs-resolver": "^1.12.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-resolve-dependencies": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.4.2.tgz",
-      "integrity": "sha512-gDiVh1I+GxYzz9oXlyw+1wv6VOYX1WYxMOfjsA3iGKePV2oxmbHhwxfkALxNxYy1ciw6APWwkW2zZONwP97aEQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.5.0.tgz",
+      "integrity": "sha512-TnSBAp3wGOnqXBmLT3OXtJkugw6Vj2KU0IPde2EJmbGns/QMoNlkauJ7jZ8KYaxONSpx0o4pUvi+u1Q/LSk3Pg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "jest-regex-util": "30.4.0",
-        "jest-snapshot": "30.4.1"
+        "jest-regex-util": "30.5.0",
+        "jest-snapshot": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-runner": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.4.2.tgz",
-      "integrity": "sha512-2dw0PslVYXxffXGpLo+Ejad+KcI1Qkjn7f4X4619gf21oCUmL+SPfjqIa/losUem3yEOvfNZe/F1HWUcNpODcg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.5.0.tgz",
+      "integrity": "sha512-Q6Yt+1LvXvEstvru6sQLT7OQYC77VNl6dK0KEvBkeOHgThmXDqNp3Ox9TglDWFHU85pemqTNdKwxfnmO3vgrdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/environment": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/environment": "30.5.0",
+        "@jest/source-map": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "emittery": "^0.13.1",
         "exit-x": "^0.2.2",
         "graceful-fs": "^4.2.11",
-        "jest-docblock": "30.4.0",
-        "jest-environment-node": "30.4.1",
-        "jest-haste-map": "30.4.1",
-        "jest-leak-detector": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-resolve": "30.4.1",
-        "jest-runtime": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-watcher": "30.4.1",
-        "jest-worker": "30.4.1",
-        "p-limit": "^3.1.0",
-        "source-map-support": "0.5.13"
+        "jest-docblock": "30.5.0",
+        "jest-environment-node": "30.5.0",
+        "jest-haste-map": "30.5.0",
+        "jest-leak-detector": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-watcher": "30.5.0",
+        "jest-worker": "30.5.0",
+        "p-limit": "^3.1.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-runtime": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.4.2.tgz",
-      "integrity": "sha512-3/5e8iPz2k/VLqlr8DgTftYyLUv8Su3FkCAO2/Od81UsUTpSxOrS6O5x5KkoQwyUjmpYyDJKeyAvg2T2nvpNkQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.5.0.tgz",
+      "integrity": "sha512-VTRz0sRIw2EISeHigx1O+CMuwoG4+RKJjF8dp8okzFaDNQEcv5Mw0h5QW8VJXgb2CRF4gZIjSEBb2jdzXPagFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/fake-timers": "30.4.1",
-        "@jest/globals": "30.4.1",
-        "@jest/source-map": "30.0.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/globals": "30.5.0",
+        "@jest/source-map": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
-        "cjs-module-lexer": "^2.1.0",
+        "cjs-module-lexer": "^2.2.0",
         "collect-v8-coverage": "^1.0.2",
-        "glob": "^10.5.0",
+        "es-module-lexer": "^2.1.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
         "slash": "^3.0.0",
         "strip-bom": "^4.0.0"
       },
@@ -7167,10 +7721,94 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/jest-runtime/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jest-snapshot": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.4.1.tgz",
-      "integrity": "sha512-tEOkkfOMppUyeiHwjZswOQ3lcnoTnws/q5FnGIaeIh/jmoU0ZlgMYRR8sTlTj+nNGCoJ0RDq6SfxGxCsyMTPmw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.5.0.tgz",
+      "integrity": "sha512-pZWETdcqmKve9MDTE/AX6RaeAbRhzKhhAXGozAW8Pg2FfOSdUrQ/7D+VdwE3fLQsqjpITXJVQvYVZoMEzrUl0Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7179,20 +7817,20 @@
         "@babel/plugin-syntax-jsx": "^7.27.1",
         "@babel/plugin-syntax-typescript": "^7.27.1",
         "@babel/types": "^7.27.3",
-        "@jest/expect-utils": "30.4.1",
-        "@jest/get-type": "30.1.0",
-        "@jest/snapshot-utils": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/expect-utils": "30.5.0",
+        "@jest/get-type": "30.5.0",
+        "@jest/snapshot-utils": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "babel-preset-current-node-syntax": "^1.2.0",
         "chalk": "^4.1.2",
-        "expect": "30.4.1",
+        "expect": "30.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-diff": "30.4.1",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
-        "pretty-format": "30.4.1",
+        "jest-diff": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "pretty-format": "30.5.0",
         "semver": "^7.7.2",
         "synckit": "^0.11.8"
       },
@@ -7201,9 +7839,9 @@
       }
     },
     "node_modules/jest-snapshot/node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -7214,13 +7852,13 @@
       }
     },
     "node_modules/jest-util": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.4.1.tgz",
-      "integrity": "sha512-vjQb1sACEiv13DKJMDToJpzVW0joCsIQrmbg0fi7CyOOt+g9jTuQl2A216pWRBYhOVt53XbL/2LbMKg1BECWOw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.5.0.tgz",
+      "integrity": "sha512-lzU4aGUWaS+2X/B0CmgheDasfnsVlRfZh/rNQxB9b9s8cSYUq5BcqdQA95ld+KqJXBUVVt1sqnMQ2T3OxIalmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
@@ -7232,18 +7870,18 @@
       }
     },
     "node_modules/jest-validate": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.4.1.tgz",
-      "integrity": "sha512-PDWi4SOwLnwqNDfHZjOcsEFyZ4fc/2W2gVL3DEoyqnB6jCQMLRtfBong8s6omIw3lI0HWOus12xfnFmQtjW3fw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.5.0.tgz",
+      "integrity": "sha512-N/hsPYKgBSzBeVZ2RHCs3yvBbTZNPX7Be8q33zhyo/yeFneBL1swzly31LYU4LJ3zJM9e8TxSM8IYLo2SDJZYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "@jest/types": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/types": "30.5.0",
         "camelcase": "^6.3.0",
         "chalk": "^4.1.2",
         "leven": "^3.1.0",
-        "pretty-format": "30.4.1"
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -7263,19 +7901,19 @@
       }
     },
     "node_modules/jest-watcher": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.4.1.tgz",
-      "integrity": "sha512-/l9UonmvCwjHH7d2h3iAwIloLc1H0S8mJZ/LNK3i86hqwPAz8otUJjP9MfYtz9Tt77Su5FD2xGjZn8d31IZHlw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.5.0.tgz",
+      "integrity": "sha512-ujjnEoL4Uu+Swu3WRwYenWMB9JMEiD2T3OypnveMJ64S/1r/5G8eC4OQ1wEOgYWQqMi+mT+buzccflCHr/XJ9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "ansi-escapes": "^4.3.2",
         "chalk": "^4.1.2",
         "emittery": "^0.13.1",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "string-length": "^4.0.2"
       },
       "engines": {
@@ -7283,15 +7921,15 @@
       }
     },
     "node_modules/jest-worker": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.4.1.tgz",
-      "integrity": "sha512-SHynN/q/QD++iNyvMdy+WMmbCGk8jIsNcRxycXbWubSOhvo6T+j2afcfUSl+3hYsiBebOTo0cT7c2H7CXugu1g==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.5.0.tgz",
+      "integrity": "sha512-7kFk/607EoynNHLJa20daivkElM+c9PrCLduYy6AlMkYrXbh5TmVtW1BLXE05Y8baAFsJHMoC3xs2QRRTotwLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
         "@ungap/structured-clone": "^1.3.0",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "merge-stream": "^2.0.0",
         "supports-color": "^8.1.1"
       },
@@ -7577,16 +8215,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/makeerror": {
-      "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "tmpl": "1.0.5"
-      }
-    },
     "node_modules/map-obj": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-4.3.0.tgz",
@@ -7898,6 +8526,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/node-addon-api": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/node-exports-info": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/node-exports-info/-/node-exports-info-1.6.0.tgz",
@@ -7935,11 +8570,14 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.44",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
-      "integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-package-data": {
       "version": "3.0.3",
@@ -8131,16 +8769,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
     "node_modules/onetime": {
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
@@ -8326,16 +8954,6 @@
         "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       }
     },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -8544,16 +9162,16 @@
       }
     },
     "node_modules/pretty-format": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
-      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.5.0.tgz",
+      "integrity": "sha512-mzNzBErpHwM0zpmWS7ExOv62yhQhvd546nUuFqVR0dmnJB59tfrw9sjDF0DJknwsr59OXP0buwJ7PaKguczHSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/schemas": "30.4.1",
-        "ansi-styles": "^5.2.0",
-        "react-is-18": "npm:react-is@^18.3.1",
-        "react-is-19": "npm:react-is@^19.2.5"
+        "@jest/react-is-18": "npm:react-is@^18.3.1",
+        "@jest/react-is-19": "npm:react-is@^19.2.5",
+        "@jest/schemas": "30.5.0",
+        "ansi-styles": "^5.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -8689,22 +9307,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/react-is-18": {
-      "name": "react-is",
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/react-is-19": {
-      "name": "react-is",
-      "version": "19.2.6",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.6.tgz",
-      "integrity": "sha512-XjBR15BhXuylgWGuslhDKqlSayuqvqBX91BP8pauG8kd1zY8kotkNWbXksTCNRarse4kuGbe2kIY05ARtwNIvw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/read-pkg": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz",
@@ -9296,27 +9898,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-support": {
-      "version": "0.5.13",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
-      "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -9726,13 +10307,13 @@
       }
     },
     "node_modules/synckit": {
-      "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
+      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.2.9"
+        "@pkgr/core": "^0.3.6"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -9781,16 +10362,16 @@
       }
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/test-exclude/node_modules/glob": {
@@ -9871,13 +10452,6 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tmpl": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -10223,9 +10797,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10253,44 +10827,47 @@
       }
     },
     "node_modules/unrs-resolver": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.11.1.tgz",
-      "integrity": "sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.12.2.tgz",
+      "integrity": "sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "napi-postinstall": "^0.3.0"
+        "napi-postinstall": "^0.3.4"
       },
       "funding": {
         "url": "https://opencollective.com/unrs-resolver"
       },
       "optionalDependencies": {
-        "@unrs/resolver-binding-android-arm-eabi": "1.11.1",
-        "@unrs/resolver-binding-android-arm64": "1.11.1",
-        "@unrs/resolver-binding-darwin-arm64": "1.11.1",
-        "@unrs/resolver-binding-darwin-x64": "1.11.1",
-        "@unrs/resolver-binding-freebsd-x64": "1.11.1",
-        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.11.1",
-        "@unrs/resolver-binding-linux-arm-musleabihf": "1.11.1",
-        "@unrs/resolver-binding-linux-arm64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-arm64-musl": "1.11.1",
-        "@unrs/resolver-binding-linux-ppc64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-riscv64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-riscv64-musl": "1.11.1",
-        "@unrs/resolver-binding-linux-s390x-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-x64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-x64-musl": "1.11.1",
-        "@unrs/resolver-binding-wasm32-wasi": "1.11.1",
-        "@unrs/resolver-binding-win32-arm64-msvc": "1.11.1",
-        "@unrs/resolver-binding-win32-ia32-msvc": "1.11.1",
-        "@unrs/resolver-binding-win32-x64-msvc": "1.11.1"
+        "@unrs/resolver-binding-android-arm-eabi": "1.12.2",
+        "@unrs/resolver-binding-android-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-x64": "1.12.2",
+        "@unrs/resolver-binding-freebsd-x64": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-musleabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-ppc64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-s390x-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-musl": "1.12.2",
+        "@unrs/resolver-binding-openharmony-arm64": "1.12.2",
+        "@unrs/resolver-binding-wasm32-wasi": "1.12.2",
+        "@unrs/resolver-binding-win32-arm64-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-ia32-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-x64-msvc": "1.12.2"
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "dev": true,
       "funding": [
         {
@@ -10354,16 +10931,6 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
-    "node_modules/walker": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "makeerror": "1.0.12"
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -10574,13 +11141,6 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/write-file-atomic": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-5.0.1.tgz",
@@ -10596,9 +11156,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/deps/undici/src/package.json b/deps/undici/src/package.json
index 270b572dfc89..bc78602fe5b9 100644
--- a/deps/undici/src/package.json
+++ b/deps/undici/src/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
@@ -97,7 +97,7 @@
     "test:websocket:autobahn": "node test/autobahn/client.js",
     "test:websocket:autobahn:report": "node test/autobahn/report.js",
     "test:wpt:setup": "node test/web-platform-tests/wpt-runner.mjs setup",
-    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /websockets /serviceWorkers /eventsource",
+    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /xhr /websockets /eventsource",
     "test:cache-tests": "node test/cache-interceptor/cache-tests.mjs --ci",
     "coverage": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report",
     "coverage:ci": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report:ci",
@@ -109,7 +109,7 @@
     "prepare": "husky && node ./scripts/platform-shell.js"
   },
   "devDependencies": {
-    "@fastify/busboy": "3.2.0",
+    "@fastify/busboy": "3.2.2",
     "@matteo.collina/tspl": "^0.2.0",
     "@metcoder95/https-pem": "^1.0.0",
     "@sinonjs/fake-timers": "^12.0.0",
diff --git a/deps/undici/src/types/client.d.ts b/deps/undici/src/types/client.d.ts
index 064d3d69f2c1..1edaeb05f1e0 100644
--- a/deps/undici/src/types/client.d.ts
+++ b/deps/undici/src/types/client.d.ts
@@ -80,6 +80,8 @@ export declare namespace Client {
     maxResponseSize?: number;
     /** WebSocket-specific options */
     webSocket?: Client.WebSocketOptions;
+    /** EventSource-specific options */
+    eventSource?: Client.EventSourceOptions;
     /** Enables a family autodetection algorithm that loosely implements section 5 of RFC 8305. */
     autoSelectFamily?: boolean;
     /** The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. */
@@ -169,6 +171,14 @@ export declare namespace Client {
      */
     settings?: Omit<SessionOptions['settings'], 'enablePush' | 'maxConcurrentStreams' | 'enableConnectProtocol'>
   }
+  export interface EventSourceOptions {
+    /**
+     * Maximum allowed event size in bytes for EventSource messages.
+     * Set to 0 to disable the limit.
+     * @default buffer.kStringMaxLength
+     */
+    maxEventSize?: number;
+  }
 }
 
 export default Client
diff --git a/deps/undici/src/types/interceptors.d.ts b/deps/undici/src/types/interceptors.d.ts
index d21d717cec51..c11d4017b11e 100644
--- a/deps/undici/src/types/interceptors.d.ts
+++ b/deps/undici/src/types/interceptors.d.ts
@@ -12,6 +12,8 @@ declare namespace Interceptors {
   export type DecompressInterceptorOpts = {
     skipErrorResponses?: boolean
     skipStatusCodes?: number[]
+    /** Maximum decompressed response size in bytes. @default 67108864 */
+    maxSize?: number
   }
 
   export type ResponseErrorInterceptorOpts = { throwOnError: boolean }
diff --git a/deps/undici/src/types/mock-agent.d.ts b/deps/undici/src/types/mock-agent.d.ts
index 330926be1919..c718df1a4334 100644
--- a/deps/undici/src/types/mock-agent.d.ts
+++ b/deps/undici/src/types/mock-agent.d.ts
@@ -6,10 +6,6 @@ import { MockCallHistory } from './mock-call-history'
 
 export default MockAgent
 
-interface PendingInterceptor extends MockDispatch {
-  origin: string;
-}
-
 /** A mocked Agent class that implements the Agent API. It allows one to intercept HTTP requests made through undici and return mocked responses instead. */
 declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.Options> extends Dispatcher {
   constructor (options?: TMockAgentOptions)
@@ -40,17 +36,22 @@ declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.
   enableCallHistory (): this
   /** Disable call history. Any subsequence calls will then not be registered. */
   disableCallHistory (): this
-  pendingInterceptors (): PendingInterceptor[]
+  pendingInterceptors (): MockAgent.PendingInterceptor[]
   assertNoPendingInterceptors (options?: {
-    pendingInterceptorsFormatter?: PendingInterceptorsFormatter;
+    pendingInterceptorsFormatter?: MockAgent.PendingInterceptorsFormatter;
   }): void
 }
 
-interface PendingInterceptorsFormatter {
-  format(pendingInterceptors: readonly PendingInterceptor[]): string;
-}
-
 declare namespace MockAgent {
+  /** An interceptor that was registered on a mock dispatcher and has not been consumed yet. */
+  export interface PendingInterceptor extends MockDispatch {
+    origin: string;
+  }
+
+  export interface PendingInterceptorsFormatter {
+    format(pendingInterceptors: readonly PendingInterceptor[]): string;
+  }
+
   /** MockAgent options. */
   export interface Options extends Agent.Options {
     /** A custom agent to be encapsulated by the MockAgent. */
diff --git a/deps/undici/src/types/socks5-proxy-agent.d.ts b/deps/undici/src/types/socks5-proxy-agent.d.ts
index 05e4331670e9..4eaeb11048f3 100644
--- a/deps/undici/src/types/socks5-proxy-agent.d.ts
+++ b/deps/undici/src/types/socks5-proxy-agent.d.ts
@@ -21,5 +21,7 @@ declare namespace Socks5ProxyAgent {
     connect?: buildConnector.connector;
     /** TLS options for the proxy connection (for SOCKS5 over TLS) */
     proxyTls?: buildConnector.BuildOptions;
+    /** TLS options for the end-to-end connection to the target */
+    requestTls?: buildConnector.BuildOptions;
   }
 }
diff --git a/deps/undici/undici.js b/deps/undici/undici.js
index bb398a0686ce..b67af93f3659 100644
--- a/deps/undici/undici.js
+++ b/deps/undici/undici.js
@@ -523,6 +523,8 @@ var require_symbols = __commonJS({
       kDestroy: /* @__PURE__ */ Symbol("destroy"),
       kDispatch: /* @__PURE__ */ Symbol("dispatch"),
       kUrl: /* @__PURE__ */ Symbol("url"),
+      kRequestOrigin: /* @__PURE__ */ Symbol("request origin"),
+      kOriginless: /* @__PURE__ */ Symbol("originless"),
       kWriting: /* @__PURE__ */ Symbol("writing"),
       kResuming: /* @__PURE__ */ Symbol("resuming"),
       kQueue: /* @__PURE__ */ Symbol("queue"),
@@ -601,6 +603,7 @@ var require_dispatcher = __commonJS({
   "lib/dispatcher/dispatcher.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("node:events");
+    var { kOriginless, kUrl } = require_symbols();
     var Dispatcher2 = class extends EventEmitter {
       static {
         __name(this, "Dispatcher");
@@ -616,6 +619,7 @@ var require_dispatcher = __commonJS({
       }
       compose(...args) {
         const interceptors = Array.isArray(args[0]) ? args[0] : args;
+        const interceptorOrigin = this[kOriginless] === true ? null : this[kUrl]?.origin;
         let dispatch = this.dispatch.bind(this);
         for (const interceptor of interceptors) {
           if (interceptor == null) {
@@ -624,11 +628,19 @@ var require_dispatcher = __commonJS({
           if (typeof interceptor !== "function") {
             throw new TypeError(`invalid interceptor, expected function received ${typeof interceptor}`);
           }
-          dispatch = interceptor(dispatch);
+          dispatch = interceptor(dispatch, interceptorOrigin);
           if (dispatch == null || typeof dispatch !== "function" || dispatch.length !== 2) {
             throw new TypeError("invalid interceptor");
           }
         }
+        const originalDispatch = dispatch;
+        const self = this;
+        dispatch = /* @__PURE__ */ __name(function(opts, handler) {
+          if (opts && typeof opts === "object" && !opts.origin && self[kUrl]) {
+            opts = Object.assign({}, opts, { origin: self[kUrl].origin });
+          }
+          return originalDispatch(opts, handler);
+        }, "dispatch");
         return new Proxy(this, {
           get: /* @__PURE__ */ __name((target, key) => key === "dispatch" ? dispatch : target[key], "get")
         });
@@ -642,6 +654,7 @@ var require_dispatcher = __commonJS({
 var require_dispatcher_base = __commonJS({
   "lib/dispatcher/dispatcher-base.js"(exports2, module2) {
     "use strict";
+    var buffer = require("node:buffer");
     var Dispatcher2 = require_dispatcher();
     var {
       ClientDestroyedError,
@@ -652,6 +665,7 @@ var require_dispatcher_base = __commonJS({
     var kOnDestroyed = /* @__PURE__ */ Symbol("onDestroyed");
     var kOnClosed = /* @__PURE__ */ Symbol("onClosed");
     var kWebSocketOptions = /* @__PURE__ */ Symbol("webSocketOptions");
+    var kEventSourceOptions = /* @__PURE__ */ Symbol("eventSourceOptions");
     var DispatcherBase = class extends Dispatcher2 {
       static {
         __name(this, "DispatcherBase");
@@ -670,9 +684,10 @@ var require_dispatcher_base = __commonJS({
       constructor(opts) {
         super();
         this[kWebSocketOptions] = opts?.webSocket ?? {};
+        this[kEventSourceOptions] = opts?.eventSource ?? {};
       }
       /**
-       * @returns {import('../../types/dispatcher').WebSocketOptions}
+       * @returns {import('../../types/client').Client.WebSocketOptions}
        */
       get webSocketOptions() {
         return {
@@ -681,6 +696,14 @@ var require_dispatcher_base = __commonJS({
           // 128 MB default
         };
       }
+      /**
+       * @returns {import('../../types/client').Client.EventSourceOptions}
+       */
+      get eventSourceOptions() {
+        return {
+          maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+        };
+      }
       /** @returns {boolean} */
       get destroyed() {
         return this[kDestroyed];
@@ -5425,6 +5448,9 @@ var require_util2 = __commonJS({
     }
     __name(TAOCheck, "TAOCheck");
     function appendFetchMetadata(httpRequest) {
+      if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+        return;
+      }
       let header = null;
       header = httpRequest.mode;
       httpRequest.headersList.set("sec-fetch-mode", header, true);
@@ -7856,7 +7882,7 @@ var require_client_h1 = __commonJS({
     __name(onSocketClose, "onSocketClose");
     function clearIdleSocketValidation(socket) {
       if (socket[kIdleSocketValidationTimeout]) {
-        clearTimeout(socket[kIdleSocketValidationTimeout]);
+        clearImmediate(socket[kIdleSocketValidationTimeout]);
         socket[kIdleSocketValidationTimeout] = null;
       }
       socket[kIdleSocketValidation] = 0;
@@ -7864,14 +7890,13 @@ var require_client_h1 = __commonJS({
     __name(clearIdleSocketValidation, "clearIdleSocketValidation");
     function scheduleIdleSocketValidation(client, socket) {
       socket[kIdleSocketValidation] = 1;
-      socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+      socket[kIdleSocketValidationTimeout] = setImmediate(() => {
         socket[kIdleSocketValidationTimeout] = null;
         socket[kIdleSocketValidation] = 2;
         if (client[kSocket] === socket && !socket.destroyed) {
           client[kResume]();
         }
-      }, 0);
-      socket[kIdleSocketValidationTimeout].unref?.();
+      });
     }
     __name(scheduleIdleSocketValidation, "scheduleIdleSocketValidation");
     function resumeH1(client) {
@@ -8391,7 +8416,8 @@ var require_client_h2 = __commonJS({
       InformationalError,
       InvalidArgumentError,
       HeadersTimeoutError,
-      BodyTimeoutError
+      BodyTimeoutError,
+      ResponseExceededMaxSizeError
     } = require_errors();
     var {
       kUrl,
@@ -8420,7 +8446,8 @@ var require_client_h2 = __commonJS({
       kRemoteSettings,
       kHTTP2Stream,
       kHTTP2SessionState,
-      kHTTP2Options
+      kHTTP2Options,
+      kMaxResponseSize
     } = require_symbols();
     var { channels } = require_diagnostics();
     var kOpenStreams = /* @__PURE__ */ Symbol("open streams");
@@ -9175,9 +9202,11 @@ var require_client_h2 = __commonJS({
       const state = {
         abort: null,
         body: request.body,
+        bytesRead: 0,
         client,
         contentLength: null,
         expectsPayload: false,
+        maxResponseSize: client[kMaxResponseSize],
         request,
         headersTimeout,
         bodyTimeout,
@@ -9316,6 +9345,7 @@ var require_client_h2 = __commonJS({
         stream.once("continue", writeBodyH2);
       }
       stream.on("response", onResponse);
+      stream.on("headers", onInterimResponse);
       stream.on("end", onEnd);
       stream.on("error", onError);
       stream.on("frameError", onFrameError);
@@ -9334,6 +9364,7 @@ var require_client_h2 = __commonJS({
       stream.off("error", noop);
       stream.off("continue", writeBodyH2);
       stream.off("response", onResponse);
+      stream.off("headers", onInterimResponse);
       stream.off("end", onEnd);
       stream.off("error", onError);
       stream.off("frameError", onFrameError);
@@ -9367,15 +9398,35 @@ var require_client_h2 = __commonJS({
       if (state == null) {
         return;
       }
-      const { request } = state;
+      const { request, maxResponseSize } = state;
       if (request.aborted || request.completed) {
         return;
       }
+      if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+        state.abort(new ResponseExceededMaxSizeError());
+        return;
+      }
+      state.bytesRead += chunk.length;
       if (request.onResponseData(chunk) === false) {
         stream.pause();
       }
     }
     __name(onData, "onData");
+    function onInterimResponse(headers) {
+      const stream = this;
+      const state = stream[kRequestStreamState];
+      if (state == null) {
+        return;
+      }
+      const { request } = state;
+      if (request.aborted || request.completed) {
+        return;
+      }
+      const statusCode = headers[HTTP2_HEADER_STATUS];
+      delete headers[HTTP2_HEADER_STATUS];
+      request.onResponseStart(Number(statusCode), headers, noop, "");
+    }
+    __name(onInterimResponse, "onInterimResponse");
     function onResponse(headers) {
       const stream = this;
       const state = stream[kRequestStreamState];
@@ -9816,7 +9867,8 @@ var require_client = __commonJS({
         connectionWindowSize,
         pingInterval,
         webSocket,
-        h2Options
+        h2Options,
+        eventSource
       } = {}) {
         if (keepAlive !== void 0) {
           throw new InvalidArgumentError("unsupported keepAlive, use pipelining=0 instead");
@@ -9919,7 +9971,7 @@ var require_client = __commonJS({
             }
           }
         }
-        super({ webSocket });
+        super({ webSocket, eventSource });
         if (typeof connect2 !== "function") {
           connect2 = buildConnector({
             ...tls,
@@ -10420,7 +10472,7 @@ var require_agent = __commonJS({
   "lib/dispatcher/agent.js"(exports2, module2) {
     "use strict";
     var { InvalidArgumentError, MaxOriginsReachedError } = require_errors();
-    var { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require_symbols();
+    var { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require_symbols();
     var DispatcherBase = require_dispatcher_base();
     var Pool = require_pool();
     var Client = require_client();
@@ -10497,7 +10549,7 @@ var require_agent = __commonJS({
             if (this[kClients].get(key) !== dispatcher) {
               return;
             }
-            if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+            if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
               return;
             }
             this[kClients].delete(key);
@@ -10564,6 +10616,7 @@ var require_dispatcher1_wrapper = __commonJS({
     var Dispatcher2 = require_dispatcher();
     var { InvalidArgumentError } = require_errors();
     var { toRawHeaders } = require_util();
+    var { kOriginless, kUrl } = require_symbols();
     var LegacyHandlerWrapper = class {
       static {
         __name(this, "LegacyHandlerWrapper");
@@ -10621,6 +10674,8 @@ var require_dispatcher1_wrapper = __commonJS({
           throw new InvalidArgumentError("Argument dispatcher must implement dispatch");
         }
         this.#dispatcher = dispatcher;
+        this[kUrl] = dispatcher[kUrl];
+        this[kOriginless] = dispatcher[kOriginless];
       }
       static wrapHandler(handler) {
         if (!handler || typeof handler !== "object") {
@@ -11230,27 +11285,37 @@ var require_socks5_proxy_agent = __commonJS({
     var { URL: URL2 } = require("node:url");
     var tls;
     var DispatcherBase = require_dispatcher_base();
-    var { InvalidArgumentError } = require_errors();
+    var { ConnectTimeoutError, InvalidArgumentError } = require_errors();
     var { Socks5Client, STATES } = require_socks5_client();
     var { kBusy, kConnected, kDispatch, kClose, kDestroy } = require_symbols();
     var Pool = require_pool();
     var buildConnector = require_connect();
+    var { setupConnectTimeout } = require_util();
     var { debuglog } = require("node:util");
     var debug = debuglog("undici:socks5-proxy");
+    var DEFAULT_SOCKS5_CONNECT_TIMEOUT = 5e3;
     var kProxyUrl = /* @__PURE__ */ Symbol("proxy url");
     var kProxyHeaders = /* @__PURE__ */ Symbol("proxy headers");
     var kProxyAuth = /* @__PURE__ */ Symbol("proxy auth");
     var kProxyProtocol = /* @__PURE__ */ Symbol("proxy protocol");
     var kPools = /* @__PURE__ */ Symbol("pools");
     var kConnector = /* @__PURE__ */ Symbol("connector");
+    var kConnectTimeout = /* @__PURE__ */ Symbol("connect timeout");
     var kRequestTls = /* @__PURE__ */ Symbol("request tls settings");
+    var kRequestTlsTimeout = /* @__PURE__ */ Symbol("request tls timeout");
+    function createConnectTimeoutError(hostname, port, timeout) {
+      return new ConnectTimeoutError(
+        `Connect Timeout Error (attempted address: ${hostname}:${port}, timeout: ${timeout}ms)`
+      );
+    }
+    __name(createConnectTimeoutError, "createConnectTimeoutError");
     var experimentalWarningEmitted = false;
     var Socks5ProxyAgent = class extends DispatcherBase {
       static {
         __name(this, "Socks5ProxyAgent");
       }
       constructor(proxyUrl, options = {}) {
-        super();
+        super(options);
         if (!experimentalWarningEmitted) {
           process.emitWarning(
             "SOCKS5 proxy support is experimental and subject to change",
@@ -11268,13 +11333,29 @@ var require_socks5_proxy_agent = __commonJS({
         this[kProxyUrl] = url;
         this[kProxyHeaders] = options.headers || {};
         this[kProxyProtocol] = options.proxyTls ? "https:" : "http:";
-        this[kRequestTls] = options.requestTls;
+        const connectTimeout = options.connectTimeout ?? DEFAULT_SOCKS5_CONNECT_TIMEOUT;
+        if (!Number.isFinite(connectTimeout) || connectTimeout < 0) {
+          throw new InvalidArgumentError("invalid connectTimeout");
+        }
+        this[kConnectTimeout] = connectTimeout;
+        const { timeout, ...requestTls } = options.requestTls || {};
+        const requestTlsTimeout = timeout ?? connectTimeout;
+        if (!Number.isFinite(requestTlsTimeout) || requestTlsTimeout < 0) {
+          throw new InvalidArgumentError("invalid requestTls.timeout");
+        }
+        this[kRequestTls] = requestTls;
+        this[kRequestTlsTimeout] = requestTlsTimeout;
         this[kProxyAuth] = {
           username: options.username || (url.username ? decodeURIComponent(url.username) : null),
           password: options.password || (url.password ? decodeURIComponent(url.password) : null)
         };
+        const proxyTlsTimeout = options.proxyTls?.timeout ?? connectTimeout;
+        if (!Number.isFinite(proxyTlsTimeout) || proxyTlsTimeout < 0) {
+          throw new InvalidArgumentError("invalid proxyTls.timeout");
+        }
         this[kConnector] = options.connect || buildConnector({
           ...options.proxyTls,
+          timeout: proxyTlsTimeout,
           servername: options.proxyTls?.servername || url.hostname
         });
         this[kPools] = /* @__PURE__ */ new Map();
@@ -11307,17 +11388,24 @@ var require_socks5_proxy_agent = __commonJS({
         });
         await socks5Client.handshake();
         const authenticationReady = Promise.withResolvers();
-        const authenticationTimeout = setTimeout(() => {
-          authenticationReady.reject(new Error("SOCKS5 authentication timeout"));
-        }, 5e3);
-        const onAuthenticated = /* @__PURE__ */ __name(() => {
+        const authenticationTimeout = this[kConnectTimeout] === 0 ? null : setTimeout(() => {
+          cleanupAuthenticationListeners();
+          socks5Client.destroy();
+          authenticationReady.reject(
+            createConnectTimeoutError(proxyHost, proxyPort, this[kConnectTimeout])
+          );
+        }, this[kConnectTimeout]);
+        const cleanupAuthenticationListeners = /* @__PURE__ */ __name(() => {
           clearTimeout(authenticationTimeout);
+          socks5Client.removeListener("authenticated", onAuthenticated);
           socks5Client.removeListener("error", onAuthenticationError);
+        }, "cleanupAuthenticationListeners");
+        const onAuthenticated = /* @__PURE__ */ __name(() => {
+          cleanupAuthenticationListeners();
           authenticationReady.resolve();
         }, "onAuthenticated");
         const onAuthenticationError = /* @__PURE__ */ __name((err) => {
-          clearTimeout(authenticationTimeout);
-          socks5Client.removeListener("authenticated", onAuthenticated);
+          cleanupAuthenticationListeners();
           authenticationReady.reject(err);
         }, "onAuthenticationError");
         if (socks5Client.state === STATES.AUTHENTICATED) {
@@ -11330,18 +11418,25 @@ var require_socks5_proxy_agent = __commonJS({
         await authenticationReady.promise;
         await socks5Client.connect(targetHost, targetPort);
         const connectionReady = Promise.withResolvers();
-        const connectionTimeout = setTimeout(() => {
-          connectionReady.reject(new Error("SOCKS5 connection timeout"));
-        }, 5e3);
-        const onConnected = /* @__PURE__ */ __name((info) => {
-          debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
+        const connectionTimeout = this[kConnectTimeout] === 0 ? null : setTimeout(() => {
+          cleanupConnectionListeners();
+          socks5Client.destroy();
+          connectionReady.reject(
+            createConnectTimeoutError(targetHost, targetPort, this[kConnectTimeout])
+          );
+        }, this[kConnectTimeout]);
+        const cleanupConnectionListeners = /* @__PURE__ */ __name(() => {
           clearTimeout(connectionTimeout);
+          socks5Client.removeListener("connected", onConnected);
           socks5Client.removeListener("error", onConnectionError);
+        }, "cleanupConnectionListeners");
+        const onConnected = /* @__PURE__ */ __name((info) => {
+          debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
+          cleanupConnectionListeners();
           connectionReady.resolve();
         }, "onConnected");
         const onConnectionError = /* @__PURE__ */ __name((err) => {
-          clearTimeout(connectionTimeout);
-          socks5Client.removeListener("connected", onConnected);
+          cleanupConnectionListeners();
           connectionReady.reject(err);
         }, "onConnectionError");
         socks5Client.once("connected", onConnected);
@@ -11381,8 +11476,26 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: this[kRequestTls]?.servername || targetHost
                     });
                     const tlsReady = Promise.withResolvers();
-                    finalSocket.once("secureConnect", tlsReady.resolve);
-                    finalSocket.once("error", tlsReady.reject);
+                    const cleanupTlsListeners = /* @__PURE__ */ __name(() => {
+                      queueMicrotask(clearTlsTimeout);
+                      finalSocket.removeListener("secureConnect", onSecureConnect);
+                      finalSocket.removeListener("error", onTlsError);
+                    }, "cleanupTlsListeners");
+                    const onSecureConnect = /* @__PURE__ */ __name(() => {
+                      cleanupTlsListeners();
+                      tlsReady.resolve();
+                    }, "onSecureConnect");
+                    const onTlsError = /* @__PURE__ */ __name((err) => {
+                      cleanupTlsListeners();
+                      tlsReady.reject(err);
+                    }, "onTlsError");
+                    const clearTlsTimeout = setupConnectTimeout(new WeakRef(finalSocket), {
+                      timeout: this[kRequestTlsTimeout],
+                      hostname: targetHost,
+                      port: targetPort
+                    });
+                    finalSocket.once("secureConnect", onSecureConnect);
+                    finalSocket.once("error", onTlsError);
                     await tlsReady.promise;
                   }
                   callback(null, finalSocket);
@@ -11453,6 +11566,7 @@ var require_proxy_agent = __commonJS({
     var Client = require_client();
     var { channels } = require_diagnostics();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
+    var { hasSafeIterator } = require_util();
     var kAgent = /* @__PURE__ */ Symbol("proxy agent");
     var kClient = /* @__PURE__ */ Symbol("proxy client");
     var kProxyHeaders = /* @__PURE__ */ Symbol("proxy headers");
@@ -11549,7 +11663,7 @@ var require_proxy_agent = __commonJS({
           throw new InvalidArgumentError("Proxy opts.clientFactory must be a function.");
         }
         const { proxyTunnel, connectTimeout } = opts;
-        super();
+        super(opts);
         const url = this.#getUrl(opts);
         const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url;
         this[kProxy] = { uri: href, protocol };
@@ -11582,6 +11696,7 @@ var require_proxy_agent = __commonJS({
               factory: agentFactory,
               username: opts.username || username,
               password: opts.password || password,
+              connectTimeout,
               proxyTls: opts.proxyTls,
               requestTls: opts.requestTls
             });
@@ -11723,6 +11838,13 @@ var require_proxy_agent = __commonJS({
         }
         return headersPair;
       }
+      if (headers && typeof headers === "object" && hasSafeIterator(headers)) {
+        const headersPair = {};
+        for (const [key, value] of headers) {
+          headersPair[key] = value;
+        }
+        return headersPair;
+      }
       return headers;
     }
     __name(buildHeaders, "buildHeaders");
@@ -11766,7 +11888,7 @@ var require_env_http_proxy_agent = __commonJS({
       #noProxyEntries = null;
       #opts = null;
       constructor(opts = {}) {
-        super();
+        super(opts);
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
         this[kNoProxyAgent] = new Agent(agentOpts);
@@ -11806,6 +11928,9 @@ var require_env_http_proxy_agent = __commonJS({
       #getProxyAgentForUrl(url) {
         let { protocol, host: hostname, port } = url;
         hostname = hostname.replace(/:\d*$/, "").replace(/^\[(.+)\]$/, "$1").toLowerCase();
+        if (hostname.length > 1 && hostname.charCodeAt(hostname.length - 1) === 46) {
+          hostname = hostname.slice(0, -1);
+        }
         port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0;
         if (!this.#shouldProxy(hostname, port)) {
           return this[kNoProxyAgent];
@@ -11861,8 +11986,8 @@ var require_env_http_proxy_agent = __commonJS({
             port = parsed ? Number.parseInt(parsed[2], 10) : 0;
           }
           noProxyEntries.push({
-            // strip leading dot or asterisk with dot
-            hostname: hostname.replace(/^\*?\./, "").toLowerCase(),
+            // strip leading dot or asterisk with dot, and any trailing dot
+            hostname: hostname.replace(/^\*?\./, "").replace(/^(.+)\.$/, "$1").toLowerCase(),
             port
           });
         }
@@ -13386,7 +13511,7 @@ var require_request2 = __commonJS({
         serviceWorkers: init.serviceWorkers ?? "all",
         initiator: init.initiator ?? "",
         destination: init.destination ?? "",
-        priority: init.priority ?? null,
+        priority: init.priority ?? "auto",
         origin: init.origin ?? "client",
         policyContainer: init.policyContainer ?? "client",
         referrer: init.referrer ?? "client",
@@ -13558,8 +13683,7 @@ var require_request2 = __commonJS({
       {
         key: "priority",
         converter: webidl.converters.DOMString,
-        allowedValues: ["high", "low", "auto"],
-        defaultValue: /* @__PURE__ */ __name(() => "auto", "defaultValue")
+        allowedValues: ["high", "low", "auto"]
       }
     ]);
     module2.exports = {
@@ -13777,6 +13901,7 @@ var require_fetch = __commonJS({
     var EE = require("node:events");
     var { Readable, pipeline, finished, isErrored, isReadable } = require("node:stream");
     var { addAbortListener, bufferToLowerCasedHeaderName } = require_util();
+    var { SocketError } = require_errors();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher: getGlobalDispatcher2 } = require_global2();
     var { webidl } = require_webidl();
@@ -14854,6 +14979,9 @@ var require_fetch = __commonJS({
               },
               onRequestUpgrade(controller, status, headers, socket) {
                 if (socket.session != null && status !== 200 || socket.session == null && status !== 101) {
+                  if (socket.session != null) {
+                    controller.abort(new SocketError("bad upgrade", null));
+                  }
                   return false;
                 }
                 const rawHeaders = controller?.rawHeaders ?? [];
@@ -15605,7 +15733,7 @@ var require_connection = __commonJS({
           const secProtocol = response.headersList.get("Sec-WebSocket-Protocol");
           if (secProtocol !== null) {
             const requestProtocols = getDecodeSplit("sec-websocket-protocol", request.headersList);
-            if (!requestProtocols.includes(secProtocol)) {
+            if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
               failWebsocketConnection(handler, 1002, "Protocol was not set in the opening handshake.");
               return;
             }
@@ -15729,6 +15857,7 @@ var require_permessage_deflate = __commonJS({
             if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
               callback(new MessageSizeExceededError());
               this.#inflate.removeAllListeners();
+              this.#inflate.destroy();
               this.#inflate = null;
               return;
             }
@@ -16768,6 +16897,7 @@ var require_util4 = __commonJS({
 var require_eventsource_stream = __commonJS({
   "lib/web/eventsource/eventsource-stream.js"(exports2, module2) {
     "use strict";
+    var buffer = require("node:buffer");
     var { Transform } = require("node:stream");
     var { isASCIINumber, isValidLastEventId } = require_util4();
     var BOM = [239, 187, 191];
@@ -16775,25 +16905,26 @@ var require_eventsource_stream = __commonJS({
     var CR = 13;
     var COLON = 58;
     var SPACE = 32;
+    var defaultMaxEventSize = buffer.kStringMaxLength;
     var DATA = Buffer.from("data");
     var EVENT = Buffer.from("event");
     var ID = Buffer.from("id");
     var RETRY = Buffer.from("retry");
-    function isASCIINumberBytes(buffer, start) {
-      if (start >= buffer.length) {
+    function isASCIINumberBytes(buffer2, start) {
+      if (start >= buffer2.length) {
         return false;
       }
-      for (let i = start; i < buffer.length; i++) {
-        if (buffer[i] < 48 || buffer[i] > 57) {
+      for (let i = start; i < buffer2.length; i++) {
+        if (buffer2[i] < 48 || buffer2[i] > 57) {
           return false;
         }
       }
       return true;
     }
     __name(isASCIINumberBytes, "isASCIINumberBytes");
-    function isValidLastEventIdBytes(buffer, start) {
-      for (let i = start; i < buffer.length; i++) {
-        if (buffer[i] === 0) {
+    function isValidLastEventIdBytes(buffer2, start) {
+      for (let i = start; i < buffer2.length; i++) {
+        if (buffer2[i] === 0) {
           return false;
         }
       }
@@ -16812,6 +16943,12 @@ var require_eventsource_stream = __commonJS({
       return true;
     }
     __name(isFieldName, "isFieldName");
+    function createMaxEventSizeExceededError() {
+      const error = new Error("EventSource message size exceeded");
+      error.aborted = false;
+      return error;
+    }
+    __name(createMaxEventSizeExceededError, "createMaxEventSizeExceededError");
     var EventSourceStream = class extends Transform {
       static {
         __name(this, "EventSourceStream");
@@ -16841,6 +16978,8 @@ var require_eventsource_stream = __commonJS({
       pos = 0;
       lineChunkIndex = 0;
       linePos = 0;
+      eventDataSize = 0;
+      maxEventSize;
       event = {
         data: void 0,
         event: void 0,
@@ -16850,6 +16989,7 @@ var require_eventsource_stream = __commonJS({
       /**
        * @param {object} options
        * @param {boolean} [options.readableObjectMode]
+       * @param {number} [options.maxEventSize]
        * @param {eventSourceSettings} [options.eventSourceSettings]
        * @param {(chunk: any, encoding?: BufferEncoding | undefined) => boolean} [options.push]
        */
@@ -16857,6 +16997,7 @@ var require_eventsource_stream = __commonJS({
         options.readableObjectMode = true;
         super(options);
         this.state = options.eventSourceSettings || {};
+        this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize;
         if (options.push) {
           this.push = options.push;
         }
@@ -16908,7 +17049,12 @@ var require_eventsource_stream = __commonJS({
             if (byte === CR) {
               this.crlfCheck = true;
             }
-            this.parseLine(this.readLine(), this.event);
+            try {
+              this.parseLine(this.readLine(), this.event);
+            } catch (error) {
+              callback(error);
+              return;
+            }
             this.consumeCurrentByte();
             this.eventEndCheck = true;
             continue;
@@ -16939,6 +17085,11 @@ var require_eventsource_stream = __commonJS({
           }
         }
         if (isFieldName(line, fieldLength, DATA)) {
+          const valueBytes = line.length - valueStart;
+          const eventDataSize = this.eventDataSize + (event.data === void 0 ? 0 : 1) + valueBytes;
+          if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+            throw createMaxEventSizeExceededError();
+          }
           const value = line.toString("utf8", valueStart);
           if (event.data === void 0) {
             event.data = value;
@@ -16946,6 +17097,7 @@ var require_eventsource_stream = __commonJS({
             event.data += `
 ${value}`;
           }
+          this.eventDataSize = eventDataSize;
           return;
         }
         if (isFieldName(line, fieldLength, RETRY)) {
@@ -16993,6 +17145,7 @@ ${value}`;
         this.event.event = void 0;
         this.event.id = void 0;
         this.event.retry = void 0;
+        this.eventDataSize = 0;
       }
       hasPendingEvent() {
         return this.event.data !== void 0 || this.event.event !== void 0 || this.event.id !== void 0 || this.event.retry !== void 0;
@@ -17122,9 +17275,12 @@ var require_eventsource = __commonJS({
     var { parseMIMEType } = require_data_url();
     var { createFastMessageEvent: createFastMessageEvent2 } = require_events();
     var { isNetworkError } = require_response();
-    var { kEnumerableProperty } = require_util();
+    var { isValidHeaderValue, kEnumerableProperty } = require_util();
     var { environmentSettingsObject } = require_util2();
     var { createPotentialCORSRequest } = require_util4();
+    var { getGlobalDispatcher: getGlobalDispatcher2 } = require_global2();
+    var { isomorphicDecode } = require_infra();
+    var textEncoder = new TextEncoder();
     var experimentalWarned = false;
     var defaultReconnectionTime = 3e3;
     var CONNECTING = 0;
@@ -17261,6 +17417,7 @@ var require_eventsource = __commonJS({
           this.#state.origin = response.urlList[response.urlList.length - 1].origin;
           const eventSourceStream = new EventSourceStream({
             eventSourceSettings: this.#state,
+            maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
             push: /* @__PURE__ */ __name((event) => {
               this.dispatchEvent(createFastMessageEvent2(
                 event.type,
@@ -17291,8 +17448,12 @@ var require_eventsource = __commonJS({
         this.dispatchEvent(new Event("error"));
         setTimeout(() => {
           if (this.#readyState !== CONNECTING) return;
+          this.#request.headersList.delete("last-event-id", true);
           if (this.#state.lastEventId.length) {
-            this.#request.headersList.set("last-event-id", this.#state.lastEventId, true);
+            const lastEventId = isomorphicDecode(textEncoder.encode(this.#state.lastEventId));
+            if (isValidHeaderValue(lastEventId)) {
+              this.#request.headersList.set("last-event-id", lastEventId, true);
+            }
           }
           this.#connect();
         }, this.#state.reconnectionTime)?.unref();
@@ -17397,7 +17558,8 @@ var require_eventsource = __commonJS({
       {
         key: "dispatcher",
         // undici only
-        converter: webidl.converters.any
+        converter: webidl.converters.any,
+        defaultValue: /* @__PURE__ */ __name(() => getGlobalDispatcher2(), "defaultValue")
       },
       {
         key: "node",
diff --git a/src/undici_version.h b/src/undici_version.h
index 8afd91ad6f9a..3dd10c8a2aa7 100644
--- a/src/undici_version.h
+++ b/src/undici_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-undici.sh
 #ifndef SRC_UNDICI_VERSION_H_
 #define SRC_UNDICI_VERSION_H_
-#define UNDICI_VERSION "8.10.0"
+#define UNDICI_VERSION "8.10.2"
 #endif  // SRC_UNDICI_VERSION_H_

From 10720f73b92b000a5bcf0de84b57c833016df049 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9?= <contact.9a5d6388@renegade334.me.uk>
Date: Sun, 6 Sep 2026 19:35:25 +0100
Subject: [PATCH 128/202] doc: replace `node:modules` documentation header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/65800
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/api/module.md | 64 +++++++++++++++++++++++++----------------------
 1 file changed, 34 insertions(+), 30 deletions(-)

diff --git a/doc/api/module.md b/doc/api/module.md
index 1aac20780c4d..a4f83a812f96 100644
--- a/doc/api/module.md
+++ b/doc/api/module.md
@@ -2,19 +2,30 @@
 
 <!--introduced_in=v12.20.0-->
 
+> Stability: 2 - Stable
+
+<!-- source_link=lib/module.js -->
+
+The `node:module` module provides utilities for interacting with the Node.js
+module system.
+
+It can be accessed using:
+
+```mjs
+import module from 'node:module';
+```
+
+## Class: `Module`
+
 <!-- YAML
-added: v0.3.7
+added: v0.3.5
 -->
 
-## The `Module` object
+`module` objects in [CommonJS][] modules are instances of this class.
 
-* Type: {Object}
+See the CommonJS documentation for [the `module` object][].
 
-Provides general utility methods when interacting with instances of
-`Module`, the [`module`][] variable often seen in [CommonJS][] modules. Accessed
-via `import 'node:module'` or `require('node:module')`.
-
-### `module.builtinModules`
+## `module.builtinModules`
 
 <!-- YAML
 added:
@@ -29,25 +40,18 @@ changes:
 
 * Type: {string\[]}
 
-A list of the names of all modules provided by Node.js. Can be used to verify
-if a module is maintained by a third party or not.
-
-`module` in this context isn't the same object that's provided
-by the [module wrapper][]. To access it, require the `Module` module:
+A list of the names of all modules provided by Node.js.
 
 ```mjs
-// module.mjs
-// In an ECMAScript module
-import { builtinModules as builtin } from 'node:module';
+import { builtinModules } from 'node:module';
+console.log(builtinModules.filter((name) => name.startsWith('path')));
+// Prints: [ 'path', 'path/posix', 'path/win32' ]
 ```
 
-```cjs
-// module.cjs
-// In a CommonJS module
-const builtin = require('node:module').builtinModules;
-```
+To test whether a module name corresponds to a builtin module, use
+[`module.isBuiltin()`][].
 
-### `module.createRequire(filename)`
+## `module.createRequire(filename)`
 
 <!-- YAML
 added: v12.2.0
@@ -66,7 +70,7 @@ const require = createRequire(import.meta.url);
 const siblingModule = require('./sibling-module');
 ```
 
-### `module.findPackageJSON(specifier[, base])`
+## `module.findPackageJSON(specifier[, base])`
 
 <!-- YAML
 added:
@@ -154,7 +158,7 @@ findPackageJSON('@foo/qux', __filename);
 // '/path/to/project/packages/qux/package.json'
 ```
 
-### `module.isBuiltin(moduleName)`
+## `module.isBuiltin(moduleName)`
 
 <!-- YAML
 added:
@@ -172,7 +176,7 @@ isBuiltin('fs'); // true
 isBuiltin('wss'); // false
 ```
 
-### `module.register(specifier[, parentURL][, options])`
+## `module.register(specifier[, parentURL][, options])`
 
 <!-- YAML
 added:
@@ -222,7 +226,7 @@ resolution and loading behavior. See [Customization hooks][].
 
 This feature requires `--allow-worker` if used with the [Permission Model][].
 
-### `module.registerHooks(options)`
+## `module.registerHooks(options)`
 
 <!-- YAML
 added:
@@ -251,7 +255,7 @@ Register [hooks][] that customize Node.js module resolution and loading behavior
 See [Customization hooks][]. The returned object can be used to
 [deregister the hooks][deregistration of synchronous customization hooks].
 
-### `module.stripTypeScriptTypes(code[, options])`
+## `module.stripTypeScriptTypes(code[, options])`
 
 <!-- YAML
 added:
@@ -316,7 +320,7 @@ console.log(strippedCode);
 // Prints: const a         = 1\n\n//# sourceURL=source.ts;
 ```
 
-### `module.syncBuiltinESMExports()`
+## `module.syncBuiltinESMExports()`
 
 <!-- YAML
 added: v12.12.0
@@ -2094,9 +2098,9 @@ returned object contains the following keys:
 [`module.enableCompileCache()`]: #moduleenablecompilecacheoptions
 [`module.flushCompileCache()`]: #moduleflushcompilecache
 [`module.getCompileCacheDir()`]: #modulegetcompilecachedir
+[`module.isBuiltin()`]: #moduleisbuiltinmodulename
 [`module.registerHooks()`]: #moduleregisterhooksoptions
 [`module.setSourceMapsSupport()`]: #modulesetsourcemapssupportenabled-options
-[`module`]: #the-module-object
 [`os.tmpdir()`]: os.md#ostmpdir
 [`register`]: #moduleregisterspecifier-parenturl-options
 [`util.TextDecoder`]: util.md#class-utiltextdecoder
@@ -2109,11 +2113,11 @@ returned object contains the following keys:
 [hooks]: #customization-hooks
 [load hook]: #synchronous-loadurl-context-nextload
 [module compile cache]: #module-compile-cache
-[module wrapper]: modules.md#the-module-wrapper
 [realm]: https://tc39.es/ecma262/#realm
 [resolve hook]: #synchronous-resolvespecifier-context-nextresolve
 [source map include directives]: https://tc39.es/ecma426/#sec-linking-generated-code
 [synchronous hook functions]: #hook-functions-accepted-by-moduleregisterhooks
+[the `module` object]: modules.md#the-module-object
 [the documentation of `Worker`]: worker_threads.md#new-workerfilename-options
 [transferable objects]: worker_threads.md#portpostmessagevalue-transferlist
 [type-stripping]: typescript.md#type-stripping

From 1f53d7ee3fe12dc98ce8acb2972f9d69f02ab929 Mon Sep 17 00:00:00 2001
From: Hamid Reza Ghavami <hamidr.ghavami@gmail.com>
Date: Mon, 7 Sep 2026 02:02:02 +0300
Subject: [PATCH 129/202] fs: return Buffer from mkdtemp when prefix is a
 Buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Hamid Reza Ghavami <hamidr.ghavami@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64397
Fixes: https://github.com/nodejs/node/issues/58795
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 doc/api/fs.md                           | 27 ++++++++++++++++++++-----
 lib/fs.js                               | 12 ++++++++---
 lib/internal/fs/promises.js             |  9 ++++++---
 test/parallel/test-fs-mkdtemp-buffer.js | 26 ++++++++++++++++++++++++
 test/parallel/test-fs-mkdtemp.js        |  5 ++---
 5 files changed, 65 insertions(+), 14 deletions(-)
 create mode 100644 test/parallel/test-fs-mkdtemp-buffer.js

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 9be67ded1f50..5955cfe0bf01 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1637,6 +1637,9 @@ makeDirectory().catch(console.error);
 <!-- YAML
 added: v10.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
   - version:
     - v20.6.0
     - v18.19.0
@@ -1651,7 +1654,7 @@ changes:
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * Returns: {Promise} Fulfills with the created directory path.
   If `encoding` is `'buffer'`, then the resulting directory
   path is returned as a {Buffer}. Otherwise, the path is returned as a
@@ -1688,11 +1691,15 @@ characters directly to the `prefix` string. For instance, given a directory
 
 <!-- YAML
 added: v24.4.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
 -->
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * Returns: {Promise} Fulfills with a Promise for an async-disposable Object:
   * `path` {string|Buffer} The path of the created directory.
   * `remove` {AsyncFunction} A function which removes the created directory.
@@ -3978,6 +3985,9 @@ See the POSIX mkdir(2) documentation for more details.
 <!-- YAML
 added: v5.10.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
   - version:
     - v20.6.0
     - v18.19.0
@@ -4008,7 +4018,7 @@ changes:
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * `callback` {Function}
   * `err` {Error}
   * `directory` {string|Buffer}
@@ -6490,6 +6500,9 @@ See the POSIX mkdir(2) documentation for more details.
 <!-- YAML
 added: v5.10.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
   - version:
     - v20.6.0
     - v18.19.0
@@ -6504,7 +6517,7 @@ changes:
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * Returns: {string|Buffer}
 
 Returns the created directory path. If `encoding` is `'buffer'`, then the
@@ -6521,11 +6534,15 @@ object with an `encoding` property specifying the character encoding to use.
 
 <!-- YAML
 added: v24.4.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
 -->
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * Returns: {Object} A disposable object:
   * `path` {string|Buffer} The path of the created directory.
   * `remove` {Function} A function which removes the created directory.
diff --git a/lib/fs.js b/lib/fs.js
index b858902cf44a..ad90551f40f1 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -3683,7 +3683,9 @@ function mkdtemp(prefix, options, callback) {
   if (h !== null && vfsResult(h.mkdtemp(prefix, typeof options === 'function' ? undefined : options), callback)) return;
 
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
@@ -3706,7 +3708,9 @@ function mkdtempSync(prefix, options) {
   }
 
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
   return binding.mkdtemp(prefix, options.encoding);
@@ -3722,7 +3726,9 @@ function mkdtempSync(prefix, options) {
  */
 function mkdtempDisposableSync(prefix, options) {
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index d5a6b9a2c853..0a2172d796c4 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -2025,9 +2025,10 @@ async function mkdtemp(prefix, options) {
     const promise = h.mkdtemp(prefix, options);
     if (promise !== undefined) return await promise;
   }
-
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
@@ -2040,7 +2041,9 @@ async function mkdtemp(prefix, options) {
 
 async function mkdtempDisposable(prefix, options) {
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
diff --git a/test/parallel/test-fs-mkdtemp-buffer.js b/test/parallel/test-fs-mkdtemp-buffer.js
new file mode 100644
index 000000000000..c9c04d57eaca
--- /dev/null
+++ b/test/parallel/test-fs-mkdtemp-buffer.js
@@ -0,0 +1,26 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const tmpdir = require('../common/tmpdir');
+tmpdir.refresh();
+
+const prefixString = path.join(tmpdir.path, 'buffer-');
+const prefixBuffer = Buffer.from(prefixString);
+
+// 1. Test Sync API
+const resultSync = fs.mkdtempSync(prefixBuffer);
+assert.strictEqual(Buffer.isBuffer(resultSync), true);
+
+// 2. Test Callback API
+fs.mkdtemp(prefixBuffer, common.mustSucceed((result) => {
+  assert.strictEqual(Buffer.isBuffer(result), true);
+}));
+
+// 3. Test Promises API
+fs.promises.mkdtemp(prefixBuffer)
+  .then(common.mustCall((resultPromise) => {
+    assert.strictEqual(Buffer.isBuffer(resultPromise), true);
+  }));
diff --git a/test/parallel/test-fs-mkdtemp.js b/test/parallel/test-fs-mkdtemp.js
index e93809d5b445..3c2323440e08 100644
--- a/test/parallel/test-fs-mkdtemp.js
+++ b/test/parallel/test-fs-mkdtemp.js
@@ -64,14 +64,13 @@ function handler(err, folder) {
 {
   const tmpFolder = fs.mkdtempSync(Buffer.from(tmpdir.resolve('foo.')));
 
-  assert.strictEqual(path.basename(tmpFolder).length, 'foo.XXXXXX'.length);
+  assert.strictEqual(path.basename(tmpFolder.toString()).length, 'foo.XXXXXX'.length);
   assert(fs.existsSync(tmpFolder));
 
   const utf8 = fs.mkdtempSync(Buffer.from(tmpdir.resolve('\u0222abc.')));
-  assert.strictEqual(Buffer.byteLength(path.basename(utf8)),
+  assert.strictEqual(Buffer.byteLength(path.basename(utf8.toString())),
                      Buffer.byteLength('\u0222abc.XXXXXX'));
   assert(fs.existsSync(utf8));
-
   fs.mkdtemp(Buffer.from(tmpdir.resolve('bar.')), common.mustCall(handler));
 
   // Same test as above, but making sure that passing an options object doesn't

From 695f01f46942a57920c009f3c3e4677a560708ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9?= <contact.9a5d6388@renegade334.me.uk>
Date: Mon, 7 Sep 2026 00:20:55 +0100
Subject: [PATCH 130/202] quic: stop guarding ngtcp2_recv_stop_sending callback
 field

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/65688
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 src/quic/http3.cc   |  4 ++--
 src/quic/session.cc | 32 ++++++++++++++------------------
 2 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index 8cbd2341e466..6e1d0c44a048 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -1430,7 +1430,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
   static constexpr nghttp3_callbacks kCallbacks = {
       on_acked_stream_data,
-      nullptr,  // nghttp3_stream_close (deprecated)
+      nullptr,  // stream_close (deprecated, use v2 below)
       on_receive_data,
       on_deferred_consume,
       on_begin_headers,
@@ -1443,7 +1443,7 @@ class Http3ApplicationImpl final : public Session::Application {
       on_end_stream,
       on_do_reset_stream,
       on_shutdown,
-      nullptr,  // recv_settings (deprecated)
+      nullptr,  // recv_settings (deprecated, use v2 below)
       on_receive_origin,
       on_end_origin,
       on_rand,
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 4a35666e34ad..1c159d763521 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -1653,7 +1653,7 @@ struct Session::Impl final : public MemoryRetainer {
 
   static constexpr ngtcp2_callbacks CLIENT = {
       ngtcp2_crypto_client_initial_cb,
-      nullptr,  // stream_stop_sending
+      nullptr,  // recv_client_initial
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
       on_receive_version_negotiation,
@@ -1687,7 +1687,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
       on_receive_rx_key,
       on_receive_tx_key,
@@ -1697,20 +1697,18 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 
   static constexpr ngtcp2_callbacks SERVER = {
-      nullptr,  // stream_stop_sending
+      nullptr,  // client_initial
       ngtcp2_crypto_recv_client_initial_cb,
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
-      nullptr,
+      nullptr,  // recv_version_negotiation
       ngtcp2_crypto_encrypt_cb,
       ngtcp2_crypto_decrypt_cb,
       ngtcp2_crypto_hp_mask_cb,
@@ -1719,7 +1717,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_stream_open,
       on_stream_close,
       nullptr,  // recv_stateless_reset (deprecated, use v2 below)
-      nullptr,
+      nullptr,  // recv_retry
       on_extend_max_streams_bidi,
       on_extend_max_streams_uni,
       on_rand,
@@ -1727,23 +1725,23 @@ struct Session::Impl final : public MemoryRetainer {
       on_remove_connection_id,
       ngtcp2_crypto_update_key_cb,
       on_path_validation,
-      nullptr,
+      nullptr,  // select_preferred_addr
       on_stream_reset,
       on_extend_max_remote_streams_bidi,
       on_extend_max_remote_streams_uni,
       on_extend_max_stream_data,
       nullptr,  // dcid_status (deprecated, use v2 below)
-      nullptr,
-      nullptr,
+      nullptr,  // handshake_confirmed
+      nullptr,  // recv_new_token
       ngtcp2_crypto_delete_crypto_aead_ctx_cb,
       ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
       on_receive_datagram,
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
-      nullptr,
+      nullptr,  // recv_rx_key
       on_receive_tx_key,
       on_early_data_rejected,
       on_begin_path_validation,
@@ -1751,12 +1749,10 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 };
 

From 48c90fffb7f1a38ca66f43691e30c92d3748c463 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 21 Aug 2026 12:06:32 +0000
Subject: [PATCH 131/202] src: support building with the V8 sandbox

With V8_ENABLE_SANDBOX every ArrayBuffer backing store has to be
allocated inside the sandbox, so memory that Node.js or a library
allocated itself cannot be wrapped and has to be copied in. Several
places already special-cased this, each with its own #ifdef, but a
build with the sandbox enabled still failed to compile
(`kMaxSafeBufferSizeForSandbox`), aborted in `crypto.randomUUID()`
(`SecureBuffer` was UNREACHABLE) and threw from every caller of the
malloc-owning `Buffer::New()` (v8.serialize, string transcoding, IPC,
the public `Buffer::New(isolate, data, length)`), and trace_events,
SEA assets and FFI still wrapped outside memory unconditionally.

Add `AdoptIntoBackingStore()`, which wraps the memory as before in
regular builds and copies it into an isolate-allocated backing store,
running the deleter right away, when the sandbox is enabled, and use it
at all of those sites so the #ifdef lives in one place. The trace
category flag cannot be copied since JS polls it, so under the sandbox
`getCategoryEnabledBuffer()` returns nothing and lib falls back to
`isTraceCategoryEnabled()`; FFI zero-copy views throw
ERR_OPERATION_FAILED there for the same reason.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62237
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 lib/ffi.js                                    |  9 ++-
 lib/internal/http.js                          |  8 +--
 lib/internal/trace_events.js                  | 19 +++++-
 lib/internal/util/debuglog.js                 | 10 +--
 src/crypto/crypto_dh.cc                       | 22 ++-----
 src/crypto/crypto_util.cc                     | 52 ++++-----------
 src/crypto/crypto_x509.cc                     | 23 ++-----
 src/ffi/data.cc                               | 26 ++++++--
 src/node_buffer.cc                            | 65 +++++++++----------
 src/node_buffer.h                             |  6 +-
 src/node_sea.cc                               |  4 +-
 src/node_sqlite.cc                            | 18 ++---
 src/node_trace_events.cc                      |  5 +-
 src/util.cc                                   | 21 ++++++
 src/util.h                                    | 12 ++++
 test/cctest/test_dataqueue.cc                 | 43 +++++++-----
 test/cctest/test_environment.cc               |  4 ++
 test/cctest/test_linked_binding.cc            | 16 ++---
 test/common/README.md                         |  7 ++
 test/common/index.js                          |  2 +
 test/common/index.mjs                         |  2 +
 test/ffi/test-ffi-memory.js                   | 16 ++++-
 test/parallel/test-crypto-secure-heap.js      |  4 ++
 ...race-events-get-category-enabled-buffer.js | 11 ++--
 24 files changed, 222 insertions(+), 183 deletions(-)

diff --git a/lib/ffi.js b/lib/ffi.js
index cbd188793200..ce8345f155fb 100644
--- a/lib/ffi.js
+++ b/lib/ffi.js
@@ -256,11 +256,10 @@ function exportString(str, data, len, encoding = 'utf8') {
     throw new ERR_OUT_OF_RANGE('len', `>= ${requiredLength}`, len);
   }
 
-  const targetBuffer = toBuffer(data, len, false);
-  const dataLength = sourceBuffer.length;
-
-  sourceBuffer.copy(targetBuffer, 0, 0, dataLength);
-  targetBuffer.fill(0, dataLength, dataLength + terminatorSize);
+  const terminated = Buffer.allocUnsafe(requiredLength);
+  sourceBuffer.copy(terminated);
+  terminated.fill(0, sourceBuffer.length);
+  exportBytes(terminated, data, len);
 }
 
 function exportBuffer(source, data, len) {
diff --git a/lib/internal/http.js b/lib/internal/http.js
index 304ef04d6638..d4efd7ad3adb 100644
--- a/lib/internal/http.js
+++ b/lib/internal/http.js
@@ -10,7 +10,7 @@ const {
 
 const { setUnrefTimeout } = require('internal/timers');
 const {
-  getCategoryEnabledBuffer,
+  categoryEnabledChecker,
   trace,
   nodeTraceEventCategory,
   kAsyncBegin,
@@ -44,11 +44,7 @@ function getNextTraceEventId() {
   return ++traceEventId;
 }
 
-const httpEnabled = getCategoryEnabledBuffer('node.http');
-
-function isTraceHTTPEnabled() {
-  return httpEnabled[0] > 0;
-}
+const isTraceHTTPEnabled = categoryEnabledChecker('node.http');
 
 const traceEventCategory = nodeTraceEventCategory('node.http');
 
diff --git a/lib/internal/trace_events.js b/lib/internal/trace_events.js
index d240f4ad589e..77959e4d5825 100644
--- a/lib/internal/trace_events.js
+++ b/lib/internal/trace_events.js
@@ -1,6 +1,11 @@
 'use strict';
 
-const { getCategoryEnabledBuffer, trace, usePerfetto } = internalBinding('trace_events');
+const {
+  getCategoryEnabledBuffer,
+  isTraceCategoryEnabled,
+  trace,
+  usePerfetto,
+} = internalBinding('trace_events');
 const {
   CHAR_UPPERCASE_B,
   CHAR_LOWERCASE_B,
@@ -17,6 +22,16 @@ if (usePerfetto) {
   nodeTraceEventCategory = (category) => `node,${category}`;
 }
 
+// The returned function reads the category's enabled flag directly when the
+// binding can expose it to JS, and asks the tracing controller otherwise.
+function categoryEnabledChecker(category) {
+  const buffer = getCategoryEnabledBuffer(category);
+  if (buffer === undefined) {
+    return () => isTraceCategoryEnabled(category);
+  }
+  return () => buffer[0] > 0;
+}
+
 // The async events describe the execution of a single asynchronous operation, and are
 // used to measure the time spent in a single asynchronous operation.
 // Async events may overlap with each other. Different events do not have
@@ -44,7 +59,7 @@ const kTraceInstant = CHAR_LOWERCASE_N;
 
 module.exports = {
   usePerfetto,
-  getCategoryEnabledBuffer,
+  categoryEnabledChecker,
   trace,
   nodeTraceEventCategory,
   kAsyncBegin,
diff --git a/lib/internal/util/debuglog.js b/lib/internal/util/debuglog.js
index 1cb3ba4df520..2eeab81dcff4 100644
--- a/lib/internal/util/debuglog.js
+++ b/lib/internal/util/debuglog.js
@@ -16,7 +16,7 @@ const {
 } = primordials;
 const { inspect, format, formatWithOptions } = require('internal/util/inspect');
 const {
-  getCategoryEnabledBuffer,
+  categoryEnabledChecker,
   trace,
   nodeTraceEventCategory,
   kAsyncBegin,
@@ -388,14 +388,14 @@ function debugWithTimer(set, cb) {
   }
 
   const traceCategory = nodeTraceEventCategory(`node.${StringPrototypeToLowerCase(set)}`);
-  let traceCategoryBuffer;
+  let traceCategoryEnabled;
   let debugLogCategoryEnabled = false;
   let timerFlags = kNone;
 
   function ensureTimerFlagsAreUpdated() {
     timerFlags &= ~kSkipTrace;
 
-    if (traceCategoryBuffer[0] === 0) {
+    if (!traceCategoryEnabled()) {
       timerFlags |= kSkipTrace;
     }
   }
@@ -469,7 +469,7 @@ function debugWithTimer(set, cb) {
     }
     emitWarningIfNeeded(set);
     debugLogCategoryEnabled = testEnabled(set);
-    traceCategoryBuffer = getCategoryEnabledBuffer(traceCategory);
+    traceCategoryEnabled = categoryEnabledChecker(traceCategory);
 
     timerFlags = kNone;
 
@@ -477,7 +477,7 @@ function debugWithTimer(set, cb) {
       timerFlags |= kSkipLog;
     }
 
-    if (traceCategoryBuffer[0] === 0) {
+    if (!traceCategoryEnabled()) {
       timerFlags |= kSkipTrace;
     }
 
diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
index 7fbaf4fff5d9..27f3a8a4cbc9 100644
--- a/src/crypto/crypto_dh.cc
+++ b/src/crypto/crypto_dh.cc
@@ -22,8 +22,6 @@ using ncrypto::DHPointer;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
 using v8::ArrayBuffer;
-using v8::BackingStoreInitializationMode;
-using v8::BackingStoreOnFailureMode;
 using v8::ConstructorBehavior;
 using v8::Context;
 using v8::DontDelete;
@@ -60,21 +58,8 @@ MaybeLocal<Value> DataPointerToBuffer(Environment* env, DataPointer&& data) {
   struct Flag {
     bool secure;
   };
-#ifdef V8_ENABLE_SANDBOX
-  auto backing = ArrayBuffer::NewBackingStore(
+  auto backing = AdoptIntoBackingStore(
       env->isolate(),
-      data.size(),
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
-  if (!backing) {
-    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-    return MaybeLocal<Value>();
-  }
-  if (data.size() > 0) {
-    memcpy(backing->Data(), data.get(), data.size());
-  }
-#else
-  auto backing = ArrayBuffer::NewBackingStore(
       data.get(),
       data.size(),
       [](void* data, size_t len, void* ptr) {
@@ -83,7 +68,10 @@ MaybeLocal<Value> DataPointerToBuffer(Environment* env, DataPointer&& data) {
       },
       new Flag{data.isSecure()});
   data.release();
-#endif  // V8_ENABLE_SANDBOX
+  if (!backing) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<Value>();
+  }
 
   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
   return Buffer::New(env, ab, 0, ab->ByteLength()).FromMaybe(Local<Value>());
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 942e00accba9..568325a99462 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -46,8 +46,6 @@ using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
 using v8::BackingStore;
-using v8::BackingStoreInitializationMode;
-using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
 using v8::Context;
 using v8::DictionaryTemplate;
@@ -802,36 +800,18 @@ std::unique_ptr<BackingStore> ByteSource::ReleaseToBackingStore(
   // It's ok for allocated_data_ to be nullptr but
   // only if size_ is zero.
   CHECK_IMPLIES(size_ > 0, allocated_data_ != nullptr);
-#ifdef V8_ENABLE_SANDBOX
-  // If the v8 sandbox is enabled, then all array buffers must be allocated
-  // via the isolate. External buffers are not allowed. So, instead of wrapping
-  // the allocated data we'll copy it instead.
-
-  // TODO(@jasnell): It would be nice to use an abstracted utility to do this
-  // branch instead of duplicating the V8_ENABLE_SANDBOX check each time.
-  std::unique_ptr<BackingStore> ptr = ArrayBuffer::NewBackingStore(
+  std::unique_ptr<BackingStore> ptr = AdoptIntoBackingStore(
       env->isolate(),
-      size(),
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
-  if (!ptr) {
-    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-    return nullptr;
-  }
-  memcpy(ptr->Data(), allocated_data_, size());
-  OPENSSL_clear_free(allocated_data_, size_);
-#else
-  std::unique_ptr<BackingStore> ptr = ArrayBuffer::NewBackingStore(
       allocated_data_,
       size(),
-      [](void* data, size_t length, void* deleter_data) {
-        OPENSSL_clear_free(deleter_data, length);
-      }, allocated_data_);
-#endif  // V8_ENABLE_SANDBOX
-  CHECK(ptr);
+      [](void* data, size_t length, void*) {
+        OPENSSL_clear_free(data, length);
+      },
+      nullptr);
   allocated_data_ = nullptr;
   data_ = nullptr;
   size_ = 0;
+  if (!ptr) THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
   return ptr;
 }
 
@@ -1193,17 +1173,6 @@ namespace {
 // initialized, SecureBuffer will automatically use it.
 void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-#ifdef V8_ENABLE_SANDBOX
-  // The v8 sandbox is enabled, so we cannot use the secure heap because
-  // the sandbox requires that all array buffers be allocated via the isolate.
-  // That is fundamentally incompatible with the secure heap which allocates
-  // in openssl's secure heap area. Instead we'll just throw an error here.
-  //
-  // That said, we really shouldn't get here in the first place since the
-  // option to enable the secure heap is only available when the sandbox
-  // is disabled.
-  UNREACHABLE();
-#else
   CHECK(args[0]->IsUint32());
   uint32_t len = args[0].As<Uint32>()->Value();
 
@@ -1213,7 +1182,10 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
   }
   auto released = data.release();
 
-  std::shared_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
+  // Under V8_ENABLE_SANDBOX this ends up as a plain copy, which is fine:
+  // --secure-heap is unavailable there, so SecureAlloc() is OPENSSL_malloc().
+  std::shared_ptr<BackingStore> store = AdoptIntoBackingStore(
+      env->isolate(),
       released.data,
       released.len,
       [](void* data, size_t len, void* deleter_data) {
@@ -1227,10 +1199,12 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
             true);
       },
       nullptr);
+  if (!store) {
+    return THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+  }
 
   Local<ArrayBuffer> buffer = ArrayBuffer::New(env->isolate(), store);
   args.GetReturnValue().Set(Uint8Array::New(buffer, 0, len));
-#endif  // V8_ENABLE_SANDBOX
 }
 
 void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index b81141e1a915..14825742e986 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -27,8 +27,6 @@ using ncrypto::X509View;
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
-using v8::BackingStoreInitializationMode;
-using v8::BackingStoreOnFailureMode;
 using v8::Boolean;
 using v8::Context;
 using v8::Date;
@@ -140,29 +138,18 @@ MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
   BUF_MEM* mem = *bio;
   if (!mem) [[unlikely]]
     return {};
-#ifdef V8_ENABLE_SANDBOX
-  // If the v8 sandbox is enabled, then all array buffers must be allocated
-  // via the isolate. External buffers are not allowed. So, instead of wrapping
-  // the BIOPointer we'll copy it instead.
-  auto backing = ArrayBuffer::NewBackingStore(
+  auto backing = AdoptIntoBackingStore(
       env->isolate(),
-      mem->length,
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
-  if (!backing) {
-    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-    return MaybeLocal<Value>();
-  }
-  memcpy(backing->Data(), mem->data, mem->length);
-#else
-  auto backing = ArrayBuffer::NewBackingStore(
       mem->data,
       mem->length,
       [](void*, size_t, void* data) {
         BIOPointer free_me(static_cast<BIO*>(data));
       },
       bio->release());
-#endif  // V8_ENABLE_SANDBOX
+  if (!backing) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<Value>();
+  }
   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
   Local<Value> ret;
   if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index bc287ddd13f9..2aa68ce8c0a3 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -533,6 +533,17 @@ void ToString(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(out);
 }
 
+// Foreign memory lies outside the V8 sandbox and cannot back an ArrayBuffer.
+static bool ZeroCopyUnavailable(Environment* env) {
+#ifdef V8_ENABLE_SANDBOX
+  THROW_ERR_OPERATION_FAILED(
+      env, "Zero-copy views are not available when the V8 sandbox is enabled");
+  return true;
+#else
+  return false;
+#endif
+}
+
 void ToBuffer(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
@@ -578,9 +589,12 @@ void ToBuffer(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  bool copy = args.Length() < 3 || args[2]->IsUndefined() ||
+              args[2]->BooleanValue(isolate);
+  if (!copy && ZeroCopyUnavailable(env)) return;
+
   Local<Object> buf;
-  if (args.Length() < 3 || args[2]->IsUndefined() ||
-      args[2]->BooleanValue(isolate)) {
+  if (copy) {
     if (!Buffer::Copy(env, reinterpret_cast<char*>(ptr), len).ToLocal(&buf)) {
       return;
     }
@@ -640,10 +654,12 @@ void ToArrayBuffer(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  Local<ArrayBuffer> ab;
+  bool copy = args.Length() < 3 || args[2]->IsUndefined() ||
+              args[2]->BooleanValue(isolate);
+  if (!copy && ZeroCopyUnavailable(env)) return;
 
-  if (args.Length() < 3 || args[2]->IsUndefined() ||
-      args[2]->BooleanValue(isolate)) {
+  Local<ArrayBuffer> ab;
+  if (copy) {
     std::unique_ptr<BackingStore> store =
         ArrayBuffer::NewBackingStore(isolate, len);
     memcpy(store->Data(), reinterpret_cast<void*>(ptr), len);
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index 1093b73e6838..99fb37ef186b 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -88,7 +88,7 @@ namespace {
 
 class CallbackInfo : public Cleanable {
  public:
-  static inline Local<ArrayBuffer> CreateTrackedArrayBuffer(
+  static inline MaybeLocal<ArrayBuffer> CreateTrackedArrayBuffer(
       Environment* env,
       char* data,
       size_t length,
@@ -114,7 +114,7 @@ class CallbackInfo : public Cleanable {
   Environment* const env_;
 };
 
-Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
+MaybeLocal<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
     Environment* env,
     char* data,
     size_t length,
@@ -124,10 +124,18 @@ Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
   CHECK_IMPLIES(data == nullptr, length == 0);
 
   CallbackInfo* self = new CallbackInfo(env, callback, data, hint);
-  std::unique_ptr<BackingStore> bs =
-      ArrayBuffer::NewBackingStore(data, length, [](void*, size_t, void* arg) {
+  std::unique_ptr<BackingStore> bs = AdoptIntoBackingStore(
+      env->isolate(),
+      data,
+      length,
+      [](void*, size_t, void* arg) {
         static_cast<CallbackInfo*>(arg)->OnBackingStoreFree();
-      }, self);
+      },
+      self);
+  if (!bs) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<ArrayBuffer>();
+  }
   Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(bs));
 
   // V8 simply ignores the BackingStore deleter callback if data == nullptr,
@@ -135,7 +143,7 @@ Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
   if (data == nullptr) {
     ab->Detach(Local<Value>()).Check();
     self->OnBackingStoreFree();  // This calls `callback` asynchronously.
-  } else {
+  } else if (ab->Data() == data) {
     // Store the ArrayBuffer so that we can detach it later.
     self->persistent_.Reset(env->isolate(), ab);
     self->persistent_.SetWeak();
@@ -144,7 +152,6 @@ Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
   return ab;
 }
 
-
 CallbackInfo::CallbackInfo(Environment* env,
                            FreeCallback callback,
                            char* data,
@@ -481,11 +488,13 @@ MaybeLocal<Object> New(Environment* env,
     return Local<Object>();
   }
 
-  Local<ArrayBuffer> ab =
-      CallbackInfo::CreateTrackedArrayBuffer(env, data, length, callback, hint);
-  if (ab->SetPrivate(env->context(),
+  Local<ArrayBuffer> ab;
+  if (!CallbackInfo::CreateTrackedArrayBuffer(env, data, length, callback, hint)
+           .ToLocal(&ab) ||
+      ab->SetPrivate(env->context(),
                      env->untransferable_object_private_symbol(),
-                     True(env->isolate())).IsNothing()) {
+                     True(env->isolate()))
+          .IsNothing()) {
     return Local<Object>();
   }
   MaybeLocal<Uint8Array> maybe_ui = Buffer::New(env, ab, 0, length);
@@ -529,32 +538,24 @@ MaybeLocal<Object> New(Environment* env,
     }
   }
 
-#if defined(V8_ENABLE_SANDBOX)
-  // When v8 sandbox is enabled, external backing stores are not supported
-  // since all arraybuffer allocations are expected to be done by the isolate.
-  // Since this violates the contract of this function, let's free the data and
-  // throw an error.
-  free(data);
-  THROW_ERR_OPERATION_FAILED(
-      env->isolate(),
-      "Wrapping external data is not supported when the v8 sandbox is enabled");
-  return MaybeLocal<Object>();
-#else
   EscapableHandleScope handle_scope(env->isolate());
 
-  auto free_callback = [](void* data, size_t length, void* deleter_data) {
-    free(data);
-  };
-  std::unique_ptr<BackingStore> bs =
-      ArrayBuffer::NewBackingStore(data, length, free_callback, nullptr);
-
+  std::unique_ptr<BackingStore> bs = AdoptIntoBackingStore(
+      env->isolate(),
+      data,
+      length,
+      [](void* data, size_t, void*) { free(data); },
+      nullptr);
+  if (!bs) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<Object>();
+  }
   Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(bs));
 
   Local<Object> obj;
   if (Buffer::New(env, ab, 0, length).ToLocal(&obj))
     return handle_scope.Escape(obj);
   return Local<Object>();
-#endif
 }
 
 namespace {
@@ -1608,11 +1609,7 @@ inline size_t CheckNumberToSize(Local<Value> number) {
   // See v8::internal::TryNumberToSize on this (and on < comparison)
   double maxSize = static_cast<double>(std::numeric_limits<size_t>::max());
   CHECK(value >= 0 && value < maxSize);
-  size_t size = static_cast<size_t>(value);
-#ifdef V8_ENABLE_SANDBOX
-  CHECK_LE(size, kMaxSafeBufferSizeForSandbox);
-#endif
-  return size;
+  return static_cast<size_t>(value);
 }
 
 // Allocates an ArrayBuffer of `size` bytes. Its contents are left
diff --git a/src/node_buffer.h b/src/node_buffer.h
index 81ed9481db65..d5a111ede004 100644
--- a/src/node_buffer.h
+++ b/src/node_buffer.h
@@ -53,14 +53,16 @@ NODE_EXTERN v8::MaybeLocal<v8::Object> New(v8::Isolate* isolate,
                                            v8::Local<v8::String> string,
                                            enum encoding enc = UTF8);
 
-// public constructor - data is used, callback is passed data on object gc
+// public constructor - data is used, callback is passed data on object gc.
+// If V8 is built with its sandbox, data is copied instead and callback runs
+// on the next turn of the event loop.
 NODE_EXTERN v8::MaybeLocal<v8::Object> New(v8::Isolate* isolate,
                                            char* data,
                                            size_t length,
                                            FreeCallback callback,
                                            void* hint);
 
-// public constructor - data is used.
+// public constructor - data is used, or copied and freed under the V8 sandbox.
 NODE_EXTERN v8::MaybeLocal<v8::Object> New(v8::Isolate* isolate,
                                            char* data,
                                            size_t len);
diff --git a/src/node_sea.cc b/src/node_sea.cc
index d17ed779399c..a988de5ed095 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -878,11 +878,13 @@ void GetAsset(const FunctionCallbackInfo<Value>& args) {
   }
   // We cast away the constness here, the JS land should ensure that
   // the data is not mutated.
-  std::unique_ptr<v8::BackingStore> store = ArrayBuffer::NewBackingStore(
+  std::unique_ptr<v8::BackingStore> store = AdoptIntoBackingStore(
+      args.GetIsolate(),
       const_cast<char*>(it->second.data()),
       it->second.size(),
       [](void*, size_t, void*) {},
       nullptr);
+  CHECK(store);
   Local<ArrayBuffer> ab = ArrayBuffer::New(args.GetIsolate(), std::move(store));
   args.GetReturnValue().Set(ab);
 }
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 76accf1c2731..f52f7e4f9b9c 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -2034,27 +2034,17 @@ void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  // V8 sandbox forbids external backing stores so allocate inside the
-  // sandbox and copy. Without sandbox wrap the output directly using
-  // sqlite3_free as the destructor to avoid the copy.
-#ifdef V8_ENABLE_SANDBOX
-  auto free_data = OnScopeLeave([&] { sqlite3_free(data); });
-  auto store = ArrayBuffer::NewBackingStore(
+  auto store = AdoptIntoBackingStore(
       env->isolate(),
+      data,
       size,
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
+      [](void* ptr, size_t, void*) { sqlite3_free(ptr); },
+      nullptr);
   if (!store) {
     THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
     return;
   }
-  memcpy(store->Data(), data, size);
   Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(store));
-#else
-  auto store = ArrayBuffer::NewBackingStore(
-      data, size, [](void* ptr, size_t, void*) { sqlite3_free(ptr); }, nullptr);
-  Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(store));
-#endif
 
   args.GetReturnValue().Set(Uint8Array::New(ab, 0, size));
 }
diff --git a/src/node_trace_events.cc b/src/node_trace_events.cc
index fec72919eb83..db0a37b85e13 100644
--- a/src/node_trace_events.cc
+++ b/src/node_trace_events.cc
@@ -133,7 +133,9 @@ static void SetTraceCategoryStateUpdateHandler(
 
 static void GetCategoryEnabledBuffer(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsString());
-
+  // The flag lives outside the V8 sandbox and cannot back an ArrayBuffer
+  // there; lib/internal/trace_events.js falls back to isTraceCategoryEnabled().
+#ifndef V8_ENABLE_SANDBOX
   Isolate* isolate = args.GetIsolate();
   node::Utf8Value category_name(isolate, args[0]);
 
@@ -150,6 +152,7 @@ static void GetCategoryEnabledBuffer(const FunctionCallbackInfo<Value>& args) {
   v8::Local<Uint8Array> u8 = v8::Uint8Array::New(ab, 0, 1);
 
   args.GetReturnValue().Set(u8);
+#endif
 }
 
 void NodeCategorySet::Initialize(Local<Object> target,
diff --git a/src/util.cc b/src/util.cc
index 15cbb202c9a6..179474928626 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -87,6 +87,7 @@ namespace node {
 
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
+using v8::BackingStore;
 using v8::Context;
 using v8::FunctionTemplate;
 using v8::Isolate;
@@ -677,6 +678,26 @@ Local<String> UnionBytes::ToStringChecked(Isolate* isolate) const {
   }
 }
 
+std::unique_ptr<BackingStore> AdoptIntoBackingStore(
+    Isolate* isolate,
+    void* data,
+    size_t byte_length,
+    BackingStore::DeleterCallback deleter,
+    void* deleter_data) {
+#ifdef V8_ENABLE_SANDBOX
+  std::unique_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
+      isolate,
+      byte_length,
+      v8::BackingStoreInitializationMode::kUninitialized,
+      v8::BackingStoreOnFailureMode::kReturnNull);
+  if (store && byte_length > 0) memcpy(store->Data(), data, byte_length);
+  if (data != nullptr) deleter(data, byte_length, deleter_data);
+  return store;
+#else
+  return ArrayBuffer::NewBackingStore(data, byte_length, deleter, deleter_data);
+#endif
+}
+
 RAIIIsolateWithoutEntering::RAIIIsolateWithoutEntering(const SnapshotData* data)
     : allocator_{ArrayBuffer::Allocator::NewDefaultAllocator()} {
   isolate_ = Isolate::Allocate();
diff --git a/src/util.h b/src/util.h
index 621d2fbf4ee6..ec7fbad43798 100644
--- a/src/util.h
+++ b/src/util.h
@@ -641,6 +641,18 @@ class ArrayBufferViewContents {
   bool was_detached_ = false;
 };
 
+// Creates a BackingStore with the contents of |data|. |deleter| runs once V8
+// no longer needs |data|: on release of the store when it can reference
+// |data| directly, or before this returns when V8 requires backing stores
+// inside its sandbox and |data| was copied. Returns nullptr if that copy
+// could not be allocated; |deleter| has run in that case too.
+std::unique_ptr<v8::BackingStore> AdoptIntoBackingStore(
+    v8::Isolate* isolate,
+    void* data,
+    size_t byte_length,
+    v8::BackingStore::DeleterCallback deleter,
+    void* deleter_data);
+
 class Utf8Value : public MaybeStackBuffer<char> {
  public:
   explicit Utf8Value(v8::Isolate* isolate, v8::Local<v8::Value> value);
diff --git a/test/cctest/test_dataqueue.cc b/test/cctest/test_dataqueue.cc
index 7c75bf9bfc42..785c6b906ba6 100644
--- a/test/cctest/test_dataqueue.cc
+++ b/test/cctest/test_dataqueue.cc
@@ -10,12 +10,27 @@ using node::DataQueue;
 using v8::ArrayBuffer;
 using v8::BackingStore;
 
+// Backing stores must lie inside V8's sandbox when it is enabled, so copy
+// the test data into memory from the default allocator rather than wrap it.
+static std::shared_ptr<BackingStore> MakeStore(const char* data) {
+  static ArrayBuffer::Allocator* const allocator =
+      ArrayBuffer::Allocator::NewDefaultAllocator();
+  size_t len = strlen(data);
+  void* copy = allocator->AllocateUninitialized(len);
+  CHECK_NOT_NULL(copy);
+  memcpy(copy, data, len);
+  return ArrayBuffer::NewBackingStore(
+      copy,
+      len,
+      [](void* p, size_t n, void*) { allocator->Free(p, n); },
+      nullptr);
+}
+
 TEST(DataQueue, InMemoryEntry) {
   char buffer[] = "hello world";
   size_t len = strlen(buffer);
 
-  std::shared_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
-      &buffer, len, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store = MakeStore(buffer);
 
   // We can create an InMemoryEntry from a v8::BackingStore.
   std::unique_ptr<DataQueue::Entry> entry =
@@ -87,11 +102,9 @@ TEST(DataQueue, IdempotentDataQueue) {
   size_t len2 = strlen(buffer2);
   size_t len3 = strlen(buffer3);
 
-  std::shared_ptr<BackingStore> store1 = ArrayBuffer::NewBackingStore(
-      &buffer1, len1, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store1 = MakeStore(buffer1);
 
-  std::shared_ptr<BackingStore> store2 = ArrayBuffer::NewBackingStore(
-      &buffer2, len2, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store2 = MakeStore(buffer2);
 
   std::vector<std::unique_ptr<DataQueue::Entry>> list;
   list.push_back(
@@ -124,8 +137,7 @@ TEST(DataQueue, IdempotentDataQueue) {
   // The size is known to be the sum of the in memory-entries.
   CHECK_EQ(data_queue->size().value(), len1 + len2);
 
-  std::shared_ptr<BackingStore> store3 = ArrayBuffer::NewBackingStore(
-      &buffer3, len3, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store3 = MakeStore(buffer3);
 
   // Trying to append a new entry does not crash, but returns std::nullopt.
   CHECK(!data_queue
@@ -416,14 +428,11 @@ TEST(DataQueue, NonIdempotentDataQueue) {
   size_t len2 = strlen(buffer2);
   size_t len3 = strlen(buffer3);
 
-  std::shared_ptr<BackingStore> store1 = ArrayBuffer::NewBackingStore(
-      &buffer1, len1, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store1 = MakeStore(buffer1);
 
-  std::shared_ptr<BackingStore> store2 = ArrayBuffer::NewBackingStore(
-      &buffer2, len2, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store2 = MakeStore(buffer2);
 
-  std::shared_ptr<BackingStore> store3 = ArrayBuffer::NewBackingStore(
-      &buffer3, len3, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store3 = MakeStore(buffer3);
 
   // We can create an non-idempotent DataQueue from a list of entries.
   std::shared_ptr<DataQueue> data_queue = DataQueue::Create();
@@ -550,11 +559,9 @@ TEST(DataQueue, DataQueueEntry) {
   size_t len1 = strlen(buffer1);
   size_t len2 = strlen(buffer2);
 
-  std::shared_ptr<BackingStore> store1 = ArrayBuffer::NewBackingStore(
-      &buffer1, len1, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store1 = MakeStore(buffer1);
 
-  std::shared_ptr<BackingStore> store2 = ArrayBuffer::NewBackingStore(
-      &buffer2, len2, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store2 = MakeStore(buffer2);
 
   std::vector<std::unique_ptr<DataQueue::Entry>> list;
   list.push_back(
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 449d7d38750b..fe9915185b71 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -554,7 +554,11 @@ TEST_F(EnvironmentTest, BufferWithFreeCallbackIsDetached) {
   }
 
   CHECK_EQ(callback_calls, 1);
+#ifdef V8_ENABLE_SANDBOX
+  CHECK_EQ(ab->ByteLength(), sizeof(hello));
+#else
   CHECK_EQ(ab->ByteLength(), 0);
+#endif
 }
 
 #if HAVE_INSPECTOR
diff --git a/test/cctest/test_linked_binding.cc b/test/cctest/test_linked_binding.cc
index 10507950becf..be097abd90bb 100644
--- a/test/cctest/test_linked_binding.cc
+++ b/test/cctest/test_linked_binding.cc
@@ -250,8 +250,8 @@ napi_value NapiLinkedWithInstanceData(napi_env env, napi_value exports) {
   napi_value key, value;
   CHECK_EQ(napi_create_string_utf8(env, "hello", NAPI_AUTO_LENGTH, &key),
            napi_ok);
-  CHECK_EQ(napi_create_external_arraybuffer(
-               env, instance_data, 1, nullptr, nullptr, &value),
+  CHECK_EQ(napi_create_bigint_uint64(
+               env, reinterpret_cast<uint64_t>(instance_data), &value),
            napi_ok);
   CHECK_EQ(napi_set_property(env, exports, key, value), napi_ok);
   return nullptr;
@@ -290,9 +290,9 @@ TEST_F(LinkedBindingTest, LocallyDefinedLinkedBindingNapiInstanceDataTest) {
             .ToLocalChecked();
     v8::Local<v8::Value> completion_value =
         script->Run(context).ToLocalChecked();
-    CHECK(completion_value->IsArrayBuffer());
-    instance_data =
-        static_cast<int*>(completion_value.As<v8::ArrayBuffer>()->Data());
+    CHECK(completion_value->IsBigInt());
+    instance_data = reinterpret_cast<int*>(
+        completion_value.As<v8::BigInt>()->Uint64Value());
     CHECK_NE(instance_data, nullptr);
     CHECK_EQ(*instance_data, 0);
   }
@@ -328,9 +328,9 @@ TEST_F(LinkedBindingTest,
             .ToLocalChecked();
     v8::Local<v8::Value> completion_value =
         script->Run(context).ToLocalChecked();
-    CHECK(completion_value->IsArrayBuffer());
-    instance_data =
-        static_cast<int*>(completion_value.As<v8::ArrayBuffer>()->Data());
+    CHECK(completion_value->IsBigInt());
+    instance_data = reinterpret_cast<int*>(
+        completion_value.As<v8::BigInt>()->Uint64Value());
     CHECK_NE(instance_data, nullptr);
     CHECK_EQ(*instance_data, 0);
   }
diff --git a/test/common/README.md b/test/common/README.md
index 193250562972..bc27da028c46 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -273,6 +273,13 @@ Indicates if [internationalization][] is supported.
 
 Indicates whether `IPv6` is supported on this platform.
 
+### `hasV8Sandbox`
+
+* [\<boolean>][<boolean>]
+
+Indicates whether V8 was built with its sandbox enabled, in which case
+`ArrayBuffer`s cannot reference memory outside of it.
+
 ### `hasSQLite`
 
 * [\<boolean>][<boolean>]
diff --git a/test/common/index.js b/test/common/index.js
index 3ec677e566d8..ce083ee7294e 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -36,6 +36,7 @@ const bits = ['arm64', 'loong64', 'mips', 'mipsel', 'ppc64', 'riscv64', 's390x',
   .includes(process.arch) ? 64 : 32;
 const hasIntl = !!process.config.variables.v8_enable_i18n_support;
 const hasTemporal = !!process.config.variables.v8_enable_temporal_support;
+const hasV8Sandbox = !!process.config.variables.v8_enable_sandbox;
 
 // small-icu doesn't support non-English locales
 const hasFullICU = (() => {
@@ -1019,6 +1020,7 @@ const common = {
   getTTYfd,
   hasIntl,
   hasTemporal,
+  hasV8Sandbox,
   hasFullICU,
   hasCrypto,
   hasDtls,
diff --git a/test/common/index.mjs b/test/common/index.mjs
index 108cae290999..9f81a2b920ee 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -24,6 +24,7 @@ const {
   hasLocalStorage,
   hasIntl,
   hasTemporal,
+  hasV8Sandbox,
   hasIPv6,
   isAIX,
   isAlive,
@@ -83,6 +84,7 @@ export {
   hasLocalStorage,
   hasIntl,
   hasTemporal,
+  hasV8Sandbox,
   hasIPv6,
   isAIX,
   isAlive,
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index 6d47200db187..ba4a341688ff 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -76,7 +76,9 @@ test('ffi supports unaligned memory access', () => {
   }));
 });
 
-test('ffi toBuffer supports copy and zero-copy views', () => {
+const zeroCopy = { skip: common.hasV8Sandbox && 'zero-copy views are unavailable with the V8 sandbox' };
+
+test('ffi toBuffer supports copy and zero-copy views', zeroCopy, () => {
   withAllocations(common.mustCall((alloc) => {
     const ptr = alloc(8);
     ffi.exportBuffer(Buffer.from([1, 2, 3, 4]), ptr, 4);
@@ -98,7 +100,7 @@ test('ffi toBuffer supports copy and zero-copy views', () => {
   }));
 });
 
-test('ffi toArrayBuffer supports copy and zero-copy views', () => {
+test('ffi toArrayBuffer supports copy and zero-copy views', zeroCopy, () => {
   withAllocations(common.mustCall((alloc) => {
     const ptr = alloc(4);
     ffi.exportBuffer(Buffer.from([10, 20, 30, 40]), ptr, 4);
@@ -120,6 +122,16 @@ test('ffi toArrayBuffer supports copy and zero-copy views', () => {
   }));
 });
 
+test('ffi zero-copy views throw with the V8 sandbox', { skip: !common.hasV8Sandbox }, () => {
+  withAllocations(common.mustCall((alloc) => {
+    const ptr = alloc(4);
+    ffi.exportBuffer(Buffer.from([1, 2, 3, 4]), ptr, 4);
+    assert.deepStrictEqual([...ffi.toBuffer(ptr, 4)], [1, 2, 3, 4]);
+    assert.throws(() => ffi.toBuffer(ptr, 4, false), { code: 'ERR_OPERATION_FAILED' });
+    assert.throws(() => ffi.toArrayBuffer(ptr, 4, false), { code: 'ERR_OPERATION_FAILED' });
+  }));
+});
+
 test('ffi getRawPointer returns raw addresses for byte sources', () => {
   const buffer = Buffer.from([1, 2, 3]);
   const arrayBuffer = new Uint8Array([4, 5, 6, 7]).buffer;
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index edf4a6d4667f..22f90b6be99f 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -13,6 +13,10 @@ if (common.isASan) {
   common.skip('ASan does not play well with secure heap allocations');
 }
 
+if (common.hasV8Sandbox) {
+  common.skip('--secure-heap is not available with the V8 sandbox');
+}
+
 const {
   isBoringSSL,
   hasOpenSSL,
diff --git a/test/parallel/test-trace-events-get-category-enabled-buffer.js b/test/parallel/test-trace-events-get-category-enabled-buffer.js
index 79d2a1cf30da..929f1ae3f2a8 100644
--- a/test/parallel/test-trace-events-get-category-enabled-buffer.js
+++ b/test/parallel/test-trace-events-get-category-enabled-buffer.js
@@ -15,31 +15,30 @@ common.skipIfPerfettoEnabled();
 const { createTracing, getEnabledCategories } = require('trace_events');
 const assert = require('assert');
 
-const binding = require('internal/test/binding');
-const getCategoryEnabledBuffer = binding.internalBinding('trace_events').getCategoryEnabledBuffer;
+const { categoryEnabledChecker } = require('internal/trace_events');
 
 it('should track enabled/disabled categories', () => {
   const random = Math.random().toString().slice(2);
   const category = `node.${random}`;
 
-  const buffer = getCategoryEnabledBuffer(category);
+  const isEnabled = categoryEnabledChecker(category);
 
   const tracing = createTracing({
     categories: [category],
   });
 
-  assert.ok(buffer[0] === 0, `the buffer[0] should start with value 0, got: ${buffer[0]}`);
+  assert.strictEqual(isEnabled(), false);
 
   tracing.enable();
 
   let currentCategories = getEnabledCategories();
 
   assert.ok(currentCategories.includes(category), `the getEnabledCategories should include ${category}, got: ${currentCategories}`);
-  assert.ok(buffer[0] > 0, `the buffer[0] should be greater than 0, got: ${buffer[0]}`);
+  assert.strictEqual(isEnabled(), true);
 
   tracing.disable();
 
   currentCategories = getEnabledCategories();
   assert.ok(currentCategories === undefined, `the getEnabledCategories should return undefined, got: ${currentCategories}`);
-  assert.ok(buffer[0] === 0, `the buffer[0] should be 0, got: ${buffer[0]}`);
+  assert.strictEqual(isEnabled(), false);
 });

From c7d80a284f4e1a95bedc309cd421b5a2bd6f9d22 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 21 Aug 2026 12:42:35 +0000
Subject: [PATCH 132/202] build: enable the V8 sandbox in shared-cage builds

V8 defaults `v8_enable_sandbox` to on whenever the shared pointer
compression cage and the external code space are enabled, and that is
the configuration embedders that use the sandbox build with. Now that
the sandbox builds and passes the tests, follow that default for
`--experimental-pointer-compression-shared-cage` so the configuration
is reachable from `configure`. Multi-cage pointer compression builds
stay without it: there every IsolateGroup gets its own sandbox, and
`NodeArrayBufferAllocator` always allocates from the default one.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62237
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 configure.py | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/configure.py b/configure.py
index 99ce9326dc93..24039f50165c 100755
--- a/configure.py
+++ b/configure.py
@@ -872,7 +872,7 @@
     action='store_true',
     dest='pointer_compression_shared_cage',
     default=None,
-    help='[Experimental] Use V8 pointer compression with shared cage (requires --experimental-enable-pointer-compression)')
+    help='[Experimental] Use V8 pointer compression with a shared cage and enable the V8 sandbox (requires --experimental-enable-pointer-compression)')
 
 parser.add_argument('--v8-options',
     action='store',
@@ -2214,16 +2214,10 @@ def configure_v8(o, configs):
                                          flavor not in ('aix', 'os400', 'zos') and
                                          o['variables']['target_arch'] in maglev_enabled_architectures)
   o['variables']['v8_enable_pointer_compression'] = 1 if options.enable_pointer_compression else 0
-  # Using the sandbox requires always allocating array buffer backing stores in the sandbox.
-  # We currently have many backing stores tied to pointers from C++ land that are not
-  # even necessarily dynamic (e.g. in static storage) for fast communication between JS and C++.
-  # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
-  # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
-  # so this can be broken at any time.
-  o['variables']['v8_enable_sandbox'] = 0
-  # We set v8_enable_pointer_compression_shared_cage to 0 always, even when
-  # pointer compression is enabled so that we don't accidentally enable shared
-  # cage mode when pointer compression is on.
+  # Like V8's own default, the sandbox goes with the shared pointer compression
+  # cage. Multi-cage builds give every IsolateGroup its own sandbox, which the
+  # array buffer allocator does not know about yet.
+  o['variables']['v8_enable_sandbox'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0

From d25ef922d6bb994b3d656432790d6e5bb7a925c3 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 22 Aug 2026 14:40:26 +0000
Subject: [PATCH 133/202] fs: give directories created by cpSync the source
 directory's mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The C++ fast path that fs.cpSync() takes when no filter is given created
the destination directories with default permissions, so a 0700
directory came out of the copy as 0755 (with the default umask). The
JavaScript implementation, which fs.cp(), fs.promises.cp() and
fs.cpSync() with a filter still use, chmod()s every directory it
creates to the mode of its source, and so did cpSync before the port.

Set the source directory's permissions on each directory the copy
creates (the destination root included); directories that already
exist keep theirs, as before.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65488
Refs: https://github.com/nodejs/node/pull/58461
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 src/node_file.cc                              | 28 +++++++-
 .../test-fs-cp-sync-directory-mode.mjs        | 64 +++++++++++++++++++
 2 files changed, 90 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-fs-cp-sync-directory-mode.mjs

diff --git a/src/node_file.cc b/src/node_file.cc
index de199dfea1a1..4f9b018c8566 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -4724,6 +4724,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
   auto dest_path = dest.ToPath();
 
   std::error_code error;
+  const bool dest_existed = std::filesystem::exists(dest_path, error);
   std::filesystem::create_directories(dest_path, error);
   if (error) {
     return env->ThrowStdErrException(error, "cp", *dest);
@@ -4843,11 +4844,28 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
         }
       } else if (dir_entry.is_directory()) {
         auto entry_dir_path = src / dir_entry.path().filename();
-        std::filesystem::create_directory(dest_file_path);
+        const bool created =
+            std::filesystem::create_directory(dest_file_path, error);
+        if (error) {
+          env->ThrowStdErrException(
+              error, "cp", ConvertPathToUTF8(dest_file_path).c_str());
+          return false;
+        }
         auto success = copy_dir_contents(entry_dir_path, dest_file_path);
         if (!success) {
           return false;
         }
+        // A directory created by the copy gets the mode of its source once
+        // its contents are in (the source may be read-only).
+        if (created) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status().permissions(), error);
+          if (error) {
+            env->ThrowStdErrException(
+                error, "cp", ConvertPathToUTF8(dest_file_path).c_str());
+            return false;
+          }
+        }
       } else if (dir_entry.is_regular_file()) {
         std::filesystem::copy_file(
             dir_entry.path(), dest_file_path, file_copy_opts, error);
@@ -4872,7 +4890,13 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
     return true;
   };
 
-  copy_dir_contents(src_path, dest_path);
+  if (copy_dir_contents(src_path, dest_path) && !dest_existed) {
+    std::filesystem::permissions(
+        dest_path, std::filesystem::status(src_path).permissions(), error);
+    if (error) {
+      return env->ThrowStdErrException(error, "cp", *dest);
+    }
+  }
 }
 
 BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
diff --git a/test/parallel/test-fs-cp-sync-directory-mode.mjs b/test/parallel/test-fs-cp-sync-directory-mode.mjs
new file mode 100644
index 000000000000..f022af268f1e
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-directory-mode.mjs
@@ -0,0 +1,64 @@
+// This tests that cpSync gives the directories it creates the mode of the
+// corresponding source directory, as cp does.
+import { mustNotMutateObjectDeep, isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import { isMainThread } from 'node:worker_threads';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('directory modes are not meaningful on Windows');
+if (!isMainThread)
+  skip('process.umask() is not available in workers');
+
+tmpdir.refresh();
+const mask = process.umask(0o022);
+
+const src = nextdir();
+mkdirSync(join(src, 'private', 'inner'), { recursive: true, mode: 0o700 });
+mkdirSync(join(src, 'shared'), { mode: 0o775 });
+writeFileSync(join(src, 'private', 'inner', 'file'), 'x', { mode: 0o600 });
+
+function modes(root) {
+  return ['.', 'private', 'private/inner', 'shared', 'private/inner/file']
+    .map((p) => (statSync(join(root, p)).mode & 0o777).toString(8));
+}
+
+const destSync = nextdir();
+cpSync(src, destSync, mustNotMutateObjectDeep({ recursive: true }));
+assert.deepStrictEqual(modes(destSync), modes(src));
+
+const destAsync = nextdir();
+await promises.cp(src, destAsync, { recursive: true });
+assert.deepStrictEqual(modes(destAsync), modes(src));
+
+// A read-only source directory can still be copied; its copy ends up read-only too.
+{
+  const roSrc = nextdir();
+  mkdirSync(join(roSrc, 'sub'), { recursive: true });
+  writeFileSync(join(roSrc, 'sub', 'file'), 'x');
+  chmodSync(join(roSrc, 'sub'), 0o555);
+  chmodSync(roSrc, 0o555);
+  const readOnly = [roSrc, join(roSrc, 'sub')];
+  for (const copy of [(dest) => cpSync(roSrc, dest, { recursive: true }),
+                      (dest) => promises.cp(roSrc, dest, { recursive: true })]) {
+    const dest = nextdir();
+    await copy(dest);
+    assert.strictEqual(statSync(join(dest, 'sub', 'file')).size, 1);
+    assert.deepStrictEqual(
+      [dest, join(dest, 'sub')].map((p) => (statSync(p).mode & 0o777).toString(8)), ['555', '555']);
+    readOnly.push(dest, join(dest, 'sub'));
+  }
+  // Let tmpdir clean up.
+  for (const dir of readOnly) chmodSync(dir, 0o755);
+}
+
+// An existing destination directory keeps its own mode.
+const existing = nextdir();
+mkdirSync(existing, { mode: 0o711 });
+cpSync(src, existing, mustNotMutateObjectDeep({ recursive: true }));
+assert.strictEqual((statSync(existing).mode & 0o777).toString(8), '711');
+assert.deepStrictEqual(modes(existing).slice(1), modes(src).slice(1));
+process.umask(mask);

From 29667e046b953029b5544a48884721b931602af0 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 22 Aug 2026 14:50:37 +0000
Subject: [PATCH 134/202] fs: copy directory trees for fs.cp() on the thread
 pool
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fs.cp() and fs.promises.cp() walked the tree in JavaScript with several
thread pool round trips per entry (opendir batches, two stat()s, the
copyFile(), a chmod()), all awaited in sequence: a 2 100-file tree took
~215 ms with ~110 ms of that on the main thread, against ~36 ms for
fs.cpSync(), which copies the tree in C++ when no filter is given.

Factor that C++ walk into CopyDirRecursive(), which records the error
instead of throwing so that it can run on any thread, and run it as one
ThreadPoolWork request (CpDirJob) for fs.cp()/fs.promises.cp() when
the destination directory does not exist yet and nothing has to run per
entry (no filter, no dereference, permission model off). Copying into
an existing tree keeps the JavaScript walk and its rules for what may
already be there. The same tree now takes ~30 ms with under 1 ms on the
main thread.

For that job the walk follows the JavaScript walk's rules rather than
cpSync's: it creates every directory with mkdir() and every file with
an exclusive uv_fs_copyfile() (honouring the copyFile() mode flags) and
fails with EEXIST if anything has appeared in their place since the
JavaScript check, so it never opens or follows something it did not
create; sockets, FIFOs and unknown entries are reported back to
JavaScript, which rejects them with the same SystemErrors as before;
relative link targets are made absolute lexically as path.resolve()
does. cpSync keeps merging into existing directories, skipping special
files and canonicalizing link targets.

The walk now uses the error_code overloads of std::filesystem throughout
(directory iteration included), so an unreadable directory inside the
tree is reported as EACCES by both cp() and cpSync() instead of
terminating the process, which cpSync() has done since the walk moved
to C++. Filesystem errors raised inside the walk keep their codes, with
'cp' or 'copyfile'/'mkdir' as the syscall. With preserveTimestamps the
walk stamps each directory it filled, root included, so cp() keeps
preserving directory times and cpSync() without a filter now does too.
Both file copies set the destination's mode before writing the data,
which clears setuid and setgid, so the walk puts the source mode back
after each file it copied; the JavaScript walk already chmod()s there.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65488
Refs: https://github.com/nodejs/node/pull/58461
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 benchmark/fs/bench-cp.js                      |  33 +
 lib/internal/fs/cp/cp.js                      |  68 +-
 src/node_file.cc                              | 677 +++++++++++++-----
 ...t-fs-cp-async-destination-appears-late.mjs |  35 +
 test/parallel/test-fs-cp-async-file-modes.mjs |  35 +
 ...test-fs-cp-async-special-files-in-tree.mjs |  53 ++
 .../test-fs-cp-async-symlink-targets.mjs      |  29 +
 .../test-fs-cp-async-with-mode-flags.mjs      |  11 +
 .../test-fs-cp-unreadable-directory.mjs       |  33 +
 9 files changed, 761 insertions(+), 213 deletions(-)
 create mode 100644 benchmark/fs/bench-cp.js
 create mode 100644 test/parallel/test-fs-cp-async-destination-appears-late.mjs
 create mode 100644 test/parallel/test-fs-cp-async-file-modes.mjs
 create mode 100644 test/parallel/test-fs-cp-async-special-files-in-tree.mjs
 create mode 100644 test/parallel/test-fs-cp-async-symlink-targets.mjs
 create mode 100644 test/parallel/test-fs-cp-unreadable-directory.mjs

diff --git a/benchmark/fs/bench-cp.js b/benchmark/fs/bench-cp.js
new file mode 100644
index 000000000000..ffaeb87705f5
--- /dev/null
+++ b/benchmark/fs/bench-cp.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// fs.promises.cp() of a directory tree.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../../test/common/tmpdir');
+
+const bench = common.createBenchmark(main, {
+  files: [500],
+  n: [3],
+});
+
+function prepareSource(files) {
+  const src = tmpdir.resolve('cp-src');
+  for (let i = 0; i < files; i++) {
+    const dir = path.join(src, `dir-${i % 10}`, `sub-${i % 7}`);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, `file-${i}.js`), 'x'.repeat(1024 + (i % 512)));
+  }
+  return src;
+}
+
+async function main({ files, n }) {
+  tmpdir.refresh();
+  const src = prepareSource(files);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    await fs.promises.cp(src, tmpdir.resolve(`cp-dest-${i}`), { recursive: true });
+  }
+  bench.end(n);
+}
diff --git a/lib/internal/fs/cp/cp.js b/lib/internal/fs/cp/cp.js
index 35fcefb12d10..1ec5a2d89cac 100644
--- a/lib/internal/fs/cp/cp.js
+++ b/lib/internal/fs/cp/cp.js
@@ -6,6 +6,8 @@ const {
   ArrayPrototypeEvery,
   ArrayPrototypeFilter,
   Boolean,
+  ErrorCaptureStackTrace,
+  Promise,
   PromisePrototypeThen,
   PromiseReject,
   SafePromiseAll,
@@ -55,6 +57,7 @@ const {
   sep,
 } = require('path');
 const fsBinding = internalBinding('fs');
+const permission = require('internal/process/permission');
 
 async function cpFn(src, dest, opts) {
   // Warn about using preserveTimestamps on 32-bit node
@@ -211,30 +214,19 @@ async function getStatsForCopy(destStat, src, dest, opts) {
     return onFile(srcStat, destStat, src, dest, opts);
   } else if (srcStat.isSymbolicLink()) {
     return onLink(destStat, src, dest, opts);
-  } else if (srcStat.isSocket()) {
-    throw new ERR_FS_CP_SOCKET({
-      message: `cannot copy a socket file: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
-  } else if (srcStat.isFIFO()) {
-    throw new ERR_FS_CP_FIFO_PIPE({
-      message: `cannot copy a FIFO pipe: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
   }
-  throw new ERR_FS_CP_UNKNOWN({
-    message: `cannot copy an unknown file type: ${dest}`,
-    path: dest,
-    syscall: 'cp',
-    errno: EINVAL,
-    code: 'EINVAL',
-  });
+  throw errorForSpecialFile(srcStat.isSocket() ? 'socket' : srcStat.isFIFO() ? 'fifo' : 'unknown', dest);
+}
+
+function errorForSpecialFile(kind, dest) {
+  const info = { path: dest, syscall: 'cp', errno: EINVAL, code: 'EINVAL' };
+  if (kind === 'socket') {
+    return new ERR_FS_CP_SOCKET({ message: `cannot copy a socket file: ${dest}`, ...info });
+  }
+  if (kind === 'fifo') {
+    return new ERR_FS_CP_FIFO_PIPE({ message: `cannot copy a FIFO pipe: ${dest}`, ...info });
+  }
+  return new ERR_FS_CP_UNKNOWN({ message: `cannot copy an unknown file type: ${dest}`, ...info });
 }
 
 function onFile(srcStat, destStat, src, dest, opts) {
@@ -318,6 +310,15 @@ async function onDir(srcStat, destStat, src, dest, opts) {
 }
 
 async function mkDirAndCopy(srcMode, src, dest, opts) {
+  // A destination directory that does not exist yet is filled in one thread
+  // pool request by the walk fs.cpSync() uses, unless a filter has to run per
+  // entry, links inside the tree must be dereferenced, or the permission model
+  // has to check each path. Copying into an existing tree keeps the per-entry
+  // walk below and its rules for what may already be there.
+  if (!opts.filter && !opts.dereference && !permission.isEnabled()) {
+    // Creates dest itself, with the mode of src.
+    return copyDirNative(src, dest, opts);
+  }
   await mkdir(dest);
   await copyDir(src, dest, opts);
   if (opts.preserveTimestamps) {
@@ -326,6 +327,27 @@ async function mkDirAndCopy(srcMode, src, dest, opts) {
   return setDestMode(dest, srcMode);
 }
 
+function copyDirNative(src, dest, opts) {
+  return new Promise((resolve, reject) => {
+    const job = new fsBinding.CpDirJob(src, dest, opts.force, opts.dereference, opts.errorOnExist,
+                                       opts.verbatimSymlinks, opts.preserveTimestamps, opts.mode);
+    // Sockets, FIFOs and unknown entries come back as (kind, path) so that
+    // they reject with the same errors as the walk above.
+    job.ondone = (err, specialFile, specialFilePath) => {
+      if (specialFile !== undefined) {
+        err = errorForSpecialFile(specialFile, specialFilePath);
+      }
+      if (err != null) {
+        ErrorCaptureStackTrace(err, copyDirNative);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    job.run();
+  });
+}
+
 async function copyDir(src, dest, opts) {
   const dir = await opendir(src);
 
diff --git a/src/node_file.cc b/src/node_file.cc
index 4f9b018c8566..b047c5a8e6a7 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -4589,96 +4589,12 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-static bool CopyUtimes(const std::filesystem::path& src,
-                       const std::filesystem::path& dest,
-                       Environment* env) {
-  uv_fs_t req;
-  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-
-  auto src_path_str = ConvertPathToUTF8(src);
-  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
-  if (is_uv_error(result)) {
-    env->ThrowUVException(result, "stat", nullptr, src_path_str.c_str());
-    return false;
-  }
-
-  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
-  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
-  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
-
-  auto dest_file_path_str = ConvertPathToUTF8(dest);
-  int utime_result = uv_fs_utime(nullptr,
-                                 &req,
-                                 dest_file_path_str.c_str(),
-                                 source_atime,
-                                 source_mtime,
-                                 nullptr);
-  if (is_uv_error(utime_result)) {
-    env->ThrowUVException(
-        utime_result, "utime", nullptr, dest_file_path_str.c_str());
-    return false;
-  }
-  return true;
-}
-
-static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-
-  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
-
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
-
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
-
-  int mode;
-  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
-    return;
-  }
-
-  bool preserve_timestamps = args[3]->IsTrue();
-
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
-
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
-
-  std::error_code error;
-
-  if (!std::filesystem::remove(dest_path, error)) {
-    return env->ThrowStdErrException(error, "unlink", *dest);
-  }
-
-  if (mode == 0) {
-    // if no mode is specified use the faster std::filesystem API
-    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
-      return env->ThrowStdErrException(error, "cp", *dest);
-    }
-  } else {
-    uv_fs_t req;
-    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
-    if (is_uv_error(result)) {
-      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
-    }
-  }
-
-  if (preserve_timestamps) {
-    CopyUtimes(src_path, dest_path, env);
-  }
-}
-
 std::vector<std::string> normalizePathToArray(
     const std::filesystem::path& path) {
   std::vector<std::string> parts;
-  std::filesystem::path absPath = std::filesystem::absolute(path);
+  std::error_code error;
+  std::filesystem::path absPath = std::filesystem::absolute(path, error);
+  if (error) absPath = path;
 #ifdef _WIN32
   auto wstr = absPath.wstring();
   if (wstr.starts_with(L"\\\\?\\")) {
@@ -4699,108 +4615,240 @@ bool isInsideDir(const std::filesystem::path& src,
   return std::equal(srcArr.begin(), srcArr.end(), destArr.begin());
 }
 
-static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
-  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
-                               // verbatimSymlinks, preserveTimestamps
+namespace {
 
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
+// An fs.cp error recorded on whatever thread performed the copy; Throw() /
+// ToException() turn it into the error the JavaScript caller sees.
+struct CpError {
+  enum Kind {
+    kNone,
+    kErrno,
+    kUv,
+    kEinval,
+    kSymlinkToSubdirectory,
+    kEexist,
+    kSocket,
+    kFifo,
+    kUnknown
+  };
+  Kind kind = kNone;
+  int code = 0;
+  const char* syscall = "cp";
+  std::string message;
+  std::string path;
 
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
+  static CpError Std(const std::error_code& error, const std::string& path) {
+    return {kErrno, error.value(), "cp", error.message(), path};
+  }
+  static CpError Uv(int code, const char* syscall, const std::string& path) {
+    return {kUv, code, syscall, {}, path};
+  }
 
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
+  Local<Value> ToException(Environment* env) const {
+    Isolate* isolate = env->isolate();
+    switch (kind) {
+      case kErrno:
+        return ErrnoException(
+            isolate, code, syscall, message.c_str(), path.c_str());
+      case kUv:
+        return UVException(isolate, code, syscall, nullptr, path.c_str());
+      case kEinval:
+        return ERR_FS_CP_EINVAL(isolate, "%s", message);
+      case kSymlinkToSubdirectory:
+        return ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(isolate, "%s", message);
+      case kEexist:
+        return ERR_FS_CP_EEXIST(isolate, "%s", message);
+      // Sockets, FIFOs and unknown entries are reported to JS by kind and
+      // path (see CpDirJob), cpSync skips them; neither builds an error here.
+      case kSocket:
+      case kFifo:
+      case kUnknown:
+      case kNone:
+        break;
+    }
+    UNREACHABLE();
+  }
 
-  bool force = args[2]->IsTrue();
-  bool dereference = args[3]->IsTrue();
-  bool error_on_exist = args[4]->IsTrue();
-  bool verbatim_symlinks = args[5]->IsTrue();
-  bool preserve_timestamps = args[6]->IsTrue();
+  void Throw(Environment* env) const {
+    env->isolate()->ThrowException(ToException(env));
+  }
+};
 
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
+CpError CopyUtimes(const std::filesystem::path& src,
+                   const std::filesystem::path& dest) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+
+  auto src_path_str = ConvertPathToUTF8(src);
+  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
+  if (is_uv_error(result)) {
+    return CpError::Uv(result, "stat", src_path_str);
+  }
+
+  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
+  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
+  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
 
+  auto dest_file_path_str = ConvertPathToUTF8(dest);
+  int utime_result = uv_fs_utime(nullptr,
+                                 &req,
+                                 dest_file_path_str.c_str(),
+                                 source_atime,
+                                 source_mtime,
+                                 nullptr);
+  if (is_uv_error(utime_result)) {
+    return CpError::Uv(utime_result, "utime", dest_file_path_str);
+  }
+  return {};
+}
+
+struct CpDirOptions {
+  bool force;
+  bool dereference;
+  bool error_on_exist;
+  bool verbatim_symlinks;
+  bool preserve_timestamps;
+  // Set for fs.cp(), which only takes this path for a destination that did
+  // not exist: nothing already present is ever opened for writing or
+  // followed. Directories are created with mkdir() and files with an
+  // exclusive uv_fs_copyfile(), so anything that appears in their place
+  // (a symbolic link included) is EEXIST; sockets, FIFOs and unknown
+  // entries are rejected as the JavaScript walk does; relative link targets
+  // are resolved lexically, as path.resolve() would. fs.cpSync() merges
+  // into existing directories, skips those entries and canonicalizes link
+  // targets.
+  bool fresh_destination;
+  // fs.copyFile() mode flags (COPYFILE_FICLONE etc.) for fresh_destination.
+  int copyfile_flags;
+};
+
+CpError CopyFileFresh(const std::filesystem::path& src,
+                      const std::filesystem::path& dest,
+                      int flags) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto src_str = ConvertPathToUTF8(src);
+  auto dest_str = ConvertPathToUTF8(dest);
+  int rc = uv_fs_copyfile(nullptr,
+                          &req,
+                          src_str.c_str(),
+                          dest_str.c_str(),
+                          flags | UV_FS_COPYFILE_EXCL,
+                          nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "copyfile", dest_str);
+  }
+  return {};
+}
+
+// mkdir() that does not follow or accept anything already at `path`.
+CpError MakeFreshDirectory(const std::filesystem::path& path) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto path_str = ConvertPathToUTF8(path);
+  int rc = uv_fs_mkdir(nullptr, &req, path_str.c_str(), 0777, nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "mkdir", path_str);
+  }
+  return {};
+}
+
+// The recursive directory copy behind fs.cpSync() and, on the thread pool,
+// fs.cp()/fsPromises.cp() when no filter function is involved. Runs on any
+// thread; touches no JS.
+CpError CopyDirRecursive(const std::filesystem::path& src_path,
+                         const std::filesystem::path& dest_path,
+                         const std::string& dest_display,
+                         const CpDirOptions& options) {
   std::error_code error;
-  const bool dest_existed = std::filesystem::exists(dest_path, error);
-  std::filesystem::create_directories(dest_path, error);
-  if (error) {
-    return env->ThrowStdErrException(error, "cp", *dest);
+  bool dest_existed = false;
+  if (options.fresh_destination) {
+    CpError made = MakeFreshDirectory(dest_path);
+    if (made.kind != CpError::kNone) return made;
+  } else {
+    dest_existed = std::filesystem::exists(dest_path, error);
+    std::filesystem::create_directories(dest_path, error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
   }
 
   auto file_copy_opts = std::filesystem::copy_options::recursive;
-  if (force) {
+  if (options.force) {
     file_copy_opts |= std::filesystem::copy_options::overwrite_existing;
-  } else if (error_on_exist) {
+  } else if (options.error_on_exist) {
     file_copy_opts |= std::filesystem::copy_options::none;
   } else {
     file_copy_opts |= std::filesystem::copy_options::skip_existing;
   }
 
-  std::function<bool(std::filesystem::path, std::filesystem::path)>
+  std::function<CpError(std::filesystem::path, std::filesystem::path)>
       copy_dir_contents;
-  copy_dir_contents = [verbatim_symlinks,
-                       &copy_dir_contents,
-                       &env,
-                       file_copy_opts,
-                       preserve_timestamps,
-                       force,
-                       error_on_exist,
-                       dereference,
-                       &isolate](std::filesystem::path src,
-                                 std::filesystem::path dest) {
+  copy_dir_contents = [&options, &copy_dir_contents, file_copy_opts](
+                          std::filesystem::path src,
+                          std::filesystem::path dest) -> CpError {
     std::error_code error;
-    for (auto dir_entry : std::filesystem::directory_iterator(src)) {
+    // Only the error_code overloads are used from here on: this runs on a
+    // thread pool thread and exceptions are disabled.
+    auto it = std::filesystem::directory_iterator(src, error);
+    if (error) {
+      return CpError::Std(error, ConvertPathToUTF8(src));
+    }
+    for (const auto end = std::filesystem::directory_iterator(); it != end;
+         it.increment(error)) {
+      if (error) {
+        return CpError::Std(error, ConvertPathToUTF8(src));
+      }
+      const auto& dir_entry = *it;
       auto dest_file_path = dest / dir_entry.path().filename();
       auto dest_str = ConvertPathToUTF8(dest);
 
-      if (dir_entry.is_symlink()) {
-        if (verbatim_symlinks) {
+      if (dir_entry.is_symlink(error)) {
+        if (options.verbatim_symlinks) {
           std::filesystem::copy_symlink(
               dir_entry.path(), dest_file_path, error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         } else {
           auto symlink_target =
               std::filesystem::read_symlink(dir_entry.path().c_str(), error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
 
-          if (std::filesystem::exists(dest_file_path)) {
-            if (std::filesystem::is_symlink((dest_file_path.c_str()))) {
+          if (std::filesystem::exists(dest_file_path, error)) {
+            if (std::filesystem::is_symlink(dest_file_path, error)) {
               auto current_dest_symlink_target =
                   std::filesystem::read_symlink(dest_file_path.c_str(), error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
 
-              if (!dereference &&
-                  std::filesystem::is_directory(symlink_target) &&
+              if (!options.dereference &&
+                  std::filesystem::is_directory(symlink_target, error) &&
                   isInsideDir(symlink_target, current_dest_symlink_target)) {
-                static constexpr const char* message =
-                    "Cannot copy %s to a subdirectory of self %s";
-                THROW_ERR_FS_CP_EINVAL(
-                    env, message, symlink_target, current_dest_symlink_target);
-                return false;
+                return {CpError::kEinval,
+                        0,
+                        "cp",
+                        SPrintF("Cannot copy %s to a subdirectory of self %s",
+                                symlink_target,
+                                current_dest_symlink_target),
+                        {}};
               }
 
               // Prevent copy if src is a subdir of dest since unlinking
               // dest in this case would result in removing src contents
               // and therefore a broken symlink would be created.
-              if (std::filesystem::is_directory(dest_file_path) &&
+              if (std::filesystem::is_directory(dest_file_path, error) &&
                   isInsideDir(current_dest_symlink_target, symlink_target)) {
-                static constexpr const char* message =
-                    "cannot overwrite %s with %s";
-                THROW_ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(
-                    env, message, current_dest_symlink_target, symlink_target);
-                return false;
+                return {CpError::kSymlinkToSubdirectory,
+                        0,
+                        "cp",
+                        SPrintF("cannot overwrite %s with %s",
+                                current_dest_symlink_target,
+                                symlink_target),
+                        {}};
               }
 
               // symlinks get overridden by cp even if force: false, this is
@@ -4808,29 +4856,40 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
               // correct? or is it a bug?
               std::filesystem::remove(dest_file_path, error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
-            } else if (std::filesystem::is_regular_file(dest_file_path)) {
-              if (!dereference || (!force && error_on_exist)) {
-                auto dest_file_path_str = ConvertPathToUTF8(dest_file_path);
-                env->ThrowStdErrException(
+            } else if (std::filesystem::is_regular_file(dest_file_path,
+                                                        error)) {
+              if (!options.dereference ||
+                  (!options.force && options.error_on_exist)) {
+                return CpError::Std(
                     std::make_error_code(std::errc::file_exists),
-                    "cp",
-                    dest_file_path_str.c_str());
-                return false;
+                    ConvertPathToUTF8(dest_file_path));
               }
             }
           }
-          auto symlink_target_absolute = std::filesystem::weakly_canonical(
-              std::filesystem::absolute(src / symlink_target));
+          std::filesystem::path symlink_target_absolute;
+          if (options.fresh_destination) {
+            // As path.resolve() does: lexical only, absolute targets verbatim.
+            symlink_target_absolute =
+                symlink_target.is_absolute()
+                    ? symlink_target
+                    : std::filesystem::absolute(src / symlink_target, error)
+                          .lexically_normal();
+          } else {
+            symlink_target_absolute = std::filesystem::weakly_canonical(
+                std::filesystem::absolute(src / symlink_target, error), error);
+          }
+          if (error) {
+            return CpError::Std(error, dest_str);
+          }
 #ifdef _WIN32
           auto wstr = symlink_target_absolute.wstring();
           if (wstr.starts_with(L"\\\\?\\")) {
             symlink_target_absolute = std::filesystem::path(wstr.substr(4));
           }
 #endif
-          if (dir_entry.is_directory()) {
+          if (dir_entry.is_directory(error)) {
             std::filesystem::create_directory_symlink(
                 symlink_target_absolute, dest_file_path, error);
           } else {
@@ -4838,67 +4897,297 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
                 symlink_target_absolute, dest_file_path, error);
           }
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         }
-      } else if (dir_entry.is_directory()) {
+      } else if (dir_entry.is_directory(error)) {
         auto entry_dir_path = src / dir_entry.path().filename();
-        const bool created =
-            std::filesystem::create_directory(dest_file_path, error);
-        if (error) {
-          env->ThrowStdErrException(
-              error, "cp", ConvertPathToUTF8(dest_file_path).c_str());
-          return false;
+        bool created = true;
+        if (options.fresh_destination) {
+          CpError made = MakeFreshDirectory(dest_file_path);
+          if (made.kind != CpError::kNone) return made;
+        } else {
+          created = std::filesystem::create_directory(dest_file_path, error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
         }
-        auto success = copy_dir_contents(entry_dir_path, dest_file_path);
-        if (!success) {
-          return false;
+        CpError inner = copy_dir_contents(entry_dir_path, dest_file_path);
+        if (inner.kind != CpError::kNone) {
+          return inner;
         }
         // A directory created by the copy gets the mode of its source once
         // its contents are in (the source may be read-only).
         if (created) {
           std::filesystem::permissions(
-              dest_file_path, dir_entry.status().permissions(), error);
+              dest_file_path, dir_entry.status(error).permissions(), error);
           if (error) {
-            env->ThrowStdErrException(
-                error, "cp", ConvertPathToUTF8(dest_file_path).c_str());
-            return false;
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
           }
         }
-      } else if (dir_entry.is_regular_file()) {
-        std::filesystem::copy_file(
-            dir_entry.path(), dest_file_path, file_copy_opts, error);
+        if (options.preserve_timestamps) {
+          CpError stamped = CopyUtimes(entry_dir_path, dest_file_path);
+          if (stamped.kind != CpError::kNone) return stamped;
+        }
+      } else if (dir_entry.is_regular_file(error)) {
+        bool copied = true;
+        if (options.fresh_destination) {
+          CpError fresh = CopyFileFresh(
+              dir_entry.path(), dest_file_path, options.copyfile_flags);
+          if (fresh.kind != CpError::kNone) return fresh;
+        } else {
+          copied = std::filesystem::copy_file(
+              dir_entry.path(), dest_file_path, file_copy_opts, error);
+        }
         if (error) {
           if (error == std::errc::file_exists) {
-            THROW_ERR_FS_CP_EEXIST(isolate,
-                                   "[ERR_FS_CP_EEXIST]: Target already exists: "
-                                   "cp returned EEXIST (%s already exists)",
-                                   dest_file_path);
-            return false;
+            return {CpError::kEexist,
+                    0,
+                    "cp",
+                    SPrintF("[ERR_FS_CP_EEXIST]: Target already exists: "
+                            "cp returned EEXIST (%s already exists)",
+                            dest_file_path),
+                    {}};
           }
-          env->ThrowStdErrException(error, "cp", dest_str.c_str());
-          return false;
+          return CpError::Std(error, dest_str);
         }
 
-        if (preserve_timestamps &&
-            !CopyUtimes(dir_entry.path(), dest_file_path, env)) {
-          return false;
+        if (options.preserve_timestamps) {
+          CpError utimes = CopyUtimes(dir_entry.path(), dest_file_path);
+          if (utimes.kind != CpError::kNone) {
+            return utimes;
+          }
         }
+        // Both copies set the mode before writing the data, which clears
+        // setuid/setgid; put the source mode back once the data is in.
+        if (copied) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+      } else if (options.fresh_destination) {
+        CpError::Kind kind = dir_entry.is_socket(error) ? CpError::kSocket
+                             : dir_entry.is_fifo(error) ? CpError::kFifo
+                                                        : CpError::kUnknown;
+        return {kind, UV_EINVAL, "cp", {}, ConvertPathToUTF8(dest_file_path)};
       }
     }
-    return true;
+    return {};
   };
 
-  if (copy_dir_contents(src_path, dest_path) && !dest_existed) {
+  CpError result = copy_dir_contents(src_path, dest_path);
+  if (result.kind != CpError::kNone) return result;
+  if (!dest_existed) {
     std::filesystem::permissions(
-        dest_path, std::filesystem::status(src_path).permissions(), error);
+        dest_path,
+        std::filesystem::status(src_path, error).permissions(),
+        error);
     if (error) {
+      return CpError::Std(error, dest_display);
+    }
+  }
+  if (options.preserve_timestamps) return CopyUtimes(src_path, dest_path);
+  return {};
+}
+
+}  // namespace
+
+static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  int mode;
+  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
+    return;
+  }
+
+  bool preserve_timestamps = args[3]->IsTrue();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  std::error_code error;
+
+  if (!std::filesystem::remove(dest_path, error)) {
+    return env->ThrowStdErrException(error, "unlink", *dest);
+  }
+
+  if (mode == 0) {
+    // if no mode is specified use the faster std::filesystem API
+    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
       return env->ThrowStdErrException(error, "cp", *dest);
     }
+  } else {
+    uv_fs_t req;
+    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
+    if (is_uv_error(result)) {
+      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
+    }
+  }
+
+  if (preserve_timestamps) {
+    CpError error = CopyUtimes(src_path, dest_path);
+    if (error.kind != CpError::kNone) {
+      error.Throw(env);
+    }
   }
 }
 
+static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
+                               // verbatimSymlinks, preserveTimestamps
+
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  bool force = args[2]->IsTrue();
+  bool dereference = args[3]->IsTrue();
+  bool error_on_exist = args[4]->IsTrue();
+  bool verbatim_symlinks = args[5]->IsTrue();
+  bool preserve_timestamps = args[6]->IsTrue();
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  CpError error = CopyDirRecursive(src_path,
+                                   dest_path,
+                                   dest.ToString(),
+                                   {force,
+                                    dereference,
+                                    error_on_exist,
+                                    verbatim_symlinks,
+                                    preserve_timestamps,
+                                    false,
+                                    0});
+  if (error.kind != CpError::kNone) {
+    error.Throw(env);
+  }
+}
+
+// JS: const job = new CpDirJob(src, dest, force, dereference, errorOnExist,
+//                              verbatimSymlinks, preserveTimestamps);
+//     job.ondone = (err) => {...}; job.run();
+// Runs CopyDirRecursive() on the thread pool for fs.cp()/fsPromises.cp().
+class CpDirJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_EQ(args.Length(), 8);
+    CHECK(args[7]->IsInt32());
+    BufferValue src(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*src);
+    ToNamespacedPath(env, &src);
+    BufferValue dest(env->isolate(), args[1]);
+    CHECK_NOT_NULL(*dest);
+    ToNamespacedPath(env, &dest);
+    new CpDirJob(env,
+                 args.This(),
+                 src.ToPath(),
+                 dest.ToPath(),
+                 dest.ToString(),
+                 {args[2]->IsTrue(),
+                  args[3]->IsTrue(),
+                  args[4]->IsTrue(),
+                  args[5]->IsTrue(),
+                  args[6]->IsTrue(),
+                  true,
+                  args[7].As<Int32>()->Value()});
+  }
+
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    CpDirJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    CHECK(!job->scheduled_);
+    job->scheduled_ = true;
+    job->ClearWeak();
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    error_ = CopyDirRecursive(src_, dest_, dest_display_, options_);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<CpDirJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env->context());
+    Local<Value> argv[] = {
+        Null(isolate), Undefined(isolate), Undefined(isolate)};
+    const char* special = error_.kind == CpError::kSocket    ? "socket"
+                          : error_.kind == CpError::kFifo    ? "fifo"
+                          : error_.kind == CpError::kUnknown ? "unknown"
+                                                             : nullptr;
+    if (special != nullptr) {
+      Local<Value> path;
+      if (!ToV8Value(env->context(), error_.path).ToLocal(&path)) return;
+      argv[1] = OneByteString(isolate, special);
+      argv[2] = path;
+    } else if (error_.kind != CpError::kNone) {
+      argv[0] = error_.ToException(env);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(CpDirJob)
+  SET_SELF_SIZE(CpDirJob)
+
+ private:
+  CpDirJob(Environment* env,
+           Local<Object> object,
+           std::filesystem::path&& src,
+           std::filesystem::path&& dest,
+           std::string&& dest_display,
+           CpDirOptions options)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.cp"),
+        src_(std::move(src)),
+        dest_(std::move(dest)),
+        dest_display_(std::move(dest_display)),
+        options_(options) {
+    MakeWeak();
+  }
+
+  const std::filesystem::path src_;
+  const std::filesystem::path dest_;
+  const std::string dest_display_;
+  const CpDirOptions options_;
+  CpError error_;
+  bool scheduled_ = false;
+};
+
 BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
     Environment* env, const std::string& file_path) {
   THROW_IF_INSUFFICIENT_PERMISSIONS(
@@ -5269,6 +5558,12 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "cpSyncOverrideFile", CpSyncOverrideFile);
   SetMethod(isolate, target, "cpSyncCopyDir", CpSyncCopyDir);
 
+  Local<FunctionTemplate> cpj = NewFunctionTemplate(isolate, CpDirJob::New);
+  cpj->InstanceTemplate()->SetInternalFieldCount(CpDirJob::kInternalFieldCount);
+  cpj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, cpj, "run", CpDirJob::Run);
+  SetConstructorFunction(isolate, target, "CpDirJob", cpj);
+
   StatWatcher::CreatePerIsolateProperties(isolate_data, target);
   BindingData::CreatePerIsolateProperties(isolate_data, target);
 
@@ -5400,6 +5695,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(CpSyncCheckPaths);
   registry->Register(CpSyncOverrideFile);
   registry->Register(CpSyncCopyDir);
+  registry->Register(CpDirJob::New);
+  registry->Register(CpDirJob::Run);
 
   registry->Register(Chmod);
   registry->Register(FChmod);
diff --git a/test/parallel/test-fs-cp-async-destination-appears-late.mjs b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
new file mode 100644
index 000000000000..40ec15e1ef39
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() into a destination that did not exist when it was
+// checked, but does by the time the copy starts, fails with EEXIST instead
+// of copying through whatever appeared there.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { createHook } from 'node:async_hooks';
+import { existsSync, lstatSync, mkdirSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+const src = nextdir();
+const dest = nextdir();
+const target = nextdir();
+mkdirSync(src);
+mkdirSync(target);
+writeFileSync(join(src, 'file'), 'x');
+
+let injected = false;
+const hook = createHook({
+  init(id, type) {
+    if (!injected && type === 'FSREQCALLBACK' && !existsSync(dest)) {
+      injected = true;
+      symlinkSync(target, dest, 'dir');
+    }
+  },
+}).enable();
+const outcome = await promises.cp(src, dest, { recursive: true }).then(() => null, (err) => err);
+hook.disable();
+assert.ok(injected, 'the hook found no request to inject the symbolic link at');
+assert.strictEqual(outcome?.code, 'EEXIST');
+assert.strictEqual(outcome?.syscall, 'mkdir');
+assert.ok(lstatSync(dest).isSymbolicLink());
+assert.ok(!existsSync(join(target, 'file')));
diff --git a/test/parallel/test-fs-cp-async-file-modes.mjs b/test/parallel/test-fs-cp-async-file-modes.mjs
new file mode 100644
index 000000000000..358f6c339b7b
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-file-modes.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() gives copied files the mode of their source, including
+// the setuid, setgid and sticky bits, as cpSync() does.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('file modes are not meaningful on Windows');
+
+tmpdir.refresh();
+const modes = { suid: 0o4755, sgid: 0o2755, sticky: 0o1755, private: 0o600 };
+const src = nextdir();
+mkdirSync(src);
+for (const [name, mode] of Object.entries(modes)) {
+  writeFileSync(join(src, name), 'x');
+  chmodSync(join(src, name), mode);
+}
+const modesIn = (dir) => Object.fromEntries(
+  Object.keys(modes).map((name) => [name, statSync(join(dir, name)).mode & 0o7777]));
+const expected = modesIn(src);
+
+const viaCp = nextdir();
+await promises.cp(src, viaCp, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCp), expected);
+
+const viaCpTimestamps = nextdir();
+await promises.cp(src, viaCpTimestamps, { recursive: true, preserveTimestamps: true });
+assert.deepStrictEqual(modesIn(viaCpTimestamps), expected);
+
+const viaCpSync = nextdir();
+cpSync(src, viaCpSync, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCpSync), expected);
diff --git a/test/parallel/test-fs-cp-async-special-files-in-tree.mjs b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
new file mode 100644
index 000000000000..9a028f297caa
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
@@ -0,0 +1,53 @@
+// This tests that cp() rejects a socket or a FIFO found inside the copied
+// tree with the same errors as for a top-level one, while cpSync() skips them.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, writeFileSync, promises } from 'node:fs';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { nextdir } from '../common/fs.js';
+import tmpdir from '../common/tmpdir.js';
+
+if (common.isWindows)
+  common.skip('No socket/FIFO support on Windows');
+if (common.isInsideDirWithUnusualChars)
+  common.skip('Test is broken in directories with unusual characters');
+
+tmpdir.refresh();
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'd'), { recursive: true });
+  writeFileSync(join(src, 'd', 'file'), 'x');
+  const server = createServer();
+  // The socket path can exceed the platform limit in a deep tmpdir; skip then.
+  const listening = await new Promise((resolve) => {
+    server.on('error', () => resolve(false));
+    server.listen(join(src, 'd', 's.sock'), () => resolve(true));
+  });
+  if (!listening) {
+    common.printSkipMessage('socket path too long');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_SOCKET' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'd', 'file')));
+    server.close();
+  }
+}
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'dir'), { recursive: true });
+  writeFileSync(join(src, 'dir', 'file'), 'x');
+  if (spawnSync('mkfifo', [join(src, 'dir', 'fifo')]).status !== 0) {
+    common.printSkipMessage('mkfifo not available');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_FIFO_PIPE' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'dir', 'file')));
+  }
+}
diff --git a/test/parallel/test-fs-cp-async-symlink-targets.mjs b/test/parallel/test-fs-cp-async-symlink-targets.mjs
new file mode 100644
index 000000000000..81e861c90859
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-symlink-targets.mjs
@@ -0,0 +1,29 @@
+// This tests that cp() into a new destination writes the same link targets
+// as path.resolve() of the original ones: relative targets made absolute
+// lexically (intermediate links kept), absolute targets left as they are.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { mkdirSync, readlinkSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join, resolve } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('symbolic links need elevated privileges on Windows');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'real'), { recursive: true });
+writeFileSync(join(src, 'real', 'file'), 'data');
+symlinkSync('real', join(src, 'alias'));
+symlinkSync('alias/file', join(src, 'link'));
+const absoluteTarget = join(tmpdir.path, 'x', '..', 'elsewhere');
+symlinkSync(absoluteTarget, join(src, 'abs'));
+
+for (const filter of [undefined, () => true]) {
+  const dest = nextdir();
+  await promises.cp(src, dest, { recursive: true, filter });
+  assert.strictEqual(readlinkSync(join(dest, 'link')), resolve(src, 'alias/file'));
+  assert.strictEqual(readlinkSync(join(dest, 'alias')), resolve(src, 'real'));
+  assert.strictEqual(readlinkSync(join(dest, 'abs')), absoluteTarget);
+}
diff --git a/test/parallel/test-fs-cp-async-with-mode-flags.mjs b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
index 99f6b5fe09d9..6e10d5859ef1 100644
--- a/test/parallel/test-fs-cp-async-with-mode-flags.mjs
+++ b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
@@ -29,3 +29,14 @@ cp(src, dest, mustNotMutateObjectDeep({
   assert(err.code === 'ENOTSUP' || err.code === 'ENOTTY' ||
     err.code === 'ENOSYS' || err.code === 'EXDEV');
 }));
+
+// The mode flags reach copyFile() whether or not a filter is given.
+{
+  const { promises } = await import('node:fs');
+  const outcome = (filter) => promises.cp(src, nextdir(), {
+    recursive: true,
+    mode: constants.COPYFILE_FICLONE_FORCE,
+    filter,
+  }).then(() => 'copied', (err) => `${err.code} ${err.syscall}`);
+  assert.strictEqual(await outcome(undefined), await outcome(() => true));
+}
diff --git a/test/parallel/test-fs-cp-unreadable-directory.mjs b/test/parallel/test-fs-cp-unreadable-directory.mjs
new file mode 100644
index 000000000000..c6343e6b277e
--- /dev/null
+++ b/test/parallel/test-fs-cp-unreadable-directory.mjs
@@ -0,0 +1,33 @@
+// This tests that cp() and cpSync() report an unreadable directory inside the
+// source tree as an error instead of terminating the process.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, readdirSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('no way to make a directory unreadable');
+if (process.getuid() === 0)
+  skip('root can read the directory anyway');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'locked'), { recursive: true });
+writeFileSync(join(src, 'file'), 'x');
+chmodSync(join(src, 'locked'), 0o000);
+try {
+  readdirSync(join(src, 'locked'));
+  chmodSync(join(src, 'locked'), 0o700);
+  skip('the directory is still readable');
+} catch {
+  // Expected: it is unreadable.
+}
+
+try {
+  assert.throws(() => cpSync(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+  await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+} finally {
+  chmodSync(join(src, 'locked'), 0o700);
+}

From 6f38736d63cba5032685ce0168f740333003c117 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Fri, 4 Sep 2026 16:54:42 +0000
Subject: [PATCH 135/202] build: allow linking shared dependencies in the GN
 build

The GN build always compiles the bundled copies of brotli, c-ares,
HdrHistogram, llhttp, libuv, nghttp2, SQLite and zstd, so anyone
packaging a GN-built Node.js for a Linux distribution has no
counterpart to configure's --shared-* options.

Add node_shared_* args named after the GYP variables. When one is set,
that dependency's GN template defines its target as a group carrying a
pkg-config config instead of the bundled sources, so every existing
"deps/<name>" reference picks up the system library without further
changes, and config.gypi reports the choice like a GYP build does.

Refs: https://github.com/nodejs/node/pull/55903
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65797
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 deps/brotli/unofficial.gni    |  67 ++++++-----
 deps/cares/unofficial.gni     | 135 ++++++++++++----------
 deps/histogram/unofficial.gni |  53 +++++----
 deps/llhttp/unofficial.gni    |  47 +++++---
 deps/nghttp2/unofficial.gni   |  67 ++++++-----
 deps/sqlite/unofficial.gni    |  94 +++++++++-------
 deps/uv/unofficial.gni        | 203 ++++++++++++++++++----------------
 deps/zstd/unofficial.gni      |  43 ++++---
 node.gni                      |  14 +++
 tools/generate_config_gypi.py |  15 +--
 10 files changed, 432 insertions(+), 306 deletions(-)

diff --git a/deps/brotli/unofficial.gni b/deps/brotli/unofficial.gni
index 91001fa43ea4..0c6a7bd8c450 100644
--- a/deps/brotli/unofficial.gni
+++ b/deps/brotli/unofficial.gni
@@ -4,36 +4,49 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("brotli_gn_build") {
-  config("brotli_config") {
-    include_dirs = [ "c/include" ]
-  }
+import("../../node.gni")
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("brotli.gyp") ],
-                            "scope",
-                            [ "brotli.gyp" ])
-
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":brotli_config" ]
-    sources = gypi_values.brotli_sources
-    if (is_linux) {
-      defines = [ "OS_LINUX" ]
-    } else if (is_mac) {
-      defines = [ "OS_MACOSX" ]
-    } else if (target_os == "freebsd") {
-      defines = [ "OS_FREEBSD" ]
+template("brotli_gn_build") {
+  if (node_shared_brotli) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("brotli_config") {
+      packages = [ "libbrotlidec", "libbrotlienc" ]
     }
-    if (is_linux) {
-      libs = [ "m" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-      ]
+  } else {
+    config("brotli_config") {
+      include_dirs = [ "c/include" ]
+    }
+
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("brotli.gyp") ],
+                              "scope",
+                              [ "brotli.gyp" ])
+
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
+      sources = gypi_values.brotli_sources
+      if (is_linux) {
+        defines = [ "OS_LINUX" ]
+      } else if (is_mac) {
+        defines = [ "OS_MACOSX" ]
+      } else if (target_os == "freebsd") {
+        defines = [ "OS_FREEBSD" ]
+      }
+      if (is_linux) {
+        libs = [ "m" ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+        ]
+      }
     }
   }
 }
diff --git a/deps/cares/unofficial.gni b/deps/cares/unofficial.gni
index e02d7f425194..364df1f312e2 100644
--- a/deps/cares/unofficial.gni
+++ b/deps/cares/unofficial.gni
@@ -4,78 +4,91 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("cares_gn_build") {
-  config("cares_config") {
-    include_dirs = [ "include" ]
-    if (!is_component_build) {
-      defines = [ "CARES_STATICLIB" ]
-    }
-  }
-
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("cares.gyp") ],
-                            "scope",
-                            [ "cares.gyp" ])
+import("../../node.gni")
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":cares_config" ]
-    if (is_component_build) {
-      defines = [ "CARES_BUILDING_LIBRARY" ]
-    } else {
-      defines = []
+template("cares_gn_build") {
+  if (node_shared_cares) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("cares_config") {
+      packages = [ "libcares" ]
     }
-    if (is_win) {
-      defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
     }
-    if (is_posix) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-        "_GNU_SOURCE",
-        "HAVE_CONFIG_H",
-      ]
+  } else {
+    config("cares_config") {
+      include_dirs = [ "include" ]
+      if (!is_component_build) {
+        defines = [ "CARES_STATICLIB" ]
+      }
     }
 
-    include_dirs = [
-      "src/lib",
-      "src/lib/include",
-    ]
-    if (is_win) {
-      include_dirs += [ "config/win32" ]
-    } else if (is_linux) {
-      include_dirs += [ "config/linux" ]
-    } else if (is_mac) {
-      include_dirs += [ "config/darwin" ]
-    }
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("cares.gyp") ],
+                              "scope",
+                              [ "cares.gyp" ])
 
-    if (is_win) {
-      libs = [
-        "ws2_32.lib",
-        "iphlpapi.lib",
-      ]
-    }
+    component(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
+      if (is_component_build) {
+        defines = [ "CARES_BUILDING_LIBRARY" ]
+      } else {
+        defines = []
+      }
+      if (is_win) {
+        defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+      }
+      if (is_posix) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+          "_GNU_SOURCE",
+          "HAVE_CONFIG_H",
+        ]
+      }
 
-    sources = gypi_values.cares_sources_common
-    if (is_linux) {
-      sources += [ "config/linux/ares_config.h" ]
-    }
-    if (is_mac) {
-      sources += gypi_values.cares_sources_mac
-    }
+      include_dirs = [
+        "src/lib",
+        "src/lib/include",
+      ]
+      if (is_win) {
+        include_dirs += [ "config/win32" ]
+      } else if (is_linux) {
+        include_dirs += [ "config/linux" ]
+      } else if (is_mac) {
+        include_dirs += [ "config/darwin" ]
+      }
 
-    if (is_clang) {
       if (is_win) {
-        cflags_c = [
-          "-Wno-macro-redefined",
-        ]
-      } else {
-        cflags_c = [
-          "-Wno-implicit-fallthrough",
-          "-Wno-unreachable-code",
+        libs = [
+          "ws2_32.lib",
+          "iphlpapi.lib",
         ]
       }
+
+      sources = gypi_values.cares_sources_common
+      if (is_linux) {
+        sources += [ "config/linux/ares_config.h" ]
+      }
+      if (is_mac) {
+        sources += gypi_values.cares_sources_mac
+      }
+
+      if (is_clang) {
+        if (is_win) {
+          cflags_c = [
+            "-Wno-macro-redefined",
+          ]
+        } else {
+          cflags_c = [
+            "-Wno-implicit-fallthrough",
+            "-Wno-unreachable-code",
+          ]
+        }
+      }
     }
   }
 }
diff --git a/deps/histogram/unofficial.gni b/deps/histogram/unofficial.gni
index 1173ab298ae7..fd8c3a276bcb 100644
--- a/deps/histogram/unofficial.gni
+++ b/deps/histogram/unofficial.gni
@@ -4,29 +4,42 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("histogram_gn_build") {
-  config("histogram_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_hdr_histogram) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("histogram_config") {
+      packages = [ "hdr_histogram" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+    }
+  } else {
+    config("histogram_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("histogram.gyp") ],
-                            "scope",
-                            [ "histogram.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("histogram.gyp") ],
+                              "scope",
+                              [ "histogram.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":histogram_config" ]
-    sources = gypi_values.histogram_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-atomic-alignment",
-        "-Wno-incompatible-pointer-types",
-        "-Wno-unused-function",
-      ]
-    }
-    if (is_linux) {
-      libs = [ "atomic" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+      sources = gypi_values.histogram_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-atomic-alignment",
+          "-Wno-incompatible-pointer-types",
+          "-Wno-unused-function",
+        ]
+      }
+      if (is_linux) {
+        libs = [ "atomic" ]
+      }
     }
   }
 }
diff --git a/deps/llhttp/unofficial.gni b/deps/llhttp/unofficial.gni
index fdce32e59764..28257dcb33ae 100644
--- a/deps/llhttp/unofficial.gni
+++ b/deps/llhttp/unofficial.gni
@@ -4,26 +4,39 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("llhttp_gn_build") {
-  config("llhttp_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_http_parser) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("llhttp_config") {
+      packages = [ "libllhttp" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+    }
+  } else {
+    config("llhttp_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("llhttp.gyp") ],
-                            "scope",
-                            [ "llhttp.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("llhttp.gyp") ],
+                              "scope",
+                              [ "llhttp.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":llhttp_config" ]
-    include_dirs = [ "include" ]
-    sources = gypi_values.llhttp_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-      ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+      include_dirs = [ "include" ]
+      sources = gypi_values.llhttp_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+        ]
+      }
     }
   }
 }
diff --git a/deps/nghttp2/unofficial.gni b/deps/nghttp2/unofficial.gni
index 4558fbbf5e5f..d37754f59124 100644
--- a/deps/nghttp2/unofficial.gni
+++ b/deps/nghttp2/unofficial.gni
@@ -4,40 +4,53 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("nghttp2_gn_build") {
-  config("nghttp2_config") {
-    include_dirs = [ "lib/includes" ]
-    if (!is_component_build) {
-      defines = [ "NGHTTP2_STATICLIB" ]
+  if (node_shared_nghttp2) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("nghttp2_config") {
+      packages = [ "libnghttp2" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":nghttp2_config" ]
+    }
+  } else {
+    config("nghttp2_config") {
+      include_dirs = [ "lib/includes" ]
+      if (!is_component_build) {
+        defines = [ "NGHTTP2_STATICLIB" ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("nghttp2.gyp") ],
-                            "scope",
-                            [ "nghttp2.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("nghttp2.gyp") ],
+                              "scope",
+                              [ "nghttp2.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    public_configs = [ ":nghttp2_config" ]
-    defines = [
-      "_U_",
-      "HAVE_CONFIG_H"
-    ]
-    if (is_component_build) {
-      defines += [ "BUILDING_NGHTTP2" ]
-    }
+      public_configs = [ ":nghttp2_config" ]
+      defines = [
+        "_U_",
+        "HAVE_CONFIG_H"
+      ]
+      if (is_component_build) {
+        defines += [ "BUILDING_NGHTTP2" ]
+      }
 
-    sources = gypi_values.nghttp2_sources
+      sources = gypi_values.nghttp2_sources
 
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        # Ref https://github.com/nghttp2/nghttp2/pull/2258
-        # This can be removed when the above PR is ingested.
-        "-Wno-extra-semi",
-      ]
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          # Ref https://github.com/nghttp2/nghttp2/pull/2258
+          # This can be removed when the above PR is ingested.
+          "-Wno-extra-semi",
+        ]
+      }
     }
   }
 }
diff --git a/deps/sqlite/unofficial.gni b/deps/sqlite/unofficial.gni
index 0e62accfb699..a0957c5769d6 100644
--- a/deps/sqlite/unofficial.gni
+++ b/deps/sqlite/unofficial.gni
@@ -4,47 +4,67 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("sqlite_gn_build") {
-  config("sqlite_config") {
-    include_dirs = [ "." ]
-    defines = [
-      "SQLITE_ENABLE_COLUMN_METADATA",
-      "SQLITE_ENABLE_DBSTAT_VTAB",
-      "SQLITE_ENABLE_FTS3",
-      "SQLITE_ENABLE_FTS3_PARENTHESIS",
-      "SQLITE_ENABLE_FTS5",
-      "SQLITE_ENABLE_GEOPOLY",
-      "SQLITE_ENABLE_MATH_FUNCTIONS",
-      "SQLITE_ENABLE_PERCENTILE",
-      "SQLITE_ENABLE_PREUPDATE_HOOK",
-      "SQLITE_ENABLE_RBU",
-      "SQLITE_ENABLE_RTREE",
-      "SQLITE_ENABLE_SESSION",
-    ]
-  }
+  if (node_shared_sqlite) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("sqlite_config") {
+      packages = [ "sqlite3" ]
+    }
+    # sqlite3.h only declares the session extension when this is defined.
+    config("sqlite_defines") {
+      defines = [ "SQLITE_ENABLE_SESSION" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [
+        ":sqlite_config",
+        ":sqlite_defines",
+      ]
+    }
+  } else {
+    config("sqlite_config") {
+      include_dirs = [ "." ]
+      defines = [
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_DBSTAT_VTAB",
+        "SQLITE_ENABLE_FTS3",
+        "SQLITE_ENABLE_FTS3_PARENTHESIS",
+        "SQLITE_ENABLE_FTS5",
+        "SQLITE_ENABLE_GEOPOLY",
+        "SQLITE_ENABLE_MATH_FUNCTIONS",
+        "SQLITE_ENABLE_PERCENTILE",
+        "SQLITE_ENABLE_PREUPDATE_HOOK",
+        "SQLITE_ENABLE_RBU",
+        "SQLITE_ENABLE_RTREE",
+        "SQLITE_ENABLE_SESSION",
+      ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("sqlite.gyp") ],
-                            "scope",
-                            [ "sqlite.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("sqlite.gyp") ],
+                              "scope",
+                              [ "sqlite.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":sqlite_config" ]
-    sources = gypi_values.sqlite_sources
-    cflags_c = [
-      "-Wno-implicit-fallthrough",
-      "-Wno-unreachable-code-return",
-      "-Wno-unreachable-code-break",
-      "-Wno-unreachable-code",
-    ]
-    if (is_win) {
-      cflags_c += [
-        "-Wno-sign-compare",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-variable",
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":sqlite_config" ]
+      sources = gypi_values.sqlite_sources
+      cflags_c = [
+        "-Wno-implicit-fallthrough",
+        "-Wno-unreachable-code-return",
+        "-Wno-unreachable-code-break",
+        "-Wno-unreachable-code",
       ]
+      if (is_win) {
+        cflags_c += [
+          "-Wno-sign-compare",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-variable",
+        ]
+      }
     }
   }
 }
diff --git a/deps/uv/unofficial.gni b/deps/uv/unofficial.gni
index 0944d6ddd241..a2891887839b 100644
--- a/deps/uv/unofficial.gni
+++ b/deps/uv/unofficial.gni
@@ -4,113 +4,126 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("uv_gn_build") {
-  config("uv_external_config") {
-    include_dirs = [ "include" ]
-    if (is_clang || !is_win) {
-      cflags_cc = [
-        "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
-      ]
-    }
-  }
-
-  config("uv_internal_config") {
-    include_dirs = [
-      "include",
-      "src",
-    ]
+import("../../node.gni")
 
-    defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
-    if (is_posix) {
-      defines += [
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-      ]
+template("uv_gn_build") {
+  if (node_shared_libuv) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("uv_external_config") {
+      packages = [ "libuv" ]
     }
-    if (is_linux) {
-      defines += [
-        "_POSIX_C_SOURCE=200112",
-        "_GNU_SOURCE",
-      ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":uv_external_config" ]
     }
-    if (is_apple) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_DARWIN_UNLIMITED_SELECT=1",
-      ]
+  } else {
+    config("uv_external_config") {
+      include_dirs = [ "include" ]
+      if (is_clang || !is_win) {
+        cflags_cc = [
+          "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
+        ]
+      }
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-deprecated-declarations",
-        "-Wno-extra-semi",
-        "-Wno-implicit-fallthrough",
-        "-Wno-missing-braces",
-        "-Wno-sign-compare",
-        "-Wno-string-conversion",
-        "-Wno-shadow",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-        "-Wno-unused-but-set-parameter",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-result",
-        "-Wno-unused-variable",
+
+    config("uv_internal_config") {
+      include_dirs = [
+        "include",
+        "src",
       ]
+
+      defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
+      if (is_posix) {
+        defines += [
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+        ]
+      }
+      if (is_linux) {
+        defines += [
+          "_POSIX_C_SOURCE=200112",
+          "_GNU_SOURCE",
+        ]
+      }
+      if (is_apple) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_DARWIN_UNLIMITED_SELECT=1",
+        ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-deprecated-declarations",
+          "-Wno-extra-semi",
+          "-Wno-implicit-fallthrough",
+          "-Wno-missing-braces",
+          "-Wno-sign-compare",
+          "-Wno-string-conversion",
+          "-Wno-shadow",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+          "-Wno-unused-but-set-parameter",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-result",
+          "-Wno-unused-variable",
+        ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("uv.gyp") ],
-                            "scope",
-                            [ "uv.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("uv.gyp") ],
+                              "scope",
+                              [ "uv.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    configs += [ ":uv_internal_config" ]
-    public_configs = [ ":uv_external_config" ]
+      configs += [ ":uv_internal_config" ]
+      public_configs = [ ":uv_external_config" ]
 
-    if (is_posix) {
-      configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
-      configs += [ "//build/config/gcc:symbol_visibility_default" ]
-    }
+      if (is_posix) {
+        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
+        configs += [ "//build/config/gcc:symbol_visibility_default" ]
+      }
 
-    if (is_win) {
-      libs = [
-        "advapi32.lib",
-        "iphlpapi.lib",
-        "psapi.lib",
-        "shell32.lib",
-        "user32.lib",
-        "userenv.lib",
-        "ws2_32.lib",
-      ]
-    }
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
-    }
-    if (is_linux) {
-      libs = [
-        "m",
-        "dl",
-        "rt",
-      ]
-    }
+      if (is_win) {
+        libs = [
+          "advapi32.lib",
+          "iphlpapi.lib",
+          "psapi.lib",
+          "shell32.lib",
+          "user32.lib",
+          "userenv.lib",
+          "ws2_32.lib",
+        ]
+      }
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
+      if (is_linux) {
+        libs = [
+          "m",
+          "dl",
+          "rt",
+        ]
+      }
 
-    sources = gypi_values.uv_sources_common
-    if (is_win) {
-      sources += gypi_values.uv_sources_win
-    }
-    if (is_posix) {
-      sources += gypi_values.uv_sources_posix +
-                 [ "src/unix/proctitle.c" ]
-    }
-    if (is_linux) {
-      sources += gypi_values.uv_sources_linux
-    }
-    if (is_apple) {
-      sources += gypi_values.uv_sources_apple +
-                 gypi_values.uv_sources_bsd_common
+      sources = gypi_values.uv_sources_common
+      if (is_win) {
+        sources += gypi_values.uv_sources_win
+      }
+      if (is_posix) {
+        sources += gypi_values.uv_sources_posix +
+                   [ "src/unix/proctitle.c" ]
+      }
+      if (is_linux) {
+        sources += gypi_values.uv_sources_linux
+      }
+      if (is_apple) {
+        sources += gypi_values.uv_sources_apple +
+                   gypi_values.uv_sources_bsd_common
+      }
     }
   }
 }
diff --git a/deps/zstd/unofficial.gni b/deps/zstd/unofficial.gni
index fe6c2b425eac..733ddb965684 100644
--- a/deps/zstd/unofficial.gni
+++ b/deps/zstd/unofficial.gni
@@ -4,25 +4,38 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("zstd_gn_build") {
-  config("zstd_config") {
-    include_dirs = [ "./lib" ]
-  }
+  if (node_shared_zstd) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("zstd_config") {
+      packages = [ "libzstd" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+    }
+  } else {
+    config("zstd_config") {
+      include_dirs = [ "./lib" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("zstd.gyp") ],
-                            "scope",
-                            [ "zstd.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("zstd.gyp") ],
+                              "scope",
+                              [ "zstd.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":zstd_config" ]
-    sources = gypi_values.zstd_sources
-    defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
-    cflags_c = [ "-Wno-unused-function" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+      sources = gypi_values.zstd_sources
+      defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
+      cflags_c = [ "-Wno-unused-function" ]
 
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
     }
   }
 }
diff --git a/node.gni b/node.gni
index 21c8de1b2afb..fa4668a543e2 100644
--- a/node.gni
+++ b/node.gni
@@ -82,5 +82,19 @@ declare_args() {
   node_use_amaro = true
 }
 
+# Link against shared copies of the bundled dependencies instead of building
+# them, like configure's --shared-* options. The libraries are looked up with
+# pkg-config, so these are meant for Linux distribution builds.
+declare_args() {
+  node_shared_brotli = false
+  node_shared_cares = false
+  node_shared_hdr_histogram = false
+  node_shared_http_parser = false
+  node_shared_libuv = false
+  node_shared_nghttp2 = false
+  node_shared_sqlite = false
+  node_shared_zstd = false
+}
+
 assert(!node_enable_inspector || node_use_openssl,
        "node_enable_inspector requires node_use_openssl")
diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
index 436767e633e1..d464d4b5859c 100755
--- a/tools/generate_config_gypi.py
+++ b/tools/generate_config_gypi.py
@@ -68,18 +68,19 @@ def translate_config(out_dir, config, v8_config):
           bool_string_to_number(config['node_enable_inspector']),
       'shlib_suffix': 'dylib' if sys.platform == 'darwin' else 'so',
       'tsan': bool_string_to_number(config['is_tsan']),
-      # TODO(zcbenz): Shared components are not supported in GN config yet.
       'node_shared': 'false',
-      'node_shared_brotli': 'false',
-      'node_shared_cares': 'false',
-      'node_shared_http_parser': 'false',
-      'node_shared_libuv': 'false',
-      'node_shared_nghttp2': 'false',
+      'node_shared_brotli': config['node_shared_brotli'],
+      'node_shared_cares': config['node_shared_cares'],
+      'node_shared_hdr_histogram': config['node_shared_hdr_histogram'],
+      'node_shared_http_parser': config['node_shared_http_parser'],
+      'node_shared_libuv': config['node_shared_libuv'],
+      'node_shared_nghttp2': config['node_shared_nghttp2'],
       'node_shared_nghttp3': 'false',
       'node_shared_ngtcp2': 'false',
       'node_shared_openssl': 'false',
-      'node_shared_sqlite': 'false',
+      'node_shared_sqlite': config['node_shared_sqlite'],
       'node_shared_zlib': 'false',
+      'node_shared_zstd': config['node_shared_zstd'],
     }
   }
   config_gypi['variables'].update(v8_config)

From 8fb89abb8d80422e19eb778ec637c6ba66526efd Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Mon, 7 Sep 2026 04:42:09 -0700
Subject: [PATCH 136/202] src,lib: add util.markPromiseAsHandled

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65805
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
---
 doc/api/util.md                            | 11 ++++++++++
 lib/util.js                                |  8 +++++++
 src/node_util.cc                           | 23 ++++++++++++++++++++
 test/parallel/test-mark-promise-handled.js | 25 ++++++++++++++++++++++
 4 files changed, 67 insertions(+)
 create mode 100644 test/parallel/test-mark-promise-handled.js

diff --git a/doc/api/util.md b/doc/api/util.md
index f9bfed5b5998..52e2c06b09ff 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -1691,6 +1691,17 @@ console.log(util.isDeepStrictEqual(foo, bar, true));
 See [`assert.deepStrictEqual()`][] for more information about deep strict
 equality.
 
+## `util.markPromiseAsHandled(promise)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `promise` {promise} The promise to mark as handled
+
+Marks a promise as handled so that unhandled rejections are ignored and are not
+reported to the `'unhandledrejection'` event.
+
 ## Class: `util.MIMEType`
 
 <!-- YAML
diff --git a/lib/util.js b/lib/util.js
index 7a9c06e8bdbb..d238a620e59a 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -588,6 +588,13 @@ function deprecate(fn, msg, code, { modifyPrototype } = kEmptyObject) {
   return internalDeprecate(fn, msg, code, undefined, modifyPrototype);
 }
 
+function markPromiseAsHandled(promise) {
+  if (!types.isPromise(promise)) {
+    throw new ERR_INVALID_ARG_TYPE('promise', 'Promise', promise);
+  }
+  binding.markPromiseAsHandled(promise);
+}
+
 // Keep the `exports =` so that various functions can still be monkeypatched
 module.exports = {
   _errnoException,
@@ -618,6 +625,7 @@ module.exports = {
     }
     return internalDeepEqual(a, b, skipPrototype);
   },
+  markPromiseAsHandled,
   promisify,
   stripVTControlCharacters,
   toUSVString(input) {
diff --git a/src/node_util.cc b/src/node_util.cc
index 6d3373caae6c..ab74b2e8d375 100644
--- a/src/node_util.cc
+++ b/src/node_util.cc
@@ -18,15 +18,18 @@ using v8::CFunction;
 using v8::Context;
 using v8::DictionaryTemplate;
 using v8::External;
+using v8::Function;
 using v8::FunctionCallbackInfo;
 using v8::IndexFilter;
 using v8::Integer;
 using v8::Isolate;
 using v8::KeyCollectionMode;
+using v8::kPromiseHandlerAddedAfterReject;
 using v8::Local;
 using v8::LocalVector;
 using v8::MaybeLocal;
 using v8::Name;
+using v8::Number;
 using v8::Object;
 using v8::ObjectTemplate;
 using v8::ONLY_CONFIGURABLE;
@@ -467,6 +470,26 @@ void MarkPromiseAsHandled(const FunctionCallbackInfo<Value>& args) {
   Local<Promise> promise = args[0].As<Promise>();
   promise->MarkAsHandled();
   promise->MarkAsSilent();
+
+  // If the promise is already rejected, then it may have already been
+  // reported to the unhandled rejection handler. Marking it as handled
+  // above does not trigger the v8 callback that updates it's status.
+  // So to avoid the notification we call out manually.
+  if (promise->State() == v8::Promise::kRejected) {
+    Environment* env = Environment::GetCurrent(args);
+    Local<Function> callback = env->promise_reject_callback();
+    CHECK(!callback.IsEmpty());
+
+    Local<Value> type =
+        Number::New(env->isolate(), kPromiseHandlerAddedAfterReject);
+    Local<Value> vargs[] = {type, promise, Undefined(env->isolate())};
+
+    USE(callback->Call(
+        env->context(), Undefined(env->isolate()), arraysize(vargs), vargs));
+
+    // Note that if callback->Call throws here, we go ahead and let that
+    // propagate.
+  }
 }
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
diff --git a/test/parallel/test-mark-promise-handled.js b/test/parallel/test-mark-promise-handled.js
new file mode 100644
index 000000000000..c2c789310bbf
--- /dev/null
+++ b/test/parallel/test-mark-promise-handled.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { markPromiseAsHandled } = require('node:util');
+
+process.on('unhandledRejection', common.mustNotCall());
+
+markPromiseAsHandled(Promise.reject(123));
+
+{
+  const { promise, reject } = Promise.withResolvers();
+  markPromiseAsHandled(promise);
+  reject(123);
+}
+
+{
+  const { promise, reject } = Promise.withResolvers();
+  reject(123);
+  markPromiseAsHandled(promise);
+}
+
+assert.throws(() => markPromiseAsHandled(123), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});

From 718cfe401690403fbe3c1dd5400a33b68cf2cb47 Mon Sep 17 00:00:00 2001
From: Chengzhong Wu <cwu631@bloomberg.net>
Date: Mon, 7 Sep 2026 07:42:20 -0400
Subject: [PATCH 137/202] build: enable V8 gdb/lldb plugin support

Build `v8_debug_helper.{so|dylib}` to enable V8 gdb/lldb postmortem
plugin support for the V8 version that Node.js built with.

Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/65786
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 common.gypi                           |   5 +-
 configure.py                          |  10 ++
 node.gypi                             |   3 +
 tools/v8_gypfiles/v8.gyp              |   4 +-
 tools/v8_gypfiles/v8_debug_helper.gyp | 177 ++++++++++++++++++++++++++
 tools/v8_gypfiles/v8windbg.gyp        | 135 +-------------------
 6 files changed, 198 insertions(+), 136 deletions(-)
 create mode 100644 tools/v8_gypfiles/v8_debug_helper.gyp

diff --git a/common.gypi b/common.gypi
index 47c1d0c0e831..441a0e237204 100644
--- a/common.gypi
+++ b/common.gypi
@@ -17,6 +17,7 @@
     'emulator%': [],
 
     'node_shared%': 'false',
+    'node_enable_v8debughelper%': 'false',
     'node_enable_experimentals%': 'false',
     'force_dynamic_crt%': 0,
     'node_use_v8_platform%': 'true',
@@ -659,7 +660,9 @@
             'cflags!': [ '-pthread' ],
             'ldflags!': [ '-pthread' ],
           }],
-          [ 'node_shared=="true"', {
+          # The V8 static libraries get linked into libv8_debug_helper, so they
+          # have to be position independent too.
+          [ 'node_shared=="true" or node_enable_v8debughelper=="true"', {
             'cflags': [ '-fPIC' ],
             'ldflags': [ '-fPIC' ],
           }],
diff --git a/configure.py b/configure.py
index 24039f50165c..6e229e8c36d9 100755
--- a/configure.py
+++ b/configure.py
@@ -850,6 +850,13 @@
     default=None,
     help=argparse.SUPPRESS)  # Undocumented.
 
+parser.add_argument('--enable-v8debughelper',
+    action='store_true',
+    dest='enable_v8debughelper',
+    default=None,
+    help='Build V8\'s debug helper as a shared library, loadable by a debugger '
+         'extension.')
+
 parser.add_argument('--enable-trace-maps',
     action='store_true',
     dest='trace_maps',
@@ -2242,6 +2249,7 @@ def configure_v8(o, configs):
   o['variables']['force_dynamic_crt'] = 1 if options.shared else 0
   o['variables']['node_enable_d8'] = b(options.enable_d8)
   o['variables']['node_enable_v8windbg'] = b(options.enable_v8windbg)
+  o['variables']['node_enable_v8debughelper'] = b(options.enable_v8debughelper)
   if options.enable_d8:
     o['variables']['test_isolation_mode'] = 'noop'  # Needed by d8.gyp.
   if options.without_bundled_v8:
@@ -2249,6 +2257,8 @@ def configure_v8(o, configs):
       raise Exception('--enable-d8 is incompatible with --without-bundled-v8.')
     if options.enable_v8windbg:
       raise Exception('--enable-v8windbg is incompatible with --without-bundled-v8.')
+    if options.enable_v8debughelper:
+      raise Exception('--enable-v8debughelper is incompatible with --without-bundled-v8.')
     (pkg_libs, pkg_cflags, pkg_libpath, _) = pkg_config("v8")
     if pkg_libs and pkg_libpath:
       output['libraries'] += [pkg_libpath] + pkg_libs.split()
diff --git a/node.gypi b/node.gypi
index 104e884e6614..bfe2d00ad929 100644
--- a/node.gypi
+++ b/node.gypi
@@ -99,6 +99,9 @@
     [ 'node_enable_v8windbg=="true"', {
       'dependencies': [ 'tools/v8_gypfiles/v8windbg.gyp:build_v8windbg' ],
     }],
+    [ 'node_enable_v8debughelper=="true"', {
+      'dependencies': [ 'tools/v8_gypfiles/v8_debug_helper.gyp:build_v8_debug_helper' ],
+    }],
     [ 'node_use_bundled_v8=="true"', {
       'dependencies': [
         'tools/v8_gypfiles/v8.gyp:v8_snapshot',
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index a976148ddab0..c4738e206bd0 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -62,7 +62,9 @@
           'BUILDING_V8_PLATFORM_SHARED',  # Make V8_PLATFORM_EXPORT visible.
         ]
       }],
-      ['node_shared=="true"', {
+      # The V8 static libraries get linked into libv8_debug_helper too, and
+      # the local-exec TLS model is only valid in an executable.
+      ['node_shared=="true" or node_enable_v8debughelper=="true"', {
         'defines': [
           'V8_TLS_USED_IN_LIBRARY',  # Enable V8_TLS_LIBRARY_MODE.
         ],
diff --git a/tools/v8_gypfiles/v8_debug_helper.gyp b/tools/v8_gypfiles/v8_debug_helper.gyp
new file mode 100644
index 000000000000..e869cb4f9771
--- /dev/null
+++ b/tools/v8_gypfiles/v8_debug_helper.gyp
@@ -0,0 +1,177 @@
+{
+  'variables': {
+    'V8_ROOT': '../../deps/v8',
+    'v8_code': 1,
+    # v8windbg links the helper statically. When the helper is the requested
+    # artifact it is built as a shared library instead, so a debugger
+    # extension can load it on its own.
+    'v8_debug_helper_type%': 'static_library',
+    'conditions': [
+      [ 'node_enable_v8debughelper=="true"', {
+        'v8_debug_helper_type': 'shared_library',
+      }],
+    ],
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      # Intermediate target to build the debug helper. dependencies_traverse
+      # stops gyp from propagating the library up to node.gypi as a link
+      # input. The library is only supposed to be loaded by a debugger.
+      'target_name': 'build_v8_debug_helper',
+      'type': 'none',
+      'dependencies_traverse': 0,
+      'hard_dependency': 1,
+      'dependencies': [
+        'v8_debug_helper',
+      ],
+    },  # build_v8_debug_helper
+    {
+      'target_name': 'v8_debug_helper',
+      'type': '<(v8_debug_helper_type)',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'gen_heap_constants',
+
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_snapshot',
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
+      ],
+      # Enable RTTI //build/config/compiler:rtti
+      'cflags_cc': [ '-frtti' ],
+      'cflags_cc!': [ '-fno-rtti' ],
+      'xcode_settings': {
+        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
+      },
+      'msvs_settings': {
+        'VCCLCompilerTool': {
+          'RuntimeTypeInfo': 'true',
+        },
+      },
+      'configurations': {
+        'Release': { # Override target_defaults.Release in common.gypi
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              'RuntimeTypeInfo': 'true',
+            },
+          },
+        },
+      },
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        [ 'v8_enable_temporal_support==1 and node_shared_temporal_capi=="false"', {
+          'dependencies': [
+            '../../deps/crates/crates.gyp:temporal_capi',
+          ],
+        }],
+        [ 'v8_debug_helper_type=="shared_library"', {
+          # The entry points in debug-helper.h are only given default
+          # visibility, or dllexport on Windows, when this is defined. Node
+          # builds with hidden visibility, so without it the library exports
+          # nothing.
+          'defines': [ 'BUILDING_V8_DEBUG_HELPER' ],
+          'direct_dependent_settings': {
+            'defines': [ 'USING_V8_DEBUG_HELPER' ],
+          },
+        }],
+      ],
+    },  # v8_debug_helper
+    {
+      'target_name': 'gen_heap_constants',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'run_mkgrokdump',
+      ],
+      'direct_dependent_settings': {
+        'sources': [
+          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+            '<(SHARED_INTERMEDIATE_DIR)',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # gen_heap_constants
+    {
+      'target_name': 'run_mkgrokdump',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'mkgrokdump',
+      ],
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/run.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/run.py',
+            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
+            '--outfile',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # run_mkgrokdump
+    {
+      'target_name': 'mkgrokdump',
+      'type': 'executable',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'v8.gyp:v8_snapshot',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
+      ]
+    },  # mkgrokdump
+  ],
+}
diff --git a/tools/v8_gypfiles/v8windbg.gyp b/tools/v8_gypfiles/v8windbg.gyp
index 8ea9fd0169f7..14823f60c0cb 100644
--- a/tools/v8_gypfiles/v8windbg.gyp
+++ b/tools/v8_gypfiles/v8windbg.gyp
@@ -24,7 +24,7 @@
         '<(V8_ROOT)/include',
       ],
       'dependencies': [
-        'v8_debug_helper',
+        'v8_debug_helper.gyp:v8_debug_helper',
         'v8.gyp:v8_libbase',
       ],
       'sources': [
@@ -40,138 +40,5 @@
         ],
       },
     },  # v8windbg
-    {
-      'target_name': 'v8_debug_helper',
-      'type': 'static_library',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'gen_heap_constants',
-
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_snapshot',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
-      ],
-      # Enable RTTI //build/config/compiler:rtti
-      'cflags_cc': [ '-frtti' ],
-      'cflags_cc!': [ '-fno-rtti' ],
-      'xcode_settings': {
-        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
-      },
-      'msvs_settings': {
-        'VCCLCompilerTool': {
-          'RuntimeTypeInfo': 'true',
-        },
-      },
-      'configurations': {
-        'Release': { # Override target_defaults.Release in common.gypi
-          'msvs_settings': {
-            'VCCLCompilerTool': {
-              'RuntimeTypeInfo': 'true',
-            },
-          },
-        },
-      },
-
-      'conditions': [
-        ['node_shared_abseil=="false"', {
-          'dependencies': ['abseil.gyp:abseil'],
-        }],
-      ],
-    },  # v8_debug_helper
-    {
-      'target_name': 'gen_heap_constants',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'run_mkgrokdump',
-      ],
-      'direct_dependent_settings': {
-        'sources': [
-          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-            '<(SHARED_INTERMEDIATE_DIR)',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # gen_heap_constants
-    {
-      'target_name': 'run_mkgrokdump',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'mkgrokdump',
-      ],
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/run.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/run.py',
-            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
-            '--outfile',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # run_mkgrokdump
-    {
-      'target_name': 'mkgrokdump',
-      'type': 'executable',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'v8.gyp:v8_snapshot',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_libplatform',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-      ],
-      'conditions': [
-        ['node_shared_abseil=="false"', {
-          'dependencies': ['abseil.gyp:abseil'],
-        }],
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
-      ]
-    },  # mkgrokdump
   ],
 }

From 8e4d830a1bb5d0e6621bd672e2a684e2b1c901fc Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Mon, 7 Sep 2026 14:34:37 +0200
Subject: [PATCH 138/202] src: stop leaking a CppHeap in CommonEnvironmentSetup

`CommonEnvironmentSetup` created a `CppHeap` for its `CreateParams`
before deciding how to create the isolate, but `NewIsolate()` ignores
`params->cpp_heap` and attaches a heap of its own (or the one from
`IsolateSettings`). The first heap was never attached or destroyed, so
every non-snapshotting setup leaked one `CppHeap`; cppgc's heap
registry keeps it reachable, which is why LSAN stays quiet about it.

Only create the heap on the snapshotting path, where the params go to
the `SnapshotCreator` directly.

Refs: https://github.com/nodejs/node/pull/55337
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65792
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
---
 src/api/embed_helpers.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/api/embed_helpers.cc b/src/api/embed_helpers.cc
index 929998a7f239..4e26befd7471 100644
--- a/src/api/embed_helpers.cc
+++ b/src/api/embed_helpers.cc
@@ -117,8 +117,6 @@ CommonEnvironmentSetup::CommonEnvironmentSetup(
   Isolate::CreateParams params;
   params.array_buffer_allocator = impl_->allocator.get();
   params.external_references = external_references.data();
-  params.cpp_heap =
-      v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 
   Isolate* isolate;
 
@@ -130,6 +128,8 @@ CommonEnvironmentSetup::CommonEnvironmentSetup(
     // isolate, so that the memory reducer can be initialized.
     isolate = impl_->isolate = Isolate::Allocate(GetOrCreateIsolateGroup());
     platform->RegisterIsolate(isolate, loop);
+    params.cpp_heap =
+        v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 
     if (snapshot_config != nullptr && snapshot_config->base_blob != nullptr) {
       params.snapshot_blob = snapshot_config->base_blob;

From 07bd5198f1aba2650810843aa575f58691a5caf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marja=20H=C3=B6ltt=C3=A4?= <marja@chromium.org>
Date: Mon, 30 Mar 2026 09:55:56 +0200
Subject: [PATCH 139/202] deps: V8: backport ebd15783b7ba
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original commit message:

    [objects]: Defer CallSiteInfo creation

    Store the raw data in a FixedArray and create the CallSiteInfo objects
    only on demand.

    This can be further optimized to omit CallSiteInfo creation altogether
    in some code paths, but currently those code paths are not critically important.

    Change-Id: I6480862caf6b64020737527c571e3e3eac704ed3
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7673818
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106127}

Refs: https://github.com/v8/v8/commit/ebd15783b7ba67a135212cf7418ca2f85ebb7502
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 common.gypi                             |   2 +-
 deps/v8/src/execution/isolate.cc        | 118 +++++++++++++++++-------
 deps/v8/src/execution/messages.cc       |  39 +++++---
 deps/v8/src/heap/factory.cc             |   7 +-
 deps/v8/src/heap/factory.h              |   2 +-
 deps/v8/src/objects/call-site-info.cc   |  32 +++++++
 deps/v8/src/objects/call-site-info.h    |  16 ++++
 deps/v8/src/objects/debug-objects-inl.h |  14 +--
 deps/v8/src/objects/debug-objects.h     |   4 +-
 deps/v8/src/objects/debug-objects.tq    |   8 +-
 deps/v8/src/objects/fixed-array.cc      |  36 +++++++-
 deps/v8/src/objects/fixed-array.h       |  13 +++
 12 files changed, 222 insertions(+), 69 deletions(-)

diff --git a/common.gypi b/common.gypi
index 441a0e237204..7065b3d7ca49 100644
--- a/common.gypi
+++ b/common.gypi
@@ -43,7 +43,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.29',
+    'v8_embedder_string': '-node.30',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index e86eabdbf07d..0a377c9fb131 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -878,18 +878,21 @@ class CallSiteBuilder {
     // framework and library code, and stack depth tends to be more than
     // a dozen frames, so we over-allocate a bit here to avoid growing
     // the elements array in the common case.
-    elements_ = isolate->factory()->NewFixedArray(std::min(64, limit));
+    elements_ = isolate->factory()->NewFixedArray(CallSiteInfo::Fields::kCount *
+                                                  std::min(64, limit));
   }
 
   void SetPrevFrameAsConstructCall() {
     if (skipped_prev_frame_) return;
     DCHECK_GT(index_, 0);
-    Tagged<CallSiteInfo> info =
-        Tagged<CallSiteInfo>::cast(elements_->get(index_ - 1));
+    int base_index = (index_ - 1) * CallSiteInfo::Fields::kCount;
+    int flags =
+        Smi::ToInt(elements_->get(base_index + CallSiteInfo::Fields::kFlags));
 #if V8_ENABLE_WEBASSEMBLY
-    if (info->IsWasm()) return;
+    if (flags & CallSiteInfo::kIsWasm) return;
 #endif
-    info->set_flags(info->flags() | CallSiteInfo::kIsConstructor);
+    elements_->set(base_index + CallSiteInfo::Fields::kFlags,
+                   Smi::FromInt(flags | CallSiteInfo::kIsConstructor));
   }
 
   bool Visit(FrameSummary const& summary) {
@@ -1051,7 +1054,8 @@ class CallSiteBuilder {
   bool Full() { return index_ >= limit_; }
 
   Handle<FixedArray> Build() {
-    return FixedArray::RightTrimOrEmpty(isolate_, elements_, index_);
+    return FixedArray::RightTrimOrEmpty(isolate_, elements_,
+                                        CallSiteInfo::Fields::kCount * index_);
   }
 
  private:
@@ -1116,17 +1120,42 @@ class CallSiteBuilder {
 
   void AppendFrame(DirectHandle<UnionOf<JSAny, Hole>> receiver_or_instance,
                    DirectHandle<UnionOf<Smi, JSFunction>> function,
-                   DirectHandle<HeapObject> code, int offset, int flags,
+                   DirectHandle<HeapObject> code_obj, int offset, int flags,
                    DirectHandle<FixedArray> parameters) {
     if (IsTheHole(*receiver_or_instance, isolate_)) {
       // TODO(jgruber): Fix all cases in which frames give us a hole value
       // (e.g. the receiver in RegExp constructor frames).
       receiver_or_instance = isolate_->factory()->undefined_value();
     }
-    auto info = isolate_->factory()->NewCallSiteInfo(
-        Cast<JSAny>(receiver_or_instance), function, code, offset, flags,
-        parameters);
-    elements_ = FixedArray::SetAndGrow(isolate_, elements_, index_++, info);
+
+    int base_index = index_ * CallSiteInfo::Fields::kCount;
+
+    // Set the last field first and grow the array if needed.
+    static_assert(CallSiteInfo::Fields::kFlags ==
+                  CallSiteInfo::Fields::kCount - 1);
+    elements_ = FixedArray::SetAndGrow(
+        isolate_, elements_, base_index + CallSiteInfo::Fields::kFlags,
+        Smi::FromInt(flags));
+
+    elements_->set(base_index + CallSiteInfo::Fields::kReceiver,
+                   *receiver_or_instance);
+    elements_->set(base_index + CallSiteInfo::Fields::kFunction, *function);
+
+    if (DirectHandle<Code> code; TryCast(code_obj, &code)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode, code->wrapper());
+    } else if (DirectHandle<BytecodeArray> bytecode;
+               TryCast(code_obj, &bytecode)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     bytecode->wrapper());
+    } else {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     *isolate_->factory()->undefined_value());
+    }
+
+    elements_->set(base_index + CallSiteInfo::Fields::kOffset,
+                   Smi::FromInt(offset));
+
+    index_++;
     skipped_prev_frame_ = false;
   }
 
@@ -1442,13 +1471,18 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 }
 
 DirectHandle<StackTraceInfo> GetDetailedStackTraceFromCallSiteInfos(
-    Isolate* isolate, DirectHandle<FixedArray> call_site_infos, int limit) {
-  auto frames = isolate->factory()->NewFixedArray(
-      std::min(limit, call_site_infos->length()));
-  int index = 0;
-  for (int i = 0; i < call_site_infos->length() && index < limit; ++i) {
-    DirectHandle<CallSiteInfo> call_site_info(
-        Cast<CallSiteInfo>(call_site_infos->get(i)), isolate);
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos,
+    uint32_t limit) {
+  uint32_t call_site_infos_len =
+      raw_data_for_call_site_infos->length() /
+      CallSiteInfo::Fields::kCount;
+  auto frames =
+      isolate->factory()->NewFixedArray(std::min(limit, call_site_infos_len));
+  uint32_t index = 0;
+  for (uint32_t i = 0; i < call_site_infos_len && index < limit; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(isolate,
+                                           raw_data_for_call_site_infos, i);
     if (call_site_info->IsAsync()) {
       break;
     }
@@ -1519,14 +1553,19 @@ MaybeDirectHandle<JSObject> Isolate::CaptureAndSetErrorStack(
           stack_trace_for_uncaught_exceptions_frame_limit_,
           stack_trace_for_uncaught_exceptions_options_);
     } else {
-      auto call_site_infos =
+      auto raw_data_for_call_site_infos =
           Cast<FixedArray>(call_site_infos_or_formatted_stack);
       stack_trace = GetDetailedStackTraceFromCallSiteInfos(
-          this, call_site_infos,
-          stack_trace_for_uncaught_exceptions_frame_limit_);
-      if (stack_trace_limit < call_site_infos->length()) {
+          this, raw_data_for_call_site_infos,
+          static_cast<uint32_t>(
+              stack_trace_for_uncaught_exceptions_frame_limit_));
+      DCHECK_GE(stack_trace_limit, 0);
+      if (static_cast<int>(stack_trace_limit) *
+              CallSiteInfo::Fields::kCount <
+          raw_data_for_call_site_infos->length()) {
         call_site_infos_or_formatted_stack = FixedArray::RightTrimOrEmpty(
-            this, call_site_infos, stack_trace_limit);
+            this, raw_data_for_call_site_infos,
+            stack_trace_limit * CallSiteInfo::Fields::kCount);
       }
       // Notify the debugger.
       OnStackTraceCaptured(stack_trace);
@@ -1556,17 +1595,27 @@ Handle<FixedArray> Isolate::GetSimpleStackTrace(
   ErrorUtils::StackPropertyLookupResult lookup =
       ErrorUtils::GetErrorStackProperty(this, maybe_error_object);
 
+  Handle<FixedArray> raw_data;
   if (IsFixedArray(*lookup.error_stack)) {
-    return Cast<FixedArray>(lookup.error_stack);
-  }
-  if (!IsErrorStackData(*lookup.error_stack)) {
+    raw_data = Cast<FixedArray>(lookup.error_stack);
+  } else if (IsErrorStackData(*lookup.error_stack)) {
+    auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
+    if (!error_stack_data->HasRawDataForCallSiteInfos()) {
+      return factory()->empty_fixed_array();
+    }
+    raw_data = handle(error_stack_data->raw_data_for_call_site_infos(), this);
+  } else {
     return factory()->empty_fixed_array();
   }
-  auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
-  if (!error_stack_data->HasCallSiteInfos()) {
-    return factory()->empty_fixed_array();
+
+  int frame_count = raw_data->length() / CallSiteInfo::Fields::kCount;
+  Handle<FixedArray> call_site_infos = factory()->NewFixedArray(frame_count);
+  for (int i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(this, raw_data, i);
+    call_site_infos->set(i, *call_site_info);
   }
-  return handle(error_stack_data->call_site_infos(), this);
+  return call_site_infos;
 }
 
 Address Isolate::GetAbstractPC(int* line, int* column) {
@@ -3175,8 +3224,11 @@ void Isolate::PrintCurrentStackTrace(
       this, FixedArray::kMaxLength, SKIP_NONE, factory()->undefined_value());
 
   IncrementalStringBuilder builder(this);
-  for (int i = 0; i < frames->length(); ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)), this);
+  uint32_t frame_count =
+      frames->length() / CallSiteInfo::Fields::kCount;
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame =
+        CallSiteInfo::ConstructFromRawData(this, frames, i);
 
     if (should_include_frame_callback) {
       Tagged<Object> raw_script_name = frame->GetScriptNameOrSourceURL();
@@ -3200,7 +3252,7 @@ void Isolate::PrintCurrentStackTrace(
       SerializeCallSiteInfo(this, frame, &builder);
     }
 
-    if (i != frames->length() - 1) builder.AppendCharacter('\n');
+    if (i != frame_count - 1) builder.AppendCharacter('\n');
   }
 
   DirectHandle<String> stack_trace = builder.Finish().ToHandleChecked();
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index b24aafc1be43..ad3913afc30a 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -24,6 +24,7 @@
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/roots/roots.h"
+#include "src/sandbox/indirect-pointer-inl.h"
 #include "src/strings/string-builder-inl.h"
 
 namespace v8 {
@@ -202,15 +203,16 @@ namespace {
 
 // Convert the raw frames as written by Isolate::CaptureSimpleStackTrace into
 // a JSArray of JSCallSite objects.
-MaybeDirectHandle<JSArray> GetStackFrames(Isolate* isolate,
-                                          DirectHandle<FixedArray> frames) {
-  int frame_count = frames->length();
+MaybeDirectHandle<JSArray> GetStackFrames(
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos) {
+  uint32_t frame_count = raw_data_for_call_site_infos->length() /
+                         CallSiteInfo::Fields::kCount;
   DirectHandle<JSFunction> constructor = isolate->callsite_function();
   DirectHandle<FixedArray> sites =
       isolate->factory()->NewFixedArray(frame_count);
-  for (int i = 0; i < frame_count; ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)),
-                                     isolate);
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
     DirectHandle<JSObject> site;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, site,
                                JSObject::New(constructor, constructor,
@@ -292,7 +294,7 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
     return isolate->factory()->empty_string();
   }
   DCHECK(IsFixedArray(*raw_stack));
-  auto elems = Cast<FixedArray>(raw_stack);
+  auto raw_data_for_call_site_infos = Cast<FixedArray>(raw_stack);
 
   const bool in_recursion = isolate->formatting_stack_trace();
   const bool has_overflowed = i::StackLimitCheck{isolate}.HasOverflowed();
@@ -303,8 +305,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
       PrepareStackTraceScope scope(isolate);
 
       DirectHandle<JSArray> sites;
-      ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                 GetStackFrames(isolate, elems));
+      ASSIGN_RETURN_ON_EXCEPTION(
+          isolate, sites,
+          GetStackFrames(isolate, raw_data_for_call_site_infos));
 
       DirectHandle<Object> result;
       ASSIGN_RETURN_ON_EXCEPTION(
@@ -329,8 +332,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
         isolate->CountUsage(v8::Isolate::kErrorPrepareStackTrace);
 
         DirectHandle<JSArray> sites;
-        ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                   GetStackFrames(isolate, elems));
+        ASSIGN_RETURN_ON_EXCEPTION(
+            isolate, sites,
+            GetStackFrames(isolate, raw_data_for_call_site_infos));
 
         constexpr int argc = 2;
         std::array<DirectHandle<Object>, argc> args;
@@ -359,12 +363,16 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
 
   RETURN_ON_EXCEPTION(isolate, AppendErrorString(isolate, error, &builder));
 
-  for (int i = 0; i < elems->length(); ++i) {
+  int elems_len = raw_data_for_call_site_infos->length() /
+                       CallSiteInfo::Fields::kCount;
+  for (int i = 0; i < elems_len; ++i) {
     builder.AppendCStringLiteral("\n    at ");
 
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(elems->get(i)),
-                                     isolate);
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
 
+    // TODO(marja): Avoid CallSiteInfo creation since we serialize it right
+    // away.
     v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
     SerializeCallSiteInfo(isolate, frame, &builder);
 
@@ -1165,7 +1173,8 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
         isolate, formatted_stack,
         FormatStackTrace(
             isolate, error_object,
-            direct_handle(error_stack_data->call_site_infos(), isolate)));
+            direct_handle(error_stack_data->raw_data_for_call_site_infos(),
+                          isolate)));
     error_stack_data->set_formatted_stack(*formatted_stack);
     return formatted_stack;
   }
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 32b47dee39ff..2fc11e822292 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -1589,13 +1589,14 @@ DirectHandle<InterceptorInfo> Factory::NewInterceptorInfo(
 }
 
 DirectHandle<ErrorStackData> Factory::NewErrorStackData(
-    DirectHandle<UnionOf<JSAny, FixedArray>> call_site_infos_or_formatted_stack,
+    DirectHandle<UnionOf<JSAny, FixedArray>>
+        raw_data_for_call_site_infos_or_formatted_stack,
     DirectHandle<StackTraceInfo> stack_trace) {
   Tagged<ErrorStackData> error_stack_data = NewStructInternal<ErrorStackData>(
       ERROR_STACK_DATA_TYPE, AllocationType::kYoung);
   DisallowGarbageCollection no_gc;
-  error_stack_data->set_call_site_infos_or_formatted_stack(
-      *call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
+  error_stack_data->set_raw_data_for_call_site_infos_or_formatted_stack(
+      *raw_data_for_call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
   error_stack_data->set_stack_trace(*stack_trace, SKIP_WRITE_BARRIER);
   return direct_handle(error_stack_data, isolate());
 }
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 67abd4458664..bba53c6a5872 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -472,7 +472,7 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   DirectHandle<ErrorStackData> NewErrorStackData(
       DirectHandle<UnionOf<JSAny, FixedArray>>
-          call_site_infos_or_formatted_stack,
+          raw_data_for_call_site_infos_or_formatted_stack,
       DirectHandle<StackTraceInfo> stack_trace);
 
   Handle<Script> CloneScript(DirectHandle<Script> script,
diff --git a/deps/v8/src/objects/call-site-info.cc b/deps/v8/src/objects/call-site-info.cc
index f0a390cdf825..c275b4d734ae 100644
--- a/deps/v8/src/objects/call-site-info.cc
+++ b/deps/v8/src/objects/call-site-info.cc
@@ -17,6 +17,38 @@
 
 namespace v8::internal {
 
+// static
+DirectHandle<CallSiteInfo> CallSiteInfo::ConstructFromRawData(
+    Isolate* isolate, DirectHandle<FixedArray> frames, int index) {
+  int base_index = index * Fields::kCount;
+  DirectHandle<Object> receiver(frames->get(base_index + Fields::kReceiver),
+                                isolate);
+  DirectHandle<Object> function(frames->get(base_index + Fields::kFunction),
+                                isolate);
+  DirectHandle<Object> code_obj(frames->get(base_index + Fields::kCode),
+                                isolate);
+  DirectHandle<Union<Code, BytecodeArray, Undefined>> resolved_code;
+  if (IsCodeWrapper(*code_obj)) {
+    resolved_code = handle(Cast<CodeWrapper>(code_obj)->code(isolate), isolate);
+  } else if (IsBytecodeWrapper(*code_obj)) {
+    resolved_code =
+        handle(Cast<BytecodeWrapper>(code_obj)->bytecode(isolate), isolate);
+  } else if (IsUndefined(*code_obj)) {
+    resolved_code = isolate->factory()->undefined_value();
+  } else {
+    UNREACHABLE();
+  }
+
+  int offset = Smi::ToInt(frames->get(base_index + Fields::kOffset));
+  DirectHandle<FixedArray> parameters(
+      Cast<FixedArray>(frames->get(base_index + Fields::kParameters)), isolate);
+  int flags = Smi::ToInt(frames->get(base_index + Fields::kFlags));
+
+  return isolate->factory()->NewCallSiteInfo(
+      Cast<JSAny>(receiver), Cast<UnionOf<Smi, JSFunction>>(function),
+      resolved_code, offset, flags, parameters);
+}
+
 bool CallSiteInfo::IsPromiseAll() const {
   if (!IsAsync()) return false;
   Tagged<JSFunction> fun = Cast<JSFunction>(function());
diff --git a/deps/v8/src/objects/call-site-info.h b/deps/v8/src/objects/call-site-info.h
index cb4d8433f141..ec3f48a74b15 100644
--- a/deps/v8/src/objects/call-site-info.h
+++ b/deps/v8/src/objects/call-site-info.h
@@ -80,6 +80,22 @@ V8_OBJECT class CallSiteInfo : public StructLayout {
   // Used to signal that the requested field is unknown.
   static constexpr int kUnknown = kNoSourcePosition;
 
+  // For delayed CallSiteInfo creation (storing the raw data for several
+  // CallSiteInfos in a FixedArray).
+  // kFlags must stay last (see CallSiteBuilder::AppendFrame).
+  enum Fields {
+    kCode = 0,
+    kReceiver,
+    kFunction,
+    kOffset,
+    kParameters,
+    kFlags,
+    kCount
+  };
+
+  static DirectHandle<CallSiteInfo> ConstructFromRawData(
+      Isolate* isolate, DirectHandle<FixedArray> frames, int index);
+
   V8_EXPORT_PRIVATE static int GetLineNumber(DirectHandle<CallSiteInfo> info);
   V8_EXPORT_PRIVATE static int GetColumnNumber(DirectHandle<CallSiteInfo> info);
 
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index 1b282108b96e..41a4dea1cd8a 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -84,18 +84,20 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(StackTraceInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(ErrorStackData)
 
 bool ErrorStackData::HasFormattedStack() const {
-  return !IsFixedArray(call_site_infos_or_formatted_stack());
+  return !IsFixedArray(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 ACCESSORS_RELAXED_CHECKED2(ErrorStackData, formatted_stack, Tagged<Object>,
-                           kCallSiteInfosOrFormattedStackOffset,
+                           kRawDataForCallSiteInfosOrFormattedStackOffset,
                            HasFormattedStack(), true)
 
-bool ErrorStackData::HasCallSiteInfos() const { return !HasFormattedStack(); }
+bool ErrorStackData::HasRawDataForCallSiteInfos() const {
+  return !HasFormattedStack();
+}
 
-DEF_GETTER(ErrorStackData, call_site_infos, Tagged<FixedArray>) {
-  DCHECK(HasCallSiteInfos());
-  return Cast<FixedArray>(call_site_infos_or_formatted_stack());
+DEF_GETTER(ErrorStackData, raw_data_for_call_site_infos, Tagged<FixedArray>) {
+  DCHECK(HasRawDataForCallSiteInfos());
+  return Cast<FixedArray>(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index e4ffa7ecf174..2ae518dcc190 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -254,8 +254,8 @@ class ErrorStackData
  public:
   inline bool HasFormattedStack() const;
   DECL_ACCESSORS(formatted_stack, Tagged<Object>)
-  inline bool HasCallSiteInfos() const;
-  DECL_GETTER(call_site_infos, Tagged<FixedArray>)
+  inline bool HasRawDataForCallSiteInfos() const;
+  DECL_GETTER(raw_data_for_call_site_infos, Tagged<FixedArray>)
 
   DECL_VERIFIER(ErrorStackData)
 
diff --git a/deps/v8/src/objects/debug-objects.tq b/deps/v8/src/objects/debug-objects.tq
index 630a134971bb..607f2abf4418 100644
--- a/deps/v8/src/objects/debug-objects.tq
+++ b/deps/v8/src/objects/debug-objects.tq
@@ -102,10 +102,10 @@ extern class StackTraceInfo extends Struct {
 // (2) A valid JavaScript object and StackTraceInfo once
 //     error.stack was accessed.
 extern class ErrorStackData extends Struct {
-  // This holds either the FixedArray of CallSiteInfo instances or
-  // the formatted stack value (usually a string) that's returned
-  // from the error.stack property.
-  call_site_infos_or_formatted_stack: FixedArray|JSAny;
+  // This holds either the FixedArray of raw data for constructing the
+  // CallSiteInfo instances or the formatted stack value (usually a string)
+  // that's returned from the error.stack property.
+  raw_data_for_call_site_infos_or_formatted_stack: FixedArray|JSAny;
   // This holds the StackTraceInfo for inspector stack trace.
   stack_trace: StackTraceInfo;
 }
diff --git a/deps/v8/src/objects/fixed-array.cc b/deps/v8/src/objects/fixed-array.cc
index 28eebb5acec0..88bbe5655c8f 100644
--- a/deps/v8/src/objects/fixed-array.cc
+++ b/deps/v8/src/objects/fixed-array.cc
@@ -21,10 +21,9 @@ bool FixedArrayBase::IsCowArray() const {
 template <template <typename> typename HandleType>
   requires(
       std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
-HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
-                                              HandleType<FixedArray> array,
-                                              int index,
-                                              DirectHandle<Object> value) {
+HandleType<FixedArray> FixedArray::Grow(Isolate* isolate,
+                                        HandleType<FixedArray> array,
+                                        int index) {
   int len = array->length();
   if (index >= len) {
     int new_capacity = FixedArray::NewCapacityForIndex(index, len);
@@ -33,7 +32,17 @@ HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
     // use `undefined` as a filler. Make this more explicit.
     array->FillWithHoles(len, new_capacity);
   }
+  return array;
+}
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              DirectHandle<Object> value) {
+  array = Grow(isolate, array, index);
   array->set(index, *value);
   return array;
 }
@@ -45,6 +54,25 @@ template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
     Isolate* isolate, IndirectHandle<FixedArray> array, int index,
     DirectHandle<Object> value);
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              Tagged<Smi> value) {
+  array = Grow(isolate, array, index);
+  array->set(index, value);
+  return array;
+}
+
+template DirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, DirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, IndirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+
 void FixedArray::RightTrim(Isolate* isolate, int new_capacity) {
   DCHECK_NE(map(), ReadOnlyRoots{isolate}.fixed_cow_array_map());
   Super::RightTrim(isolate, new_capacity);
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index e634550ae8f9..a0adf5e49011 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -259,6 +259,12 @@ V8_OBJECT class FixedArray
   V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
       Isolate* isolate, HandleType<FixedArray> array, int index,
       DirectHandle<Object> value);
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
+      Isolate* isolate, HandleType<FixedArray> array, int index,
+      Tagged<Smi> value);
 
   // Right-trim the array.
   // Invariant: 0 < new_length <= length()
@@ -289,6 +295,13 @@ V8_OBJECT class FixedArray
   static constexpr int kMaxRegularLength = FixedArray::kMaxRegularCapacity;
 
  private:
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  static HandleType<FixedArray> Grow(Isolate* isolate,
+                                     HandleType<FixedArray> array,
+                                     int index);
+
   inline static Handle<FixedArray> Resize(
       Isolate* isolate, DirectHandle<FixedArray> xs, int new_capacity,
       AllocationType allocation = AllocationType::kYoung,

From 7a4654c501329e12e9cf6848b1050f26bce50b04 Mon Sep 17 00:00:00 2001
From: Jakob Linke <jgruber@chromium.org>
Date: Wed, 1 Apr 2026 19:54:23 +0200
Subject: [PATCH 140/202] deps: V8: backport c9c0abfa51f0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original commit message:

    [stack traces] Reduce stack frame summarization costs

    During stack trace capture, Summarize() is the most expensive step — it
    creates a full TranslatedState for every optimized frame even though
    most frames are never inspected. This CL reduces that cost in two ways:

    1. Lightweight Summarize() for optimized frames: instead of building a
       full TranslatedState, walk only the deopt translation frame headers
       and resolve function/receiver via ResolveTaggedValue(), falling back
       to the full TranslatedState path for wasm-inlined or unresolvable
       closures.

    2. Deferred baseline frames: during CaptureSimpleStackTrace, baseline
       frames store the raw Code + PC offset and defer bytecode offset
       resolution to ExpandDeferredFrames(), which runs lazily before the
       stack trace is formatted or inspected.

    A new Torque bitfield flag (is_deferred_baseline_frame) marks entries in
    the raw capture array that still need resolution. All consumers
    (GetSimpleStackTrace, GetDetailedStackTraceFromCallSiteInfos,
    GetFormattedStack, PrintCurrentStackTrace) call ExpandDeferredFrames()
    before processing the array.

    Change-Id: I1fe8cce918ba129d655d66f608ac6aa0ed160920
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7722138
    Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    Auto-Submit: Jakob Linke <jgruber@chromium.org>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106237}

Refs: https://github.com/v8/v8/commit/74e153d17187f07535c1812f10937f60e0ae0974
Refs: https://github.com/v8/v8/commit/c9c0abfa51f06ea3c87c4ee9bb519fa8b01fcbbf
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 common.gypi                                 |   2 +-
 deps/v8/src/deoptimizer/translated-state.cc |  21 +++
 deps/v8/src/deoptimizer/translated-state.h  |  10 +-
 deps/v8/src/execution/frames.cc             | 144 ++++++++++++++++++--
 deps/v8/src/execution/frames.h              |  12 ++
 deps/v8/src/execution/isolate.cc            | 132 +++++++++++++-----
 deps/v8/src/execution/messages.cc           |  13 +-
 deps/v8/src/objects/call-site-info.cc       |  37 +++++
 deps/v8/src/objects/call-site-info.h        |  11 ++
 deps/v8/src/objects/call-site-info.tq       |   5 +
 10 files changed, 333 insertions(+), 54 deletions(-)

diff --git a/common.gypi b/common.gypi
index 7065b3d7ca49..ffb06d54ffed 100644
--- a/common.gypi
+++ b/common.gypi
@@ -43,7 +43,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.30',
+    'v8_embedder_string': '-node.31',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/deoptimizer/translated-state.cc b/deps/v8/src/deoptimizer/translated-state.cc
index a8c87dbd0242..06a9136e13fa 100644
--- a/deps/v8/src/deoptimizer/translated-state.cc
+++ b/deps/v8/src/deoptimizer/translated-state.cc
@@ -1889,6 +1889,27 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
   }
 }
 
+// static
+Tagged<Object> TranslatedState::ResolveTaggedValue(
+    DeoptTranslationIterator* it, Address fp,
+    Tagged<DeoptimizationLiteralArray> literals) {
+  TranslationOpcode opcode = it->NextOpcode();
+  switch (opcode) {
+    case TranslationOpcode::LITERAL: {
+      int literal_index = it->NextOperand();
+      return literals->get(literal_index);
+    }
+    case TranslationOpcode::TAGGED_STACK_SLOT: {
+      int slot_offset =
+          OptimizedJSFrame::StackSlotOffsetRelativeToFp(it->NextOperand());
+      intptr_t value = *reinterpret_cast<intptr_t*>(fp + slot_offset);
+      return Tagged<Object>(DecompressIfNeeded(value));
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
 TranslatedState::TranslatedState(const JavaScriptFrame* frame)
     : purpose_(kFrameInspection) {
   int deopt_index = SafepointEntry::kNoDeoptIndex;
diff --git a/deps/v8/src/deoptimizer/translated-state.h b/deps/v8/src/deoptimizer/translated-state.h
index dfa5f11e8209..5029b2b74222 100644
--- a/deps/v8/src/deoptimizer/translated-state.h
+++ b/deps/v8/src/deoptimizer/translated-state.h
@@ -511,6 +511,15 @@ class TranslatedState {
   void VerifyMaterializedObjects();
   bool DoUpdateFeedback(DeoptimizeReason reason);
 
+  // Resolves one deopt translation value opcode to a raw Tagged<Object>,
+  // reading from the live frame if needed.  Only LITERAL and
+  // TAGGED_STACK_SLOT are expected; other opcodes are UNREACHABLE.
+  static Tagged<Object> ResolveTaggedValue(
+      DeoptTranslationIterator* it, Address fp,
+      Tagged<DeoptimizationLiteralArray> literals);
+
+  static Address DecompressIfNeeded(intptr_t value);
+
  private:
   friend TranslatedValue;
 
@@ -529,7 +538,6 @@ class TranslatedState {
       int frame_index, DeoptTranslationIterator* iterator,
       const DeoptimizationLiteralProvider& literal_array, Address fp,
       RegisterValues* registers, FILE* trace_file);
-  Address DecompressIfNeeded(intptr_t value);
   void CreateArgumentsElementsTranslatedValues(int frame_index,
                                                Address input_frame_pointer,
                                                CreateArgumentsType type,
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 110abb96f250..be13c1d682af 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -3179,7 +3179,109 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
         "Missing deoptimization information for OptimizedJSFrame::Summarize.");
   }
 
-  // Prepare iteration over translation. We must not materialize values here
+  // Lightweight walk: iterate frame headers only, resolving just the
+  // function and receiver from the live frame via ResolveTaggedValue.
+  // This avoids the expensive TranslatedState::Init + Prepare path that
+  // would parse every value in every inlined frame.
+
+  Tagged<DeoptimizationLiteralArray> literal_array = data->LiteralArray();
+
+  // Lightweight walk: resolve function and receiver from live frame headers
+  // and build JavaScriptFrameSummary objects directly.
+  bool needs_full_walk = false;
+  {
+    DisallowGarbageCollection no_gc;
+    DeoptimizationFrameTranslation::Iterator it(
+        data->FrameTranslation(), data->TranslationIndex(deopt_index).value());
+    bool is_constructor = IsConstructor();
+    int remaining = it.EnterBeginOpcode().total_frame_count;
+
+    while (remaining > 0) {
+      TranslationOpcode opcode = it.SeekNextFrame();
+      remaining--;
+
+      if (opcode == TranslationOpcode::CONSTRUCT_CREATE_STUB_FRAME ||
+          opcode == TranslationOpcode::CONSTRUCT_INVOKE_STUB_FRAME) {
+        is_constructor = true;
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      if (!IsTranslationJsFrameOpcode(opcode)) {
+#if V8_ENABLE_WEBASSEMBLY
+        // Wasm-inlined-into-JS frames need the full TranslatedState
+        // machinery to produce WasmFrameSummary entries.
+        if (opcode == TranslationOpcode::WASM_INLINED_INTO_JS_FRAME) {
+          needs_full_walk = true;
+          break;
+        }
+#endif
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      bool is_builtin_cont =
+          (opcode == TranslationOpcode::JAVASCRIPT_BUILTIN_CONTINUATION_FRAME ||
+           opcode == TranslationOpcode::
+                         JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH_FRAME);
+
+      int bytecode_offset = it.NextOperand();
+      int sfi_id = it.NextOperand();
+      Tagged<SharedFunctionInfo> sfi =
+          Cast<SharedFunctionInfo>(literal_array->get(sfi_id));
+
+      // Skip remaining header operands to reach the values.
+      it.SkipOperands(TranslationOpcodeOperandCount(opcode) - 2);
+
+      // Resolve closure and receiver from the live frame.  Both are always
+      // encoded as LITERAL or TAGGED_STACK_SLOT in the deopt translation.
+      Tagged<Object> function_obj =
+          TranslatedState::ResolveTaggedValue(&it, fp(), literal_array);
+      DCHECK(IsJSFunction(function_obj));
+      Tagged<Object> receiver_obj =
+          TranslatedState::ResolveTaggedValue(&it, fp(), literal_array);
+
+      Tagged<AbstractCode> abstract_code;
+      int code_offset;
+      if (is_builtin_cont) {
+        code_offset = 0;
+        abstract_code = Cast<AbstractCode>(
+            isolate()->builtins()->code(Builtins::GetBuiltinFromBytecodeOffset(
+                BytecodeOffset(bytecode_offset))));
+      } else {
+        code_offset = bytecode_offset;
+        abstract_code = Cast<AbstractCode>(sfi->GetBytecodeArray(isolate()));
+      }
+
+      DirectHandle<FixedArray> params = GetParameters(never_allocate);
+      FrameSummary::JavaScriptFrameSummary summary(
+          isolate(), receiver_obj, Cast<JSFunction>(function_obj),
+          abstract_code, code_offset, is_constructor, *params);
+      summaries.frames.push_back(summary);
+      is_constructor = false;
+    }
+
+    if (!needs_full_walk && is_constructor) {
+      summaries.top_frame_is_construct_call = true;
+    }
+  }  // no_gc scope ends.
+
+  if (needs_full_walk) {
+    return SummarizeFull(data, deopt_index, never_allocate);
+  }
+
+  return summaries;
+}
+
+FrameSummaries OptimizedJSFrame::SummarizeFull(Tagged<DeoptimizationData> data,
+                                               int deopt_index,
+                                               bool never_allocate) const {
+  FrameSummaries summaries;
+
+  DCHECK_NE(deopt_index, SafepointEntry::kNoDeoptIndex);
+  DCHECK(!data.is_null());
+
+  // Prepare iteration over translation.  We must not materialize values here
   // because we do not deoptimize the function.
   TranslatedState translated(this);
   translated.Prepare(fp());
@@ -3204,7 +3306,21 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
       // Get the correct receiver in the optimized frame.
       static_assert(TranslatedFrame::kReceiverIsFirstParameterInJSFrames);
       CHECK(!translated_values->IsMaterializedObject());
-      DirectHandle<Object> receiver = translated_values->GetValue();
+      // Check GetRawValue() against arguments_marker() first to see whether
+      // calling GetValue() allocates.
+      Tagged<Object> receiver_obj = translated_values->GetRawValue();
+      DirectHandle<Object> receiver;
+      if (receiver_obj == ReadOnlyRoots(isolate()).arguments_marker() &&
+          never_allocate) {
+        // Calling GetValue() would definitely trigger allocation but with
+        // `never_allocate` allocations are not allowed. Simply pick `undefined`
+        // as receiver instead even though it is off. `never_allocate` is
+        // currently only used for OOM stacks, where we don't even emit the
+        // receiver but want to see as many stack frames as possible.
+        receiver = isolate()->factory()->undefined_value();
+      } else {
+        receiver = translated_values->GetValue();
+      }
       translated_values++;
 
       // Determine the underlying code object and the position within it from
@@ -3311,24 +3427,20 @@ int TurbofanJSFrame::FindReturnPCForTrampoline(Tagged<Code> code,
   return safepoints.find_return_pc(trampoline_pc);
 }
 
-Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
-    Tagged<Code> code, int* deopt_index) const {
-  DCHECK(is_optimized());
-
-  Address pc = maybe_unauthenticated_pc();
-
-  DCHECK(code->contains(isolate(), pc));
+// static
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationDataForPC(
+    Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index) {
+  DCHECK(code->contains(isolate, pc));
   DCHECK(CodeKindCanDeoptimize(code->kind()));
-
   if (code->is_maglevved()) {
     MaglevSafepointEntry safepoint_entry =
-        code->GetMaglevSafepointEntry(isolate(), pc);
+        code->GetMaglevSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
     }
   } else {
-    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate(), pc);
+    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
@@ -3338,6 +3450,14 @@ Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
   return {};
 }
 
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
+    Tagged<Code> code, int* deopt_index) const {
+  DCHECK(is_optimized());
+  Address pc = maybe_unauthenticated_pc();
+  DCHECK(code->contains(isolate(), pc));
+  return GetDeoptimizationDataForPC(isolate(), code, pc, deopt_index);
+}
+
 void OptimizedJSFrame::GetFunctions(
     std::vector<Tagged<SharedFunctionInfo>>* functions) const {
   DCHECK(functions->empty());
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index 017613a7305a..550fdde93671 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -1169,6 +1169,11 @@ class OptimizedJSFrame : public JavaScriptFrame {
   Tagged<DeoptimizationData> GetDeoptimizationData(Tagged<Code> code,
                                                    int* deopt_index) const;
 
+  // Like GetDeoptimizationData, but takes an explicit PC instead of reading
+  // it from the frame.  Can be used without a live frame.
+  static Tagged<DeoptimizationData> GetDeoptimizationDataForPC(
+      Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index);
+
   static int StackSlotOffsetRelativeToFp(int slot_index);
 
   // Lookup exception handler for current {pc}, returns -1 if none found.
@@ -1178,6 +1183,13 @@ class OptimizedJSFrame : public JavaScriptFrame {
   virtual int FindReturnPCForTrampoline(Tagged<Code> code,
                                         int trampoline_pc) const = 0;
 
+ private:
+  // Full TranslatedState-based walk, used as fallback when the lightweight
+  // path in Summarize() encounters frames it cannot handle (e.g.
+  // wasm-inlined-into-JS frames).
+  FrameSummaries SummarizeFull(Tagged<DeoptimizationData> data, int deopt_index,
+                               bool never_allocate) const;
+
  protected:
   inline explicit OptimizedJSFrame(StackFrameIteratorBase* iterator);
 };
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 0a377c9fb131..37c72639cd7f 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -1118,6 +1118,30 @@ class CallSiteBuilder {
     return true;
   }
 
+ public:
+  // Store a deferred entry for a baseline frame.
+  // Stores the Code + raw PC offset; bytecode offset resolution
+  // happens lazily in ExpandDeferredFrames().
+  bool AppendDeferredFrame(JavaScriptFrame* frame, int deferred_flag) {
+    if (Full()) return false;
+    DirectHandle<JSFunction> function(frame->function(), isolate_);
+    if (!IsVisibleInStackTrace(function)) {
+      skipped_prev_frame_ = true;
+      return true;
+    }
+    int flags = deferred_flag;
+    if (IsStrictFrame(function)) flags |= CallSiteInfo::kIsStrict;
+    if (frame->IsConstructor()) flags |= CallSiteInfo::kIsConstructor;
+
+    Tagged<Code> code = frame->LookupCode();
+    int pc_offset = static_cast<int>(frame->pc() - code->instruction_start());
+
+    AppendFrame(Cast<UnionOf<JSAny, Hole>>(handle(frame->receiver(), isolate_)),
+                function, handle(code, isolate_), pc_offset, flags,
+                frame->GetParameters(/*never_allocate=*/false));
+    return true;
+  }
+
   void AppendFrame(DirectHandle<UnionOf<JSAny, Hole>> receiver_or_instance,
                    DirectHandle<UnionOf<Smi, JSFunction>> function,
                    DirectHandle<HeapObject> code_obj, int offset, int flags,
@@ -1154,6 +1178,8 @@ class CallSiteBuilder {
 
     elements_->set(base_index + CallSiteInfo::Fields::kOffset,
                    Smi::FromInt(offset));
+    elements_->set(base_index + CallSiteInfo::Fields::kParameters,
+                   *parameters);
 
     index_++;
     skipped_prev_frame_ = false;
@@ -1386,18 +1412,16 @@ void CaptureAsyncStackTrace(Isolate* isolate, CallSiteBuilder* builder) {
   }
 }
 
+// Summarize a single frame and pass each logical frame to the visitor.
 template <typename Visitor>
 void VisitStack(Isolate* isolate, Visitor* visitor,
                 StackTrace::StackTraceOptions options = StackTrace::kDetailed,
                 bool never_allocate = false) {
   DisallowJavascriptExecution no_js(isolate);
-  // Keep track if we visited a stack frame, but did not visit any summarized
-  // frames. Either because the stack frame didn't create any summarized frames
-  // or due to security origin.
-  bool skipped_last_frame = true;
   for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
     StackFrame* frame = it.frame();
     switch (frame->type()) {
+      case StackFrame::BASELINE:
       case StackFrame::API_CALLBACK_EXIT:
       case StackFrame::API_CONSTRUCT_EXIT:
       case StackFrame::BUILTIN_EXIT:
@@ -1406,7 +1430,6 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
       case StackFrame::TURBOFAN_JS:
       case StackFrame::MAGLEV:
       case StackFrame::INTERPRETED:
-      case StackFrame::BASELINE:
       case StackFrame::BUILTIN:
 #if V8_ENABLE_WEBASSEMBLY
       case StackFrame::STUB:
@@ -1421,14 +1444,73 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
         // inlining).
         FrameSummaries summaries =
             CommonFrame::cast(frame)->Summarize(never_allocate);
+        for (auto& summary : base::Reversed(summaries.frames)) {
+          // Skip frames from other origins when asked to do so.
+          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
+              !summary.native_context()->HasSameSecurityTokenAs(
+                  isolate->context())) {
+            continue;
+          }
+          if (!visitor->Visit(summary)) return;
+        }
+        break;
+      }
+
+      default:
+        break;
+    }
+  }
+}
+
+// Specialized stack walk for CallSiteBuilder, handling deferred baseline
+// frames and the construct-call flag on the previous frame.
+void VisitStack_ForCallSiteBuilder(Isolate* isolate, CallSiteBuilder* visitor) {
+  DisallowJavascriptExecution no_js(isolate);
+  // Track whether the last physical frame produced any visited summarized
+  // frames. Used to correctly attribute construct-call flags.
+  bool skipped_last_frame = true;
+  for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+    StackFrame* frame = it.frame();
+    switch (frame->type()) {
+      case StackFrame::BASELINE:
+        // Baseline frames are captured as deferred entries so they can be
+        // expanded later without blocking the stack capture path.
+        if (!visitor->AppendDeferredFrame(
+                JavaScriptFrame::cast(frame),
+                CallSiteInfo::kIsDeferredBaselineFrame)) {
+          return;
+        }
+        skipped_last_frame = true;
+        break;
+      case StackFrame::API_CALLBACK_EXIT:
+      case StackFrame::API_CONSTRUCT_EXIT:
+      case StackFrame::BUILTIN_EXIT:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH:
+      case StackFrame::TURBOFAN_JS:
+      case StackFrame::MAGLEV:
+      case StackFrame::INTERPRETED:
+      case StackFrame::BUILTIN:
+#if V8_ENABLE_WEBASSEMBLY
+      case StackFrame::STUB:
+      case StackFrame::WASM:
+      case StackFrame::WASM_SEGMENT_START:
+#if V8_ENABLE_DRUMBRAKE
+      case StackFrame::WASM_INTERPRETER_ENTRY:
+#endif  // V8_ENABLE_DRUMBRAKE
+#endif  // V8_ENABLE_WEBASSEMBLY
+      {
+        // A standard frame may include many summarized frames (due to
+        // inlining).
+        FrameSummaries summaries = CommonFrame::cast(frame)->Summarize();
         if (summaries.top_frame_is_construct_call && !skipped_last_frame) {
           visitor->SetPrevFrameAsConstructCall();
         }
         skipped_last_frame = true;
         for (auto& summary : base::Reversed(summaries.frames)) {
-          // Skip frames from other origins when asked to do so.
-          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
-              !summary.native_context()->HasSameSecurityTokenAs(
+          // CaptureSimpleStackTrace uses kDetailed, which does not expose
+          // frames across security origins.
+          if (!summary.native_context()->HasSameSecurityTokenAs(
                   isolate->context())) {
             continue;
           }
@@ -1455,7 +1537,7 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 #endif  // V8_ENABLE_WEBASSEMBLY
 
   CallSiteBuilder builder(isolate, mode, limit, caller);
-  VisitStack(isolate, &builder);
+  VisitStack_ForCallSiteBuilder(isolate, &builder);
 
   // If --async-stack-traces are enabled and the "current microtask" is a
   // PromiseReactionJobTask, we try to enrich the stack trace with async
@@ -1473,6 +1555,9 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 DirectHandle<StackTraceInfo> GetDetailedStackTraceFromCallSiteInfos(
     Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos,
     uint32_t limit) {
+  Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+      isolate, handle(*raw_data_for_call_site_infos, isolate));
+  raw_data_for_call_site_infos = expanded;
   uint32_t call_site_infos_len =
       raw_data_for_call_site_infos->length() /
       CallSiteInfo::Fields::kCount;
@@ -1608,6 +1693,8 @@ Handle<FixedArray> Isolate::GetSimpleStackTrace(
     return factory()->empty_fixed_array();
   }
 
+  raw_data = CallSiteInfo::ExpandDeferredFrames(this, raw_data);
+
   int frame_count = raw_data->length() / CallSiteInfo::Fields::kCount;
   Handle<FixedArray> call_site_infos = factory()->NewFixedArray(frame_count);
   for (int i = 0; i < frame_count; ++i) {
@@ -1665,10 +1752,6 @@ class StackFrameBuilder {
         index_(0),
         limit_(limit) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Check if we have enough capacity left.
     if (index_ >= limit_) return false;
@@ -1713,10 +1796,6 @@ class CurrentScriptNameStackVisitor {
   explicit CurrentScriptNameStackVisitor(Isolate* isolate)
       : isolate_(isolate) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1745,10 +1824,6 @@ class CurrentScriptNameStackVisitor {
 
 class CurrentScriptIdStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1778,10 +1853,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
     DCHECK_LT(0, frame_data.size());
   }
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (!summary.is_subject_to_debugging()) return true;
 
@@ -1827,10 +1898,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
 
 class CurrentScriptStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1968,10 +2035,6 @@ class MinimalStackPrinter {
 
   explicit MinimalStackPrinter(size_t max_length) : max_length_(max_length) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (summary.IsJavaScript()) {
       const FrameSummary::JavaScriptFrameSummary& js_summary =
@@ -3220,8 +3283,9 @@ Tagged<Object> Isolate::ThrowIllegalOperation() {
 void Isolate::PrintCurrentStackTrace(
     std::ostream& out,
     PrintCurrentStackTraceFilterCallback should_include_frame_callback) {
-  DirectHandle<FixedArray> frames = CaptureSimpleStackTrace(
+  Handle<FixedArray> frames = CaptureSimpleStackTrace(
       this, FixedArray::kMaxLength, SKIP_NONE, factory()->undefined_value());
+  frames = CallSiteInfo::ExpandDeferredFrames(this, frames);
 
   IncrementalStringBuilder builder(this);
   uint32_t frame_count =
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index ad3913afc30a..64800baec261 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -1168,13 +1168,13 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
 
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate,
+        handle(error_stack_data->raw_data_for_call_site_infos(), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(
-            isolate, error_object,
-            direct_handle(error_stack_data->raw_data_for_call_site_infos(),
-                          isolate)));
+        FormatStackTrace(isolate, error_object, expanded));
     error_stack_data->set_formatted_stack(*formatted_stack);
     return formatted_stack;
   }
@@ -1182,11 +1182,12 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
   if (IsFixedArray(*lookup.error_stack)) {
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate, handle(Cast<FixedArray>(*lookup.error_stack), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(isolate, error_object,
-                         Cast<FixedArray>(lookup.error_stack)));
+        FormatStackTrace(isolate, error_object, expanded));
     RETURN_ON_EXCEPTION(
         isolate, Object::SetProperty(isolate, error_object,
                                      isolate->factory()->error_stack_symbol(),
diff --git a/deps/v8/src/objects/call-site-info.cc b/deps/v8/src/objects/call-site-info.cc
index c275b4d734ae..fa1a0f15a6b2 100644
--- a/deps/v8/src/objects/call-site-info.cc
+++ b/deps/v8/src/objects/call-site-info.cc
@@ -7,7 +7,9 @@
 #include <optional>
 
 #include "src/base/strings.h"
+#include "src/builtins/builtins.h"
 #include "src/objects/call-site-info-inl.h"
+#include "src/objects/code-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/strings/string-builder-inl.h"
 
@@ -49,6 +51,41 @@ DirectHandle<CallSiteInfo> CallSiteInfo::ConstructFromRawData(
       resolved_code, offset, flags, parameters);
 }
 
+// static
+Handle<FixedArray> CallSiteInfo::ExpandDeferredFrames(
+    Isolate* isolate, Handle<FixedArray> raw_data) {
+  int entry_count = raw_data->length() / Fields::kCount;
+
+  // Resolve deferred baseline frames in-place (PC offset → bytecode offset).
+  for (int i = 0; i < entry_count; i++) {
+    int base = i * Fields::kCount;
+    int flags = Smi::ToInt(raw_data->get(base + Fields::kFlags));
+
+    if (flags & kIsDeferredBaselineFrame) {
+      // Resolve the bytecode offset from the raw PC offset.
+      Tagged<Object> code_obj = raw_data->get(base + Fields::kCode);
+      CHECK(IsCodeWrapper(code_obj));
+      Tagged<Code> code = Cast<CodeWrapper>(code_obj)->code(isolate);
+      int pc_offset = Smi::ToInt(raw_data->get(base + Fields::kOffset));
+      Tagged<BytecodeArray> bytecode_array =
+          Cast<JSFunction>(raw_data->get(base + Fields::kFunction))
+              ->shared()
+              ->GetBytecodeArray(isolate);
+      int bytecode_offset = code->GetBytecodeOffsetForBaselinePC(
+          code->instruction_start() + pc_offset, bytecode_array);
+
+      raw_data->set(base + Fields::kCode, bytecode_array->wrapper());
+      raw_data->set(base + Fields::kOffset, Smi::FromInt(bytecode_offset));
+
+      // Strip deferred flags.
+      int clean_flags = flags & ~kDeferredFlagsMask;
+      raw_data->set(base + Fields::kFlags, Smi::FromInt(clean_flags));
+    }
+  }
+
+  return raw_data;
+}
+
 bool CallSiteInfo::IsPromiseAll() const {
   if (!IsAsync()) return false;
   Tagged<JSFunction> fun = Cast<JSFunction>(function());
diff --git a/deps/v8/src/objects/call-site-info.h b/deps/v8/src/objects/call-site-info.h
index ec3f48a74b15..bea45215aeaa 100644
--- a/deps/v8/src/objects/call-site-info.h
+++ b/deps/v8/src/objects/call-site-info.h
@@ -93,9 +93,20 @@ V8_OBJECT class CallSiteInfo : public StructLayout {
     kCount
   };
 
+  // Deferred flags: defined in the Torque bitfield, but only meaningful in
+  // raw capture arrays.  Stripped before creating actual CallSiteInfo objects.
+  static constexpr int kDeferredFlagsMask = kIsDeferredBaselineFrame;
+
   static DirectHandle<CallSiteInfo> ConstructFromRawData(
       Isolate* isolate, DirectHandle<FixedArray> frames, int index);
 
+  // Expand a raw stack-capture array that may contain deferred entries
+  // (optimized/baseline frames that were not Summarize'd at capture time)
+  // into a fully-resolved raw array where every entry corresponds to one
+  // logical JS frame.  Non-deferred entries are copied as-is.
+  static Handle<FixedArray> ExpandDeferredFrames(Isolate* isolate,
+                                                 Handle<FixedArray> raw_data);
+
   V8_EXPORT_PRIVATE static int GetLineNumber(DirectHandle<CallSiteInfo> info);
   V8_EXPORT_PRIVATE static int GetColumnNumber(DirectHandle<CallSiteInfo> info);
 
diff --git a/deps/v8/src/objects/call-site-info.tq b/deps/v8/src/objects/call-site-info.tq
index f9585b2324a3..3df40cee3b3c 100644
--- a/deps/v8/src/objects/call-site-info.tq
+++ b/deps/v8/src/objects/call-site-info.tq
@@ -14,6 +14,11 @@ bitfield struct CallSiteInfoFlags extends uint31 {
 
   // whether offset_or_source_position contains the source position.
   is_source_position_computed: bool: 1 bit;
+
+  // Only meaningful in raw capture arrays, stripped before creating
+  // CallSiteInfo objects.  Indicates the entry stores a Code + raw PC offset
+  // that needs resolution to a BytecodeArray + bytecode offset.
+  is_deferred_baseline_frame: bool: 1 bit;
 }
 
 @cppObjectLayoutDefinition

From a3f0041e8f2dcee09209cf62dbea97c46cfa91b3 Mon Sep 17 00:00:00 2001
From: Jakob Linke <jgruber@chromium.org>
Date: Mon, 13 Apr 2026 13:35:47 +0200
Subject: [PATCH 141/202] deps: V8: backport 1a0089053443

Original commit message:

    [stack traces] Fall back to full walk when receiver is unboxed

    The lightweight OptimizedJSFrame::Summarize path added in
    crrev.com/c/7722138 assumed that closure and receiver are always
    encoded as LITERAL or TAGGED_STACK_SLOT in the deopt translation.
    This holds for the closure (a JSFunction reference is always tagged)
    but not for the receiver: the "receiver" slot in an InterpretedFrame
    translation is just parameter 0 of the (possibly inlined) frame and
    is emitted via BuildDeoptFrameSingleValue, which encodes it according
    to the value's representation. An inlined frame whose `this` was
    typed as Float64 ends up as DOUBLE_STACK_SLOT, hitting UNREACHABLE in
    ResolveTaggedValue.

    Rename ResolveTaggedValue to TryResolveTaggedValue, return
    std::optional, and fall back to SummarizeFull when the receiver isn't
    a directly-resolvable tagged value.

    Fixed: 499260582
    Change-Id: I1f9cdd28e4b6b76a253a46e43b248d9239a4ecd8
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7748309
    Auto-Submit: Jakob Linke <jgruber@chromium.org>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Jakob Linke <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106423}

Refs: https://github.com/v8/v8/commit/1a0089053443ae4001fd15b84f1b46f330a0b3fa
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 common.gypi                                   |  2 +-
 deps/v8/src/deoptimizer/translated-state.cc   |  8 ++++--
 deps/v8/src/deoptimizer/translated-state.h    |  6 +++--
 deps/v8/src/execution/frames.cc               | 25 +++++++++++++------
 .../test/mjsunit/regress/regress-499260582.js | 20 +++++++++++++++
 5 files changed, 48 insertions(+), 13 deletions(-)
 create mode 100644 deps/v8/test/mjsunit/regress/regress-499260582.js

diff --git a/common.gypi b/common.gypi
index ffb06d54ffed..ce602beccf66 100644
--- a/common.gypi
+++ b/common.gypi
@@ -43,7 +43,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.31',
+    'v8_embedder_string': '-node.32',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/deoptimizer/translated-state.cc b/deps/v8/src/deoptimizer/translated-state.cc
index 06a9136e13fa..6aa94999ac28 100644
--- a/deps/v8/src/deoptimizer/translated-state.cc
+++ b/deps/v8/src/deoptimizer/translated-state.cc
@@ -1890,7 +1890,7 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
 }
 
 // static
-Tagged<Object> TranslatedState::ResolveTaggedValue(
+std::optional<Tagged<Object>> TranslatedState::TryResolveTaggedValue(
     DeoptTranslationIterator* it, Address fp,
     Tagged<DeoptimizationLiteralArray> literals) {
   TranslationOpcode opcode = it->NextOpcode();
@@ -1906,7 +1906,11 @@ Tagged<Object> TranslatedState::ResolveTaggedValue(
       return Tagged<Object>(DecompressIfNeeded(value));
     }
     default:
-      UNREACHABLE();
+      // Any other encoding (unboxed numerics, register-resident values,
+      // captured objects, etc.) requires the full TranslatedState path to
+      // materialize. Caller should fall back.
+      it->SkipOperands(TranslationOpcodeOperandCount(opcode));
+      return std::nullopt;
   }
 }
 
diff --git a/deps/v8/src/deoptimizer/translated-state.h b/deps/v8/src/deoptimizer/translated-state.h
index 5029b2b74222..07daaf4be395 100644
--- a/deps/v8/src/deoptimizer/translated-state.h
+++ b/deps/v8/src/deoptimizer/translated-state.h
@@ -513,8 +513,10 @@ class TranslatedState {
 
   // Resolves one deopt translation value opcode to a raw Tagged<Object>,
   // reading from the live frame if needed.  Only LITERAL and
-  // TAGGED_STACK_SLOT are expected; other opcodes are UNREACHABLE.
-  static Tagged<Object> ResolveTaggedValue(
+  // TAGGED_STACK_SLOT can be resolved cheaply; for any other opcode the
+  // iterator is left positioned just past the opcode and std::nullopt is
+  // returned so the caller can fall back to the full materialization path.
+  static std::optional<Tagged<Object>> TryResolveTaggedValue(
       DeoptTranslationIterator* it, Address fp,
       Tagged<DeoptimizationLiteralArray> literals);
 
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index be13c1d682af..f587dd49e36d 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -3233,13 +3233,22 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
       // Skip remaining header operands to reach the values.
       it.SkipOperands(TranslationOpcodeOperandCount(opcode) - 2);
 
-      // Resolve closure and receiver from the live frame.  Both are always
-      // encoded as LITERAL or TAGGED_STACK_SLOT in the deopt translation.
-      Tagged<Object> function_obj =
-          TranslatedState::ResolveTaggedValue(&it, fp(), literal_array);
-      DCHECK(IsJSFunction(function_obj));
-      Tagged<Object> receiver_obj =
-          TranslatedState::ResolveTaggedValue(&it, fp(), literal_array);
+      // Resolve closure and receiver from the live frame.  The closure is
+      // always tagged (LITERAL or TAGGED_STACK_SLOT), but the receiver is
+      // just parameter 0 of the (possibly inlined) frame and may be encoded
+      // in any representation the optimizer chose (e.g. DOUBLE_STACK_SLOT
+      // for an unboxed Float64). Fall back to the full materialization path
+      // in that case.
+      std::optional<Tagged<Object>> function_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      DCHECK(function_obj.has_value());
+      DCHECK(IsJSFunction(*function_obj));
+      std::optional<Tagged<Object>> receiver_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      if (!receiver_obj.has_value()) {
+        needs_full_walk = true;
+        break;
+      }
 
       Tagged<AbstractCode> abstract_code;
       int code_offset;
@@ -3255,7 +3264,7 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
 
       DirectHandle<FixedArray> params = GetParameters(never_allocate);
       FrameSummary::JavaScriptFrameSummary summary(
-          isolate(), receiver_obj, Cast<JSFunction>(function_obj),
+          isolate(), *receiver_obj, Cast<JSFunction>(*function_obj),
           abstract_code, code_offset, is_constructor, *params);
       summaries.frames.push_back(summary);
       is_constructor = false;
diff --git a/deps/v8/test/mjsunit/regress/regress-499260582.js b/deps/v8/test/mjsunit/regress/regress-499260582.js
new file mode 100644
index 000000000000..08e4a2daf9b1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-499260582.js
@@ -0,0 +1,20 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --jit-fuzzing --single-threaded
+
+function f9(a10, a11) {
+    'use strict';
+    for (let v12 = 0; v12 < 5; v12++) {
+        const v15 = ({ maxByteLength: 1073741824 }).maxByteLength;
+        %OptimizeOsr();
+        function F16(a18, a19, a20) {
+            if (!new.target) { throw 'must be called with new'; }
+        }
+        try { F16.call(v15); } catch (e) {}
+    }
+    return f9;
+}
+%PrepareFunctionForOptimization(f9);
+f9(f9, f9);

From 9f7ae86d8b57e16ec0384af0be29fb6a768c2ab7 Mon Sep 17 00:00:00 2001
From: Y1D7NG <y1d7ng@yeah.net>
Date: Mon, 7 Sep 2026 20:35:04 +0800
Subject: [PATCH 142/202] stream: destroy source when map iterator closes early
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://github.com/nodejs/node/issues/64261
Signed-off-by: y1d7ng <y1d7ng@yeah.net>
PR-URL: https://github.com/nodejs/node/pull/64264
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 lib/internal/streams/operators.js             |  2 ++
 test/parallel/test-stream-some-find-every.mjs | 32 ++++++++++++++++++-
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/lib/internal/streams/operators.js b/lib/internal/streams/operators.js
index 6db2df0e3646..a5cbe1af428f 100644
--- a/lib/internal/streams/operators.js
+++ b/lib/internal/streams/operators.js
@@ -29,6 +29,7 @@ const {
   validateFunction,
 } = require('internal/validators');
 const { kWeakHandler, kResistStopPropagation } = require('internal/event_target');
+const destroyImpl = require('internal/streams/destroy');
 const { finished } = require('internal/streams/end-of-stream');
 
 const kEmpty = Symbol('kEmpty');
@@ -177,6 +178,7 @@ function map(fn, options) {
         resume();
         resume = null;
       }
+      destroyImpl.destroyer(stream, null);
     }
   }.call(this);
 }
diff --git a/test/parallel/test-stream-some-find-every.mjs b/test/parallel/test-stream-some-find-every.mjs
index 0617102bc471..c18e418ddce5 100644
--- a/test/parallel/test-stream-some-find-every.mjs
+++ b/test/parallel/test-stream-some-find-every.mjs
@@ -1,6 +1,6 @@
 import * as common from '../common/index.mjs';
 import { setTimeout } from 'timers/promises';
-import { Readable } from 'stream';
+import { PassThrough, Readable } from 'stream';
 import assert from 'assert';
 
 
@@ -77,6 +77,36 @@ function oneTo5Async() {
     await findStream.find(common.mustCall((x) => x > 1, 2));
     await checkDestroyed(findStream);
 
+    const openSomeStream = new PassThrough({ objectMode: true });
+    openSomeStream.write(1);
+    openSomeStream.write(2);
+    openSomeStream.write(3);
+    assert.strictEqual(
+      await openSomeStream.some(common.mustCall((x) => x > 2, 3)),
+      true,
+    );
+    await checkDestroyed(openSomeStream);
+
+    const openEveryStream = new PassThrough({ objectMode: true });
+    openEveryStream.write(1);
+    openEveryStream.write(2);
+    openEveryStream.write(3);
+    assert.strictEqual(
+      await openEveryStream.every(common.mustCall((x) => x < 3, 3)),
+      false,
+    );
+    await checkDestroyed(openEveryStream);
+
+    const openFindStream = new PassThrough({ objectMode: true });
+    openFindStream.write(1);
+    openFindStream.write(2);
+    openFindStream.write(3);
+    assert.strictEqual(
+      await openFindStream.find(common.mustCall((x) => x > 1, 2)),
+      2,
+    );
+    await checkDestroyed(openFindStream);
+
     // When short circuit isn't possible the whole stream is iterated
     await oneTo5().some(common.mustCall(() => false, 5));
     await oneTo5().every(common.mustCall(() => true, 5));

From 073e85d772e8abb255dc58930025250226a2c4d1 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 18 Aug 2026 15:16:36 +0200
Subject: [PATCH 143/202] build: add `--shared-perfetto` flag

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65614
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 .github/workflows/test-shared.yml |  2 ++
 Makefile                          |  1 +
 configure.py                      | 33 +++++++++++++++++++++++++++++++
 node.gyp                          | 13 ++++++++----
 shell.nix                         |  4 ++++
 tools/nix/sharedLibDeps.nix       |  4 ++++
 tools/nix/v8.nix                  |  7 ++++---
 tools/v8_gypfiles/v8.gyp          | 26 +++++++++++++++---------
 8 files changed, 74 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 96e862c35916..f7483103016f 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -29,6 +29,7 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
@@ -84,6 +85,7 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
diff --git a/Makefile b/Makefile
index a354f55ab28e..afa55b2da33e 100644
--- a/Makefile
+++ b/Makefile
@@ -1319,6 +1319,7 @@ ifeq ($(SKIP_SHARED_DEPS), 1)
 	$(RM) -r $(TARNAME)/deps/ngtcp2
 	find $(TARNAME)/deps/openssl -maxdepth 1 -type f ! -name 'nodejs-openssl.cnf' -exec $(RM) {} +
 	find $(TARNAME)/deps/openssl -mindepth 1 -maxdepth 1 -type d -exec $(RM) -r {} +
+	$(RM) -r $(TARNAME)/deps/perfetto
 	$(RM) -r $(TARNAME)/deps/simdjson
 	$(RM) -r $(TARNAME)/deps/sqlite
 	$(RM) -r $(TARNAME)/deps/uv
diff --git a/configure.py b/configure.py
index 6e229e8c36d9..84a688917efe 100755
--- a/configure.py
+++ b/configure.py
@@ -546,6 +546,29 @@
     dest='shared_openssl_libpath',
     help='a directory to search for the shared OpenSSL DLLs')
 
+shared_optgroup.add_argument('--shared-perfetto',
+    action='store_true',
+    dest='shared_perfetto',
+    default=None,
+    help='link to a shared perfetto SDK instead of the one in deps/perfetto '
+         '(requires --with-perfetto)')
+
+shared_optgroup.add_argument('--shared-perfetto-includes',
+    action='store',
+    dest='shared_perfetto_includes',
+    help='directory containing perfetto header files')
+
+shared_optgroup.add_argument('--shared-perfetto-libname',
+    action='store',
+    dest='shared_perfetto_libname',
+    default='perfetto',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-perfetto-libpath',
+    action='store',
+    dest='shared_perfetto_libpath',
+    help='a directory to search for the shared perfetto DLL')
+
 shared_optgroup.add_argument('--shared-uvwasi',
     action='store_true',
     dest='shared_uvwasi',
@@ -2366,6 +2389,15 @@ def configure_lief(o):
 
   configure_library('lief', o, pkgname='LIEF')
 
+def configure_perfetto(o):
+  if not options.with_perfetto:
+    if options.shared_perfetto:
+      error('--shared-perfetto requires --with-perfetto')
+    o['variables']['node_shared_perfetto'] = b(False)
+    return
+
+  configure_library('perfetto', o)
+
 def configure_sqlite(o):
   o['variables']['node_use_sqlite'] = b(not options.without_sqlite)
   if options.without_sqlite:
@@ -2941,6 +2973,7 @@ def make_bin_override():
 configure_library('nghttp3', output, pkgname='libnghttp3')
 configure_library('ngtcp2', output, pkgname='libngtcp2')
 configure_lief(output);
+configure_perfetto(output);
 configure_sqlite(output);
 configure_ffi(output);
 configure_library('temporal_capi', output)
diff --git a/node.gyp b/node.gyp
index 7e1e4f212cad..52f421f3181c 100644
--- a/node.gyp
+++ b/node.gyp
@@ -28,6 +28,7 @@
     'node_shared_nbytes%': 'false',
     'node_shared_nghttp2%': 'false',
     'node_shared_openssl%': 'false',
+    'node_shared_perfetto%': 'false',
     'node_shared_sqlite%': 'false',
     'node_shared_ffi%': 'false',
     'node_shared_temporal_capi%': 'false',
@@ -942,8 +943,12 @@
           'sources': [
             '<@(node_tracing_perfetto_sources)',
           ],
-          'dependencies': [
-            'deps/perfetto/perfetto.gyp:perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                'deps/perfetto/perfetto.gyp:perfetto_sdk',
+              ],
+            }],
           ],
         }, {
           'sources': [
@@ -1401,7 +1406,7 @@
         }, {
           'sources!': [ '<@(node_cctest_quic_sources)' ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
@@ -1731,7 +1736,7 @@
             'NODE_USE_NODE_CODE_CACHE=1',
           ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
diff --git a/shell.nix b/shell.nix
index 53abe6859d4a..1829c1efd21b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -29,6 +29,7 @@
         withSQLite
         withFFI
         withSSL
+        withPerfetto
         withTemporal
         ;
     }
@@ -52,6 +53,7 @@ let
   useSharedAda = builtins.hasAttr "ada" sharedLibDeps;
   useSharedOpenSSL = builtins.hasAttr "openssl" sharedLibDeps;
 
+  useSharedPerfetto = builtins.hasAttr "perfetto" sharedLibDeps;
   useSharedTemporal = builtins.hasAttr "temporal_capi" sharedLibDeps;
   needsRustCompiler = withTemporal && !useSharedTemporal;
 
@@ -65,6 +67,7 @@ let
     pkgs.lib.optional useSharedICU icu
     ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) sharedLibDeps.abseil
     ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) sharedLibDeps.highway
+    ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) sharedLibDeps.perfetto
     ++ pkgs.lib.optional (withTemporal && useSharedTemporal) sharedLibDeps.temporal_capi;
 
   # Put here only the configure flags that affect the V8 build
@@ -79,6 +82,7 @@ let
   ]
   ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) "--shared-abseil"
   ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) "--shared-highway"
+  ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) "--shared-perfetto"
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index c28c56acc6b5..d57ceb4918bb 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -5,6 +5,7 @@
   withSQLite ? true,
   withSSL ? true,
   withFFI ? true,
+  withPerfetto ? false,
   withTemporal ? false,
 }:
 {
@@ -46,6 +47,9 @@
 // (pkgs.lib.optionalAttrs withSSL ({
   inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
 }))
+// (pkgs.lib.optionalAttrs withPerfetto {
+  perfetto = pkgs.perfetto.sdk;
+})
 // (pkgs.lib.optionalAttrs withTemporal {
   inherit (pkgs) temporal_capi;
 })
diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix
index 98df8b769c2a..3c3c3ab47347 100644
--- a/tools/nix/v8.nix
+++ b/tools/nix/v8.nix
@@ -47,9 +47,10 @@ let
       ]
       ++ lib.optional (!useSharedAbseil) ../../tools/v8_gypfiles/abseil.gyp
       ++ lib.optional (!useSharedHighway) ../../tools/v8_gypfiles/highway.gyp
-      ++ lib.optionals (builtins.elem "--with-perfetto" configureFlags) [
-        ../../deps/perfetto
-      ]
+      ++ lib.optional (
+        builtins.elem "--with-perfetto" configureFlags
+        && !(builtins.elem "--shared-perfetto" configureFlags)
+      ) ../../deps/perfetto
       ++ lib.optionals (icu != null) [
         ../../tools/icu/icu_versions.json
         ../../tools/icu/icu-system.gyp
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index c4738e206bd0..819dffb88984 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -295,7 +295,7 @@
         '<(V8_ROOT)/src/init/setup-isolate-full.cc',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -323,7 +323,7 @@
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_initializers.*?sources = ")',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -498,7 +498,7 @@
         },
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -998,7 +998,7 @@
         'v8_pch',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1139,8 +1139,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_base_without_compiler.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_snapshot_compression==1', {
@@ -1765,8 +1769,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_system_instrumentation==1 and is_win', {
@@ -1880,7 +1888,7 @@
         },
       },
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],

From 1d0e5f11dc47f8e4924b266c33cf8c712b5c5e6b Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 4 Sep 2026 16:17:33 +0200
Subject: [PATCH 144/202] tools: add GHA workflow to test vendored Perfetto

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65614
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 .github/workflows/test-linux-perfetto.yml | 70 +++++++++++++++++++++++
 .gitignore                                |  1 +
 2 files changed, 71 insertions(+)
 create mode 100644 .github/workflows/test-linux-perfetto.yml

diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml
new file mode 100644
index 000000000000..70a92202c1c7
--- /dev/null
+++ b/.github/workflows/test-linux-perfetto.yml
@@ -0,0 +1,70 @@
+name: Test Linux (with Perfetto)
+
+on:
+  workflow_dispatch:
+  pull_request:
+    # Only targeting paths specific to the vendored version of Perfetto, `test-shared`
+    # is taking care of rest of the coverage.
+    paths:
+      - .github/workflows/test-linux-perfetto.yml
+      - common.gypi
+      - configure.py
+      - deps/perfetto/**
+      - node.gyp
+      - node.gypi
+      - tools/v8_gypfiles/v8.gyp
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: '3.14'
+  FLAKY_TESTS: keep_retrying
+  CLANG_VERSION: '19'
+  CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
+  CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++-19
+  SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
+  SCCACHE_IDLE_TIMEOUT: '0'
+  RUSTC_VERSION: '1.86'
+
+permissions:
+  contents: read
+
+jobs:
+  test-perfetto:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+          path: node
+      - name: Install Clang ${{ env.CLANG_VERSION }}
+        uses: ./node/.github/actions/install-clang
+        with:
+          clang-version: ${{ env.CLANG_VERSION }}
+      - name: Install Rust ${{ env.RUSTC_VERSION }}
+        run: |
+          rustup override set "$RUSTC_VERSION"
+          rustup --version
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          allow-prereleases: true
+      - name: Set up sccache
+        if: github.base_ref == 'main' || github.ref_name == 'main'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
+        with:
+          version: v0.17.0
+      - name: Build
+        working-directory: node
+        run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --with-perfetto"
+      - name: Test
+        working-directory: node
+        run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"
+      - name: Ensure running tests did not cause any change in the tree
+        working-directory: node
+        run: git add -A && git diff --name-only --exit-code --staged
diff --git a/.gitignore b/.gitignore
index 2a7ce3337021..9277cdf090f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -121,6 +121,7 @@ tools/*/*.i.tmp
 /*.xml
 /v8*-tap.json
 /node_trace.*.log
+/node_trace.*.pftrace
 # coverage related
 /gcovr
 /build

From fe4a42b0e7658a5f12cc8e643def3be33fbacde6 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 7 Sep 2026 10:21:39 -0400
Subject: [PATCH 145/202] test: update WPT for WebCryptoAPI to 55ce71bb9d

PR-URL: https://github.com/nodejs/node/pull/65813
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 .../encap_decap_bits.tentative.https.any.js   |  35 +-
 .../encap_decap_keys.tentative.https.any.js   |  35 +-
 .../encap_decap/hybrid_kem_vectors.js         |  50 ++
 .../encap_decap/ml_kem_vectors.js             | 682 +-----------------
 .../generateKey/algorithm_registry.js         |   3 +
 ...failures_Hybrid-KEM.tentative.https.any.js |   6 +
 .../wpt/WebCryptoAPI/generateKey/successes.js |  35 +-
 ...uccesses_Hybrid-KEM.tentative.https.any.js |   7 +
 .../getPublicKey.tentative.https.any.js       |  23 +-
 ...ybrid-KEM_importKey.tentative.https.any.js |  11 +
 .../Hybrid-KEM_importKey_fixtures.js          |  56 ++
 .../ML-DSA_importKey_fixtures.js              |   6 +
 .../ML-KEM_importKey_fixtures.js              |   6 +
 .../import_export/ml_importKey.js             |   4 +-
 .../hybridkem.tentative.https.window.js       |  32 +
 .../supports-modern.tentative.https.any.js    |  18 +
 .../fixtures/wpt/WebCryptoAPI/util/helpers.js |   3 +
 test/fixtures/wpt/versions.json               |   2 +-
 test/wpt/status/WebCryptoAPI.cjs              |  29 +-
 19 files changed, 329 insertions(+), 714 deletions(-)
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js
 create mode 100644 test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js

diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
index ffb78f7e5348..c0afb698e0a2 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
@@ -1,13 +1,23 @@
-// META: title=WebCryptoAPI: ML-KEM encapsulateBits() and decapsulateBits() tests
-// META: script=ml_kem_vectors.js
+// META: title=WebCryptoAPI: KEM encapsulateBits() and decapsulateBits() tests
 // META: script=../util/helpers.js
+// META: script=ml_kem_vectors.js
+// META: script=hybrid_kem_vectors.js
 // META: timeout=long
 
 function define_bits_tests() {
   var subtle = self.crypto.subtle;
-  var variants = ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024'];
+  var variants = [
+    { name: 'ML-KEM-512', ciphertextLength: 768 },
+    { name: 'ML-KEM-768', ciphertextLength: 1088 },
+    { name: 'ML-KEM-1024', ciphertextLength: 1568 },
+    { name: 'MLKEM768-P256', ciphertextLength: 1153 },
+    { name: 'MLKEM768-X25519', ciphertextLength: 1120 },
+    { name: 'MLKEM1024-P384', ciphertextLength: 1665 },
+  ];
+
+  variants.forEach(function (variant) {
+    var algorithmName = variant.name;
 
-  variants.forEach(function (algorithmName) {
     // Test encapsulateBits operation
     promise_test(async function (test) {
       // Generate a key pair for testing
@@ -50,24 +60,11 @@ function define_bits_tests() {
         'Shared key should be 32 bytes'
       );
 
-      // Verify ciphertext length based on algorithm variant
-      var expectedCiphertextLength;
-      switch (algorithmName) {
-        case 'ML-KEM-512':
-          expectedCiphertextLength = 768;
-          break;
-        case 'ML-KEM-768':
-          expectedCiphertextLength = 1088;
-          break;
-        case 'ML-KEM-1024':
-          expectedCiphertextLength = 1568;
-          break;
-      }
       assert_equals(
         encapsulatedBits.ciphertext.byteLength,
-        expectedCiphertextLength,
+        variant.ciphertextLength,
         'Ciphertext should be ' +
-          expectedCiphertextLength +
+          variant.ciphertextLength +
           ' bytes for ' +
           algorithmName
       );
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
index a482eafbb610..e978fe497e63 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
@@ -1,11 +1,19 @@
-// META: title=WebCryptoAPI: ML-KEM encapsulateKey() and decapsulateKey() tests
-// META: script=ml_kem_vectors.js
+// META: title=WebCryptoAPI: KEM encapsulateKey() and decapsulateKey() tests
 // META: script=../util/helpers.js
+// META: script=ml_kem_vectors.js
+// META: script=hybrid_kem_vectors.js
 // META: timeout=long
 
 function define_key_tests() {
   var subtle = self.crypto.subtle;
-  var variants = ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024'];
+  var variants = [
+    { name: 'ML-KEM-512', ciphertextLength: 768 },
+    { name: 'ML-KEM-768', ciphertextLength: 1088 },
+    { name: 'ML-KEM-1024', ciphertextLength: 1568 },
+    { name: 'MLKEM768-P256', ciphertextLength: 1153 },
+    { name: 'MLKEM768-X25519', ciphertextLength: 1120 },
+    { name: 'MLKEM1024-P384', ciphertextLength: 1665 },
+  ];
 
   // Test various 256-bit shared key algorithms
   var sharedKeyConfigs = [
@@ -36,7 +44,9 @@ function define_key_tests() {
     },
   ];
 
-  variants.forEach(function (algorithmName) {
+  variants.forEach(function (variant) {
+    var algorithmName = variant.name;
+
     sharedKeyConfigs.forEach(function (config) {
       [true, false].forEach(function (extractable) {
         // Test encapsulateKey operation
@@ -115,24 +125,11 @@ function define_key_tests() {
             );
           }
 
-          // Verify ciphertext length based on algorithm variant
-          var expectedCiphertextLength;
-          switch (algorithmName) {
-            case 'ML-KEM-512':
-              expectedCiphertextLength = 768;
-              break;
-            case 'ML-KEM-768':
-              expectedCiphertextLength = 1088;
-              break;
-            case 'ML-KEM-1024':
-              expectedCiphertextLength = 1568;
-              break;
-          }
           assert_equals(
             encapsulatedKey.ciphertext.byteLength,
-            expectedCiphertextLength,
+            variant.ciphertextLength,
             'Ciphertext should be ' +
-              expectedCiphertextLength +
+              variant.ciphertextLength +
               ' bytes for ' +
               algorithmName
           );
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js
new file mode 100644
index 000000000000..751d192cbd42
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js
@@ -0,0 +1,50 @@
+// Test vectors from draft-irtf-cfrg-concrete-hybrid-kems-03, Appendix A.
+
+// MLKEM768-P256 test vectors
+ml_kem_vectors['MLKEM768-P256'] = {
+  publicKey: hexStringToUint8Array(
+    '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220d422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '0000000000000000000000000000000000000000000000000000000000000000'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4efca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35d4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e443f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe334e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6dad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c87e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f276356fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796bd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853fc4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498cfd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab376f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa66491ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd81319a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274aca2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad493c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e602877037de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc04428a824ea7cf56ad2a64ed368b71315d80cee846007cff1d2eea2c3f0f921537304ae598f98dd10d1f102811a4e2d161c3fd8bbb193d4b25bee950ac839c0f9d'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '9bd018e869bb01b63fb8f5da374a73d347ea14cb2bc570b13d0908e2288ec456'
+  ),
+};
+
+// MLKEM768-X25519 test vectors
+ml_kem_vectors['MLKEM768-X25519'] = {
+  publicKey: hexStringToUint8Array(
+    '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '0000000000000000000000000000000000000000000000000000000000000000'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4efca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35d4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e443f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe334e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6dad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c87e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f276356fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796bd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853fc4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498cfd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab376f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa66491ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd81319a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274aca2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad493c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e602877037de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc6b3d57762f8badb69433f9c6d060f85f5e5c6b6803a816d141c075f63541ad10'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    'e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a'
+  ),
+};
+
+// MLKEM1024-P384 test vectors
+ml_kem_vectors['MLKEM1024-P384'] = {
+  publicKey: hexStringToUint8Array(
+    'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d677d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c749c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b04d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e6853453b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e298c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cbaa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c5938258c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec06746749473e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed77cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865ab22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db657460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b510b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e78544887f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b388725758a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1adde369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a875d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a7372632ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a306e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e370941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da896133272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa702265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '0000000000000000000000000000000000000000000000000000000000000000'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'dc63d18bb9715fb6e3ba71cb439fcd3377a75305cc9b144e6758bf5794a272e6b4a0da33234c0ac1bb5b4e60e4c82eb1fb780d59e4e4616641a0595ba031e3ae69d971dcd5fff14e21731a8e1a221f46c7820d214630b707fa1b0de3a484698f3d49e0a75f1212b8c42d330dd909f15eac0402f19ee77fba9447e1c44304b0d8c371c17c5549fdbdec1e0a2e7be9f577d7a4b5b2618d9ba67ab95a0297cd5c5a13c89cc5a57cbd9a8ae38d66455c9a3d2bc55b498775fee2f6dc224d376d5f526a8354c8ed724f60337e900b85627972383e1fd987d407a8834005814a4fdc94c947e5f3471459288cfb127952b3208f10c914200bbaac5fcebd2bc9e2848492bab17b9288ca8b81d1c2ac9522dcc0b6d5f51e10f3afbb5d65fbf919edef6323c4e92c6b0690c10db25a9182de9e919ea1b3e65ae6150635d5180ebd7d23a2264828bc3ee1fd34dba1924ad0db30c747e05baa9148f1a032769c685e04665fd802a79c4624f69a9198a426eac1b217d903cdacf8844e73365f3a219a700dda27edf6bea33602617c5fd105b301b884bfaaa1163b791ec09f82523fef65c87b75ed063ceb127729b82c8712e1f41b547d095f55ee71f3f8b47a306cb5d9bdd817854c74a42eebf934a1136dea3fbc546ad8ce51b3171913722f08b0261d197590342bfe4108dcb08c62a98610cbfb8d3b2831f56dcac2220e29a5811f38f0824f21a6cbebc64fd89a09b110dffbe03799ffc74fe565c80dbf6a66acd7bfd14cb90acba03405a7982d4c1c68caa75f8b72e4dd6401d7dce4db4f6b820a7886a604b66b4e5b9eea5e5eddc2bca458a25977bd1f02874c5d9daf2baf56b3040f24ce7fe14cc14d61c7960db4decb37d9779c8e36d69a7763066d8c1149312d26887a693dc222daa892dd00cd8f3a558cf605e4c65c011c2e9f0d671ba10af2bb90ee0351ae5078eb7878399ec9eb4ace87a68269618bda12a7aed6fda0385496c5d10ac36b35255f4a31edfa8a2c516b65c63431013ed4909ec7a787a5efb9d3c3887b80ac18a44934b6559bd8a84b18e86fa1b0b9e1d9f92ba495ba5595d82e5095612b79e805154bf428a7071662c7cefb6450165c6f8f6954c37219bff4a49894a8aa37f940a40f4ec942c281e6c47ea408199927a724ff1c7460fc8fd47a98d0c9d4d1f07994d8084f6e084935ad7c2985282fabd5ca13b942e10d35278f4ff4cb1cb96f3c862410e79144a46b4db1a3c3d4d63018ec5c01ca48cb67081482e7d434b4abe5fa3071f2fbb533f745602b0da6183b28e6c5dfa42dab7ae0bbbf7638e106be1bd7312cba399e08c96dbd69a128a2face2d4a02951533a25e82fe63d0aaaa2e8c75150215c93ab06c22f9cab8d1cae7424f8baa09b3260ecfa3c7c8d55a276b4b317f72ec86b1b145a63aca83ef8c1204d8ab0c96ea3f742de39db47020616e139285814f188029ace4587f14cf12b5ed81086d8213cf8cb578341e04e16f519b77ff4c2644a5732639d658d0c4eaf992bd7dbd5011b700a5fa63dc1b24a84a3c80656bab5705dc3a74312c80e8bdb24a7ac6e27bcb8c07ece62c6e5777dd3dc0657181f440c7524d907dd27950bcb252aef7f8cbf453cee3fe3143a665072c787cea76de323aa41537df2f3a40a518a694b918953bde8d57084e32d3b1fdcf9d153e73f02624beaf6ebe23e6828a6a489583494f3cd790fc96bb6f5d8b198402965e2e668e6581e7cf1c8a47a92198388f2b4cd38df660f0ddd48ad126819c4435af3a12c89113d778ac544fd8079cb8aaa97d2ff1b608da574c4dcd87f4979390de3be405f0e47788dd0b01662805079fd73c64e9278c036544add3694c838bfcfb08c8a5efb09549442123eaa59fa30fbb9198105f6be00163bac076193f6721c539714108bbfae167f5db8085c5838618f32a968bbb25c40645a17c17b9bec64aea45832eec5adc25b53e677f67566fbf5ce2d9193a06bd9b477e601d589b25f422defc49105252cd9ca6adcbb36be8a01a8472b4d463f655be14ccff9b0571a2048e31c14b9b23e2d43fafa3f85ece6fd41896cc5c68993dbaa926f285ec94c72887de9564881d735c05f83aa474b3d4cd133a630ac63850771cb5270f6cb7a391170d66af3e4901b6eb0253f3f34ef57d6babd97aa99ce718c3bcb53ff13d4028a0c943bb9681106ce176242cccb75df1d3f8d3706e5b068b042c3154d5e6292581b36499e6b069b9a490aa67f0675390539da8555e6a4e8a35a86fdfea83e1387bf4acc650ec1edae7c99aa3a48306ee1d1a5e513c0c6901f64d0a3ee285de3c11d49f90cd4323dafda14832f0d8b760c0e5a48633c967cfaf'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '8c028c6ea72a1c59408e2b15dd8fed8008517e861cd2329b159bda1919ea656c'
+  ),
+};
+
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js
index 3e04fda6a3b3..a3cd8a2a749e 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js
@@ -2,658 +2,48 @@ var ml_kem_vectors = {};
 
 // ML-KEM-512 test vectors
 ml_kem_vectors['ML-KEM-512'] = {
-  // 800-byte publicKey
-  publicKey: new Uint8Array([
-    0xce, 0xcb, 0x75, 0x1f, 0x32, 0x67, 0x09, 0xb4, 0x9e, 0x14, 0xca, 0xa4,
-    0xbe, 0x30, 0x95, 0xee, 0xe9, 0x85, 0x58, 0x86, 0x2b, 0x83, 0xb9, 0x33,
-    0x56, 0x86, 0x4e, 0xad, 0x05, 0xcb, 0x38, 0x26, 0x95, 0x4c, 0xdb, 0xb2,
-    0x1d, 0xc4, 0x52, 0x44, 0x60, 0x36, 0xdd, 0x77, 0x82, 0x30, 0x09, 0x4f,
-    0xe3, 0xb8, 0x14, 0xc7, 0x99, 0x8f, 0x94, 0x45, 0x82, 0xd3, 0x89, 0xcc,
-    0xc7, 0x38, 0x97, 0x4e, 0x39, 0x49, 0x6d, 0xb5, 0x34, 0xd4, 0xdb, 0x78,
-    0x4b, 0x65, 0x44, 0x6e, 0xa9, 0xbc, 0x59, 0xe8, 0x96, 0xa3, 0x39, 0xbe,
-    0x6c, 0x13, 0x46, 0x3a, 0xb7, 0x4a, 0xe2, 0x02, 0x8a, 0x12, 0x69, 0x5c,
-    0x5b, 0x12, 0xc1, 0xc9, 0xd5, 0x70, 0x06, 0x58, 0x19, 0xf6, 0x82, 0x3b,
-    0x53, 0x3b, 0x29, 0xbb, 0xc8, 0x93, 0x8b, 0xc0, 0xaa, 0x74, 0x52, 0x77,
-    0xe7, 0x33, 0x57, 0xd9, 0x52, 0x5c, 0xec, 0x0c, 0xaf, 0xe1, 0xf0, 0x8a,
-    0x1b, 0x9b, 0x11, 0xa2, 0xf8, 0xaa, 0xc1, 0xf5, 0xab, 0xb2, 0xa6, 0xb4,
-    0x5f, 0x10, 0x95, 0x69, 0xb2, 0x0c, 0xfe, 0xba, 0xaf, 0x32, 0xb4, 0x90,
-    0x64, 0x4c, 0x18, 0x84, 0xd7, 0x7f, 0xe3, 0x88, 0xa1, 0x20, 0xb0, 0x85,
-    0x14, 0xc9, 0x6e, 0xeb, 0xb3, 0xbc, 0x0c, 0xd9, 0x77, 0x06, 0x76, 0x9f,
-    0x70, 0xf0, 0x48, 0x47, 0x09, 0x8a, 0xbf, 0x62, 0x82, 0xac, 0x00, 0x2f,
-    0xa0, 0x15, 0x84, 0xab, 0x96, 0x76, 0x0b, 0xdc, 0x46, 0x57, 0x09, 0x3b,
-    0xb6, 0x97, 0x9e, 0x0a, 0xf8, 0x54, 0x0b, 0xb7, 0x20, 0x72, 0x2a, 0x6c,
-    0xbb, 0xb8, 0x48, 0x1f, 0xd0, 0x36, 0xf5, 0xd3, 0x64, 0xc5, 0x64, 0xc9,
-    0x6f, 0x4a, 0xa6, 0xbe, 0xb2, 0x40, 0x86, 0xb3, 0xb1, 0x04, 0xe0, 0xaf,
-    0x59, 0x10, 0x63, 0x8b, 0x66, 0x7d, 0x7d, 0x29, 0xb3, 0x2e, 0x93, 0xad,
-    0xdb, 0xa0, 0x54, 0x37, 0x82, 0x38, 0x58, 0xf7, 0xcf, 0xc6, 0x9a, 0xcd,
-    0xaa, 0x94, 0xba, 0x74, 0x90, 0x29, 0x73, 0xb8, 0x8a, 0x9b, 0x08, 0xce,
-    0x2f, 0xb1, 0x09, 0xb2, 0xa1, 0x6d, 0x31, 0xf1, 0x0d, 0x8b, 0xb4, 0x52,
-    0xa0, 0x89, 0x96, 0xb9, 0x54, 0x78, 0x49, 0x90, 0x8a, 0x61, 0xba, 0x0d,
-    0x92, 0xf3, 0x6f, 0x46, 0x7a, 0xa5, 0x22, 0x4c, 0xb9, 0x2c, 0xaa, 0x17,
-    0xab, 0xc9, 0x37, 0x84, 0x2a, 0x4f, 0xac, 0xf6, 0x4a, 0xf4, 0xe2, 0x81,
-    0x12, 0x78, 0x49, 0x6d, 0xac, 0xa6, 0xe1, 0xa9, 0x89, 0x8a, 0x5c, 0x02,
-    0x8e, 0xa4, 0x6a, 0x64, 0xe5, 0x67, 0x84, 0xc5, 0xbe, 0x7e, 0xf9, 0x39,
-    0x60, 0xa9, 0x10, 0xd7, 0x01, 0x1e, 0x03, 0xb1, 0x7c, 0xaf, 0x42, 0xce,
-    0x3e, 0xc2, 0x13, 0x75, 0x96, 0x93, 0x32, 0x0b, 0x2c, 0x96, 0xb2, 0x2a,
-    0xef, 0x80, 0x10, 0xa3, 0x82, 0x5d, 0x60, 0xbc, 0xc0, 0xe9, 0x15, 0x1a,
-    0x0f, 0xa4, 0x3d, 0xf1, 0x0c, 0xa3, 0xa3, 0xcc, 0x6b, 0x6d, 0x6b, 0xb6,
-    0xa2, 0xf6, 0x03, 0x5f, 0xe3, 0xc0, 0x23, 0x62, 0xae, 0x07, 0xe5, 0xa9,
-    0x79, 0x28, 0x69, 0x24, 0xd0, 0x5a, 0x54, 0xc5, 0x13, 0x7b, 0x46, 0xb3,
-    0x99, 0x85, 0x74, 0xa7, 0x3c, 0xc0, 0x09, 0x87, 0x5d, 0xd5, 0x66, 0xbe,
-    0xae, 0x6b, 0x4d, 0x47, 0xa2, 0x79, 0xf5, 0x85, 0xaf, 0x8e, 0xc5, 0x7c,
-    0xfc, 0xa2, 0x81, 0x16, 0xa9, 0x54, 0x03, 0xfa, 0x6e, 0x49, 0xe7, 0xa4,
-    0x11, 0x16, 0x89, 0xf2, 0x34, 0x0f, 0xe9, 0x08, 0x8e, 0x07, 0x43, 0xa2,
-    0x6e, 0x06, 0xbc, 0x6c, 0x54, 0xb0, 0x12, 0x61, 0x76, 0x69, 0x05, 0xcf,
-    0xb2, 0x78, 0x5e, 0xf5, 0xd5, 0xc9, 0x86, 0xec, 0xc9, 0xd7, 0x4c, 0x66,
-    0xef, 0xec, 0x57, 0x69, 0xa9, 0x2c, 0x8a, 0x03, 0x48, 0x90, 0x30, 0x0f,
-    0x2b, 0x7c, 0x7d, 0x20, 0xa8, 0x0f, 0xfb, 0x73, 0x1c, 0xe4, 0x19, 0x2c,
-    0xec, 0x02, 0x1a, 0xd9, 0xb9, 0xac, 0x25, 0xdc, 0x99, 0x46, 0x00, 0x4c,
-    0xcd, 0xcc, 0xa5, 0xf4, 0xb2, 0x95, 0x81, 0xf2, 0x7e, 0xb3, 0xe7, 0x24,
-    0x50, 0x4a, 0xc3, 0x6e, 0x95, 0xae, 0xb7, 0xbc, 0x49, 0xc6, 0x5a, 0x78,
-    0x3a, 0xb8, 0xc2, 0xd1, 0x69, 0xcc, 0xc0, 0x11, 0x3b, 0x18, 0x26, 0x30,
-    0x7e, 0x51, 0xb3, 0xc5, 0x73, 0x07, 0xa6, 0x8a, 0xc3, 0xe6, 0x18, 0xba,
-    0x22, 0x39, 0x28, 0xd6, 0x33, 0x61, 0x51, 0x28, 0x92, 0xbf, 0x93, 0xb1,
-    0x52, 0x68, 0xae, 0x54, 0xea, 0xc4, 0x4f, 0x62, 0x1d, 0x82, 0x94, 0x39,
-    0xe2, 0x98, 0x7c, 0x1b, 0xea, 0x13, 0x26, 0x92, 0x6a, 0xb1, 0x1c, 0x59,
-    0x11, 0x47, 0x7c, 0x7b, 0xeb, 0x28, 0x2a, 0xe8, 0x81, 0x0b, 0x55, 0x14,
-    0x53, 0x80, 0x28, 0xb8, 0x58, 0x8b, 0x1c, 0xa5, 0x91, 0x4e, 0x55, 0x9e,
-    0x68, 0x32, 0x5d, 0x5f, 0x94, 0x87, 0x83, 0x73, 0x3f, 0xfc, 0x8b, 0xb4,
-    0x8c, 0xd9, 0x52, 0xf8, 0x74, 0x5f, 0x76, 0xc2, 0x63, 0x9a, 0x87, 0x54,
-    0x10, 0x47, 0x1e, 0x83, 0x82, 0x31, 0x6d, 0x22, 0x26, 0x16, 0x32, 0xb1,
-    0xa1, 0x78, 0x09, 0xd5, 0x8b, 0xbb, 0x75, 0xd7, 0x8b, 0xa2, 0x99, 0xcf,
-    0xde, 0x2a, 0x73, 0x0f, 0x80, 0x91, 0xdc, 0x44, 0xb8, 0xaa, 0x73, 0x69,
-    0x55, 0xfa, 0x23, 0xb8, 0x16, 0xb1, 0xd7, 0x78, 0x4d, 0x97, 0xab, 0xcb,
-    0x0c, 0xf4, 0xcb, 0xb7, 0xc8, 0x36, 0x4e, 0xf1, 0x2a, 0x82, 0xb0, 0x09,
-    0x10, 0x3c, 0x8f, 0x7a, 0x76, 0xc6, 0xac, 0x08, 0x6a, 0xe1, 0x0a, 0x3e,
-    0x6b, 0x06, 0x39, 0xcb, 0x35, 0xce, 0x10, 0xc3, 0x1f, 0xaa, 0xaa, 0x26,
-    0xfc, 0x22, 0xb9, 0xd5, 0x12, 0xcc, 0xa8, 0x48, 0x0a, 0x61, 0xac, 0x3a,
-    0xa1, 0x87, 0xbf, 0xea, 0x79, 0x11, 0x7d, 0xfb, 0xc4, 0xfe, 0x0b, 0x4f,
-    0x94, 0x57, 0xd8, 0x7b, 0xa4, 0x91, 0x4e, 0xe5, 0x5a, 0x4b, 0xaa, 0x94,
-    0x6e, 0x91, 0x55, 0xe9, 0x9b, 0xae, 0xac, 0xe9, 0x52, 0x2c, 0xc6, 0x4b,
-    0xee, 0x7b, 0xd7, 0xfa, 0x45, 0xeb, 0x2f, 0x6b,
-  ]),
-  // 64-byte privateSeed
-  privateSeed: new Uint8Array([
-    0x3e, 0x42, 0x62, 0xca, 0xd1, 0x44, 0x02, 0x6d, 0xe9, 0xbd, 0x35, 0xbf,
-    0x20, 0x3f, 0xfb, 0x40, 0x26, 0x3c, 0x8c, 0x76, 0x5d, 0x05, 0xd2, 0xa4,
-    0xd0, 0x0a, 0x8a, 0xe9, 0x25, 0x07, 0xd2, 0xd2, 0xc5, 0x60, 0xb8, 0x43,
-    0x5a, 0x05, 0x4d, 0x81, 0x6e, 0x5f, 0x25, 0x35, 0xa3, 0xdf, 0x91, 0x83,
-    0x3c, 0xca, 0xd2, 0x63, 0xe5, 0x8e, 0x3c, 0x34, 0x55, 0x5c, 0xd8, 0xc5,
-    0x73, 0x25, 0xad, 0x9d,
-  ]),
-  // 768-byte sampleCiphertext
-  sampleCiphertext: new Uint8Array([
-    0x0e, 0x48, 0x87, 0x58, 0xdc, 0xd4, 0x55, 0x52, 0x56, 0x5b, 0xec, 0xe5,
-    0xb8, 0xbd, 0xa4, 0x52, 0x35, 0x44, 0xde, 0x14, 0xee, 0xd1, 0x3f, 0xec,
-    0x29, 0xcf, 0x92, 0x60, 0x16, 0x15, 0x89, 0x13, 0x14, 0x32, 0x24, 0xdb,
-    0x55, 0x5a, 0x2d, 0x6d, 0x42, 0xc2, 0xce, 0x30, 0xf6, 0x3b, 0x72, 0x34,
-    0xb8, 0x25, 0xab, 0x11, 0xb6, 0xb1, 0x0b, 0xba, 0xc1, 0x98, 0x35, 0xc2,
-    0x3c, 0xac, 0x07, 0xe3, 0xb3, 0x7f, 0xed, 0x08, 0xa1, 0xeb, 0x88, 0x61,
-    0x99, 0xee, 0x2d, 0xb9, 0x5e, 0x01, 0x35, 0xaf, 0x1c, 0x21, 0xd3, 0x75,
-    0xed, 0xd0, 0xc1, 0x34, 0x66, 0x17, 0xb6, 0x6c, 0xfc, 0xd9, 0xcd, 0xa8,
-    0x5a, 0x80, 0x28, 0xda, 0x74, 0x5d, 0x9d, 0x36, 0x53, 0xfc, 0x5b, 0x80,
-    0xc6, 0xd2, 0x9b, 0x4c, 0xd9, 0xb0, 0x2d, 0x6c, 0x5a, 0xc8, 0xe7, 0xc0,
-    0x27, 0xa7, 0x02, 0x58, 0x57, 0x31, 0x98, 0xbc, 0x72, 0x40, 0x4a, 0x31,
-    0xde, 0x1f, 0x44, 0x38, 0x54, 0xe7, 0xbe, 0xcb, 0x3b, 0xcf, 0x39, 0x0a,
-    0x6f, 0xe7, 0xc8, 0x6c, 0x3a, 0x0b, 0x14, 0x9e, 0x51, 0xa5, 0x10, 0x3b,
-    0x2d, 0xd8, 0x4b, 0x96, 0xd2, 0x0d, 0x1f, 0x3b, 0x1a, 0x53, 0x08, 0xdd,
-    0x94, 0x11, 0xfa, 0x87, 0x75, 0x4d, 0x7d, 0x85, 0x72, 0xad, 0x58, 0x36,
-    0x27, 0xdb, 0x9a, 0xa9, 0x8d, 0x2f, 0xe0, 0x9b, 0x6f, 0xdd, 0xca, 0x3c,
-    0xa8, 0xf9, 0x4e, 0x64, 0x3b, 0x56, 0xd9, 0x2b, 0xab, 0xaf, 0x10, 0x5e,
-    0x52, 0xba, 0x70, 0x82, 0xe3, 0x34, 0xf7, 0xb8, 0xe4, 0x86, 0x6f, 0x45,
-    0xf4, 0x15, 0xa1, 0xd4, 0x69, 0x01, 0xba, 0x93, 0x2c, 0x29, 0x8d, 0xcd,
-    0xb0, 0xe9, 0x64, 0xd1, 0x8a, 0x0b, 0x72, 0x5a, 0xd0, 0x58, 0xc2, 0xd5,
-    0xea, 0x72, 0x13, 0xff, 0x7f, 0x44, 0xaf, 0xea, 0xcf, 0x1b, 0x6a, 0x10,
-    0x29, 0xfd, 0x93, 0xce, 0x50, 0xa6, 0xb3, 0x4b, 0xf5, 0x1e, 0x83, 0x23,
-    0xc7, 0xda, 0x58, 0x60, 0x06, 0xd3, 0xc1, 0xf7, 0x8c, 0x98, 0xca, 0x79,
-    0xcc, 0xbc, 0xff, 0x1c, 0x14, 0xa0, 0x30, 0x94, 0x96, 0xbf, 0xb4, 0xf4,
-    0xbc, 0x24, 0x40, 0x2a, 0x47, 0x91, 0x2f, 0x98, 0x00, 0x5d, 0xef, 0xbc,
-    0x08, 0x2b, 0x96, 0xc2, 0x06, 0xdc, 0xa0, 0x2c, 0x93, 0x27, 0xd7, 0xa4,
-    0x16, 0x6b, 0x9c, 0xcf, 0xea, 0x2c, 0x45, 0x32, 0x6a, 0x98, 0xa1, 0xab,
-    0x84, 0xdc, 0xac, 0x0e, 0xa3, 0x5a, 0x2b, 0x1a, 0x2c, 0x40, 0x1b, 0x91,
-    0x1c, 0xdf, 0x27, 0x65, 0x23, 0x38, 0xe7, 0x4b, 0xea, 0xfa, 0xb4, 0xd9,
-    0x45, 0xc3, 0xf1, 0x3c, 0xa2, 0x96, 0x50, 0x7c, 0x87, 0xf7, 0x3e, 0x34,
-    0x8b, 0xb4, 0x43, 0xb7, 0xfa, 0x7e, 0xc0, 0x5f, 0xa0, 0xe3, 0x5b, 0x9f,
-    0x19, 0x1e, 0xc8, 0xba, 0xde, 0x96, 0x60, 0x92, 0x74, 0x8c, 0xda, 0x72,
-    0x9e, 0x25, 0xa4, 0xcf, 0x8d, 0x9f, 0x8f, 0xc0, 0x6d, 0xaf, 0x4a, 0x60,
-    0xf3, 0xb9, 0x85, 0x30, 0x28, 0x2e, 0xab, 0xbf, 0x57, 0x67, 0x4d, 0x34,
-    0xf9, 0x6c, 0xf5, 0x37, 0x63, 0x96, 0x95, 0x35, 0x78, 0x25, 0x11, 0x1e,
-    0x0c, 0xa9, 0xaf, 0xc0, 0x4a, 0x78, 0x9d, 0xf2, 0x83, 0xb1, 0x25, 0xd9,
-    0xf9, 0xf1, 0xb5, 0x59, 0x27, 0xc9, 0x3b, 0xd4, 0x8e, 0x1b, 0xcc, 0x62,
-    0xf3, 0x6e, 0x76, 0x28, 0xea, 0x8b, 0xdd, 0xf4, 0x48, 0xae, 0x0c, 0xe2,
-    0x98, 0x44, 0x2f, 0x1a, 0x8c, 0x8d, 0x31, 0xdc, 0x23, 0xb9, 0x68, 0x32,
-    0x60, 0x3c, 0xf2, 0x03, 0x6f, 0xba, 0xe9, 0x6f, 0xc0, 0xfb, 0xd2, 0x57,
-    0x0a, 0xa5, 0xd6, 0x51, 0x7c, 0xc3, 0x52, 0xdd, 0xdf, 0xa9, 0x44, 0x52,
-    0x4a, 0x4c, 0xa6, 0xc5, 0xc7, 0x6d, 0xb9, 0x8c, 0xc7, 0x96, 0xc8, 0xf9,
-    0xcf, 0xe3, 0x92, 0x74, 0x8c, 0xb3, 0xb2, 0x2e, 0xaf, 0x58, 0x43, 0x45,
-    0x77, 0x29, 0xa7, 0xb6, 0xa8, 0x01, 0xca, 0x0c, 0xa9, 0xb4, 0x65, 0x6a,
-    0xbc, 0x9d, 0xf0, 0x91, 0x1a, 0x3d, 0x1a, 0x11, 0xc8, 0x5b, 0xe1, 0xf4,
-    0x13, 0x60, 0xe8, 0x5a, 0x47, 0xe7, 0x66, 0xdc, 0xd9, 0x9c, 0xd0, 0xa3,
-    0x5f, 0x1f, 0xa6, 0xc0, 0x94, 0x58, 0x05, 0xc8, 0x46, 0xd2, 0xa0, 0x86,
-    0x55, 0x36, 0x34, 0x01, 0xae, 0x98, 0x86, 0xd4, 0x26, 0xc3, 0xa1, 0x5a,
-    0xef, 0xd0, 0x98, 0x4d, 0x5a, 0x12, 0x8c, 0x03, 0x18, 0xf1, 0x81, 0x8d,
-    0x73, 0x4f, 0x62, 0x4b, 0xc6, 0xe7, 0x3a, 0x5d, 0x42, 0xf8, 0x13, 0x29,
-    0x76, 0x4c, 0x3b, 0x51, 0x86, 0xe7, 0xd6, 0x87, 0x2e, 0x9e, 0x3e, 0x22,
-    0xde, 0x4f, 0xae, 0xf9, 0x6a, 0xe1, 0xa7, 0x72, 0xfa, 0x1e, 0x8f, 0xc1,
-    0x95, 0xe8, 0x60, 0x1d, 0xd5, 0x46, 0x8a, 0xcb, 0x80, 0x61, 0x9c, 0x65,
-    0x8e, 0x06, 0xe7, 0x89, 0xfa, 0xb5, 0xfd, 0x68, 0x8f, 0x8c, 0x08, 0xc3,
-    0x6a, 0xc8, 0x84, 0x13, 0x52, 0x32, 0xce, 0x83, 0x2e, 0x68, 0xa0, 0xc1,
-    0x5f, 0x01, 0x65, 0xb8, 0x4c, 0x38, 0x82, 0xaf, 0xac, 0x0b, 0xbe, 0x4e,
-    0xef, 0x7a, 0x42, 0xde, 0x92, 0x17, 0x4a, 0xf0, 0xf6, 0x85, 0xfe, 0x47,
-    0xba, 0xf2, 0xbc, 0x79, 0x7c, 0xed, 0x19, 0xdf, 0x18, 0x08, 0x72, 0x8a,
-    0xce, 0x57, 0x86, 0xcf, 0xc5, 0x54, 0x17, 0x19, 0xab, 0x0c, 0xeb, 0xa5,
-    0x44, 0x33, 0x5c, 0x1f, 0x02, 0xec, 0x8b, 0x80, 0xdd, 0xe7, 0x50, 0x74,
-    0x97, 0x43, 0xa8, 0xa3, 0xb9, 0x1a, 0x8e, 0x1d, 0x21, 0x97, 0x95, 0x6c,
-    0x96, 0xa0, 0x2d, 0xc5, 0x1b, 0xad, 0xed, 0x9d, 0x88, 0x46, 0x89, 0x9d,
-    0xbd, 0x4a, 0xc5, 0x57, 0xa7, 0x4c, 0x4e, 0x78, 0x43, 0xa4, 0xc3, 0x43,
-    0x11, 0x32, 0xde, 0xaf, 0xa3, 0xf4, 0x18, 0xd7, 0xc3, 0x9d, 0x52, 0x76,
-  ]),
-  // 32-byte expectedSharedSecret
-  expectedSharedSecret: new Uint8Array([
-    0x6b, 0x15, 0xad, 0xd5, 0xb3, 0x66, 0xb2, 0x2c, 0x66, 0x8a, 0x1d, 0x81,
-    0x90, 0x1d, 0x2e, 0xe2, 0x11, 0x33, 0x03, 0xb6, 0xaf, 0xa8, 0x2e, 0xaf,
-    0x67, 0x64, 0xdb, 0xea, 0xd7, 0x66, 0xb8, 0xfc,
-  ]),
+  publicKey: hexStringToUint8Array(
+    'cecb751f326709b49e14caa4be3095eee98558862b83b93356864ead05cb3826954cdbb21dc452446036dd778230094fe3b814c7998f944582d389ccc738974e39496db534d4db784b65446ea9bc59e896a339be6c13463ab74ae2028a12695c5b12c1c9d570065819f6823b533b29bbc8938bc0aa745277e73357d9525cec0cafe1f08a1b9b11a2f8aac1f5abb2a6b45f109569b20cfebaaf32b490644c1884d77fe388a120b08514c96eebb3bc0cd97706769f70f04847098abf6282ac002fa01584ab96760bdc4657093bb6979e0af8540bb720722a6cbbb8481fd036f5d364c564c96f4aa6beb24086b3b104e0af5910638b667d7d29b32e93addba05437823858f7cfc69acdaa94ba74902973b88a9b08ce2fb109b2a16d31f10d8bb452a08996b9547849908a61ba0d92f36f467aa5224cb92caa17abc937842a4facf64af4e2811278496daca6e1a9898a5c028ea46a64e56784c5be7ef93960a910d7011e03b17caf42ce3ec213759693320b2c96b22aef8010a3825d60bcc0e9151a0fa43df10ca3a3cc6b6d6bb6a2f6035fe3c02362ae07e5a979286924d05a54c5137b46b3998574a73cc009875dd566beae6b4d47a279f585af8ec57cfca28116a95403fa6e49e7a4111689f2340fe9088e0743a26e06bc6c54b01261766905cfb2785ef5d5c986ecc9d74c66efec5769a92c8a034890300f2b7c7d20a80ffb731ce4192cec021ad9b9ac25dc9946004ccdcca5f4b29581f27eb3e724504ac36e95aeb7bc49c65a783ab8c2d169ccc0113b1826307e51b3c57307a68ac3e618ba223928d63361512892bf93b15268ae54eac44f621d829439e2987c1bea1326926ab11c5911477c7beb282ae8810b5514538028b8588b1ca5914e559e68325d5f948783733ffc8bb48cd952f8745f76c2639a875410471e8382316d22261632b1a17809d58bbb75d78ba299cfde2a730f8091dc44b8aa736955fa23b816b1d7784d97abcb0cf4cbb7c8364ef12a82b009103c8f7a76c6ac086ae10a3e6b0639cb35ce10c31faaaa26fc22b9d512cca8480a61ac3aa187bfea79117dfbc4fe0b4f9457d87ba4914ee55a4baa946e9155e99baeace9522cc64bee7bd7fa45eb2f6b'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '3e4262cad144026de9bd35bf203ffb40263c8c765d05d2a4d00a8ae92507d2d2c560b8435a054d816e5f2535a3df91833ccad263e58e3c34555cd8c57325ad9d'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    '0e488758dcd45552565bece5b8bda4523544de14eed13fec29cf926016158913143224db555a2d6d42c2ce30f63b7234b825ab11b6b10bbac19835c23cac07e3b37fed08a1eb886199ee2db95e0135af1c21d375edd0c1346617b66cfcd9cda85a8028da745d9d3653fc5b80c6d29b4cd9b02d6c5ac8e7c027a70258573198bc72404a31de1f443854e7becb3bcf390a6fe7c86c3a0b149e51a5103b2dd84b96d20d1f3b1a5308dd9411fa87754d7d8572ad583627db9aa98d2fe09b6fddca3ca8f94e643b56d92babaf105e52ba7082e334f7b8e4866f45f415a1d46901ba932c298dcdb0e964d18a0b725ad058c2d5ea7213ff7f44afeacf1b6a1029fd93ce50a6b34bf51e8323c7da586006d3c1f78c98ca79ccbcff1c14a0309496bfb4f4bc24402a47912f98005defbc082b96c206dca02c9327d7a4166b9ccfea2c45326a98a1ab84dcac0ea35a2b1a2c401b911cdf27652338e74beafab4d945c3f13ca296507c87f73e348bb443b7fa7ec05fa0e35b9f191ec8bade966092748cda729e25a4cf8d9f8fc06daf4a60f3b98530282eabbf57674d34f96cf537639695357825111e0ca9afc04a789df283b125d9f9f1b55927c93bd48e1bcc62f36e7628ea8bddf448ae0ce298442f1a8c8d31dc23b96832603cf2036fbae96fc0fbd2570aa5d6517cc352dddfa944524a4ca6c5c76db98cc796c8f9cfe392748cb3b22eaf5843457729a7b6a801ca0ca9b4656abc9df0911a3d1a11c85be1f41360e85a47e766dcd99cd0a35f1fa6c0945805c846d2a08655363401ae9886d426c3a15aefd0984d5a128c0318f1818d734f624bc6e73a5d42f81329764c3b5186e7d6872e9e3e22de4faef96ae1a772fa1e8fc195e8601dd5468acb80619c658e06e789fab5fd688f8c08c36ac884135232ce832e68a0c15f0165b84c3882afac0bbe4eef7a42de92174af0f685fe47baf2bc797ced19df1808728ace5786cfc5541719ab0ceba544335c1f02ec8b80dde750749743a8a3b91a8e1d2197956c96a02dc51baded9d8846899dbd4ac557a74c4e7843a4c3431132deafa3f418d7c39d5276'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '6b15add5b366b22c668a1d81901d2ee2113303b6afa82eaf6764dbead766b8fc'
+  ),
 };
 
 // ML-KEM-768 test vectors
 ml_kem_vectors['ML-KEM-768'] = {
-  // 1184-byte publicKey
-  publicKey: new Uint8Array([
-    0x0f, 0x61, 0x02, 0x18, 0x60, 0x7b, 0xac, 0x16, 0x36, 0xd1, 0x2a, 0x24,
-    0x50, 0x79, 0x65, 0xbc, 0x4b, 0x6f, 0x39, 0x75, 0x69, 0x9e, 0x24, 0xba,
-    0x48, 0x9a, 0xb0, 0x0e, 0xb8, 0xbb, 0x94, 0xc4, 0x16, 0xe0, 0x9b, 0x5b,
-    0x3c, 0x22, 0x05, 0xda, 0x71, 0xa4, 0x0a, 0xf3, 0x8b, 0x10, 0x95, 0xb9,
-    0x98, 0xb7, 0x34, 0x46, 0x2a, 0x0c, 0xdf, 0x33, 0x7b, 0xe7, 0x85, 0x25,
-    0xfb, 0xd9, 0x84, 0x54, 0x7a, 0x98, 0x1e, 0x11, 0x9a, 0x10, 0xa1, 0x9b,
-    0xb6, 0x22, 0x21, 0xf7, 0x17, 0x60, 0xf4, 0x71, 0x1b, 0x3d, 0x88, 0x31,
-    0x7e, 0xf7, 0x83, 0x84, 0xd5, 0x20, 0x28, 0xa9, 0x49, 0x77, 0xa7, 0x59,
-    0x96, 0x10, 0xb3, 0x4b, 0xc3, 0x39, 0x4b, 0x90, 0x9c, 0xcc, 0x3a, 0xbf,
-    0x62, 0xfb, 0xc2, 0xcc, 0x66, 0xae, 0xc6, 0x17, 0xcd, 0xc9, 0x09, 0x17,
-    0xc1, 0x80, 0xba, 0x14, 0x81, 0x68, 0x64, 0xf5, 0x41, 0xc4, 0x3a, 0x1f,
-    0x29, 0x98, 0x77, 0xfa, 0x28, 0x4a, 0xca, 0x65, 0x5b, 0xd5, 0xa7, 0xb5,
-    0xda, 0x3b, 0x77, 0xe4, 0x86, 0x96, 0xbf, 0xf7, 0x25, 0x25, 0x10, 0x59,
-    0x34, 0x26, 0x9f, 0xef, 0x4c, 0x0b, 0xb4, 0x83, 0xce, 0x3d, 0x8c, 0x12,
-    0x6f, 0xa4, 0xc0, 0xe4, 0x4a, 0x18, 0x1f, 0x97, 0x31, 0xbe, 0x18, 0x39,
-    0xad, 0x08, 0x95, 0xe2, 0x7b, 0x1b, 0xf2, 0xe5, 0x89, 0xf3, 0x08, 0x60,
-    0x6c, 0x50, 0xc5, 0x2d, 0x2c, 0x0c, 0x15, 0x78, 0x58, 0x88, 0x65, 0x5e,
-    0x72, 0x18, 0x25, 0xd1, 0xa4, 0xb5, 0x25, 0x65, 0x51, 0x85, 0x59, 0xc3,
-    0xf2, 0xa7, 0xb4, 0xb5, 0x86, 0x18, 0xe6, 0xe6, 0x91, 0x49, 0xb0, 0x29,
-    0x62, 0x21, 0x73, 0x96, 0x89, 0x7e, 0xb7, 0x42, 0x12, 0xb1, 0x07, 0x0d,
-    0x9f, 0xb0, 0x9d, 0x0c, 0xf3, 0x93, 0x75, 0x08, 0x9b, 0xf3, 0x25, 0x1e,
-    0xf9, 0x92, 0xb2, 0x55, 0xb1, 0x5b, 0x83, 0xc9, 0xb4, 0x75, 0x15, 0x1b,
-    0x93, 0x22, 0x83, 0xfc, 0xd9, 0x43, 0xee, 0x7a, 0x2e, 0x7c, 0xb2, 0x48,
-    0xdf, 0xb8, 0x32, 0x5d, 0xc0, 0xc7, 0x0d, 0x55, 0x71, 0x31, 0xcc, 0x69,
-    0x66, 0x46, 0xa2, 0x31, 0x75, 0x5b, 0xe2, 0x0a, 0x9c, 0xee, 0x44, 0x15,
-    0xde, 0x08, 0x5d, 0xf3, 0xa4, 0x16, 0x65, 0x56, 0x0a, 0x59, 0xc1, 0x5a,
-    0x95, 0x60, 0x87, 0x96, 0x96, 0xc0, 0xbb, 0x34, 0x4a, 0x27, 0x87, 0x91,
-    0x6c, 0xb7, 0x77, 0x3a, 0xf0, 0x5c, 0x65, 0xbb, 0x79, 0xcd, 0xf9, 0x24,
-    0x75, 0x1b, 0xcb, 0x4d, 0x8a, 0x20, 0xae, 0x59, 0xa6, 0x09, 0xc1, 0x58,
-    0xb1, 0x41, 0x9c, 0x83, 0x64, 0x9a, 0x74, 0xe1, 0x7e, 0x69, 0x76, 0x5a,
-    0xd4, 0xf5, 0x28, 0xac, 0x66, 0xc9, 0x81, 0x19, 0xc6, 0x20, 0xa3, 0x18,
-    0xc8, 0x17, 0x98, 0x14, 0xc2, 0x57, 0x58, 0x43, 0x2a, 0x5c, 0xb6, 0x73,
-    0x4e, 0x31, 0xa0, 0x2a, 0xa9, 0xc8, 0xba, 0x14, 0x88, 0xa1, 0x1a, 0x9c,
-    0xf3, 0x69, 0x29, 0xe2, 0x12, 0x8d, 0xb8, 0x76, 0x6d, 0x95, 0xb2, 0xab,
-    0x22, 0xb1, 0x15, 0x5a, 0x22, 0x53, 0xe4, 0x27, 0x7d, 0xc7, 0x80, 0xb0,
-    0x10, 0xe5, 0x9a, 0x42, 0xea, 0x95, 0xc6, 0xa9, 0xa0, 0xd6, 0xf9, 0x45,
-    0xd5, 0x73, 0x45, 0xe5, 0x55, 0xc9, 0xf3, 0x39, 0x80, 0x8a, 0xe0, 0x0a,
-    0xa5, 0x47, 0x5e, 0xc6, 0xc4, 0x52, 0x6b, 0xb0, 0x10, 0xfc, 0xac, 0x24,
-    0x47, 0x5a, 0x21, 0x8a, 0x75, 0x8e, 0x62, 0xf9, 0x20, 0x56, 0x77, 0x11,
-    0xc0, 0x38, 0x19, 0x6c, 0xd0, 0x37, 0xab, 0xb5, 0x7a, 0xd1, 0x32, 0xad,
-    0x62, 0x2a, 0x2e, 0x3e, 0x39, 0x61, 0x7c, 0xf3, 0x66, 0xa3, 0x98, 0x56,
-    0x4f, 0x31, 0xad, 0xb5, 0x40, 0x5f, 0xf6, 0xa9, 0x20, 0xc5, 0x32, 0x6e,
-    0xc7, 0x26, 0xa3, 0x97, 0xfc, 0x11, 0xcf, 0x79, 0x25, 0x9e, 0x48, 0x62,
-    0xe6, 0xd3, 0x39, 0x48, 0x29, 0x9e, 0x55, 0xf5, 0x68, 0x93, 0xea, 0xcd,
-    0x10, 0xdc, 0x9f, 0x89, 0x98, 0x47, 0xac, 0x12, 0x7c, 0xb8, 0xb5, 0x52,
-    0x7c, 0xaa, 0x9e, 0x8c, 0xf4, 0xaf, 0x1b, 0xf5, 0xc5, 0x06, 0x01, 0x4c,
-    0x76, 0x05, 0x8b, 0x1e, 0xd1, 0x0f, 0xa0, 0xf6, 0x09, 0xb7, 0x78, 0xaa,
-    0x26, 0xca, 0xcc, 0x3b, 0xb0, 0x3e, 0x04, 0xb4, 0x9e, 0x99, 0xfa, 0x7a,
-    0xc0, 0x33, 0x0e, 0xf2, 0x92, 0x55, 0x38, 0x80, 0x4e, 0xbc, 0x24, 0x53,
-    0x00, 0x03, 0xcf, 0x08, 0x17, 0x3a, 0x4b, 0x5a, 0x78, 0x7b, 0xcb, 0x3b,
-    0xb0, 0x6b, 0x6b, 0x7d, 0xe1, 0x7a, 0x7a, 0xd7, 0x4b, 0xc3, 0x12, 0x5b,
-    0x9f, 0xa0, 0xcb, 0x46, 0x55, 0x0c, 0xfd, 0xc9, 0xa9, 0xa8, 0x40, 0x0a,
-    0x8f, 0xe5, 0x1f, 0x9f, 0x39, 0xa2, 0x8a, 0xa2, 0xa7, 0x52, 0xc1, 0x61,
-    0x19, 0xf9, 0x25, 0xe4, 0xdb, 0x6a, 0x4a, 0x37, 0xb2, 0x6e, 0x85, 0xc7,
-    0x80, 0x22, 0xb8, 0x95, 0x2b, 0x30, 0x59, 0x98, 0x33, 0xbf, 0x18, 0x96,
-    0xba, 0x1a, 0x16, 0xfd, 0xb7, 0x1e, 0x4a, 0x30, 0x31, 0x05, 0x85, 0x00,
-    0xc8, 0x5a, 0x05, 0xfd, 0x36, 0xb9, 0x97, 0x41, 0xca, 0xc7, 0x90, 0x24,
-    0x3a, 0xf9, 0x4c, 0xfb, 0xe2, 0x5d, 0xec, 0x58, 0x08, 0xfa, 0x43, 0xcf,
-    0xc7, 0x92, 0xa9, 0xfc, 0xc1, 0xad, 0xf9, 0x62, 0x07, 0x98, 0x32, 0x89,
-    0x70, 0x49, 0xb9, 0x99, 0x9a, 0x71, 0x85, 0x72, 0x88, 0xa0, 0xea, 0x84,
-    0x23, 0xe1, 0x7e, 0x1d, 0x50, 0xc8, 0xa5, 0x6a, 0x97, 0xfb, 0xfc, 0x0c,
-    0xa4, 0x19, 0x5f, 0xc9, 0xd2, 0x0d, 0x6b, 0x7b, 0xbf, 0x62, 0x55, 0x91,
-    0xa6, 0x85, 0x8f, 0x75, 0xca, 0x79, 0x1b, 0x65, 0x57, 0x58, 0x5b, 0x4f,
-    0x23, 0x86, 0x8a, 0x38, 0x7a, 0xbd, 0x20, 0x08, 0x51, 0x1c, 0xbb, 0x4b,
-    0x68, 0x1c, 0x3f, 0x90, 0x49, 0x9c, 0x53, 0xc1, 0x6e, 0x8a, 0x35, 0x22,
-    0x49, 0x58, 0x48, 0xc5, 0x0a, 0x0e, 0x37, 0x92, 0x67, 0xd0, 0xb9, 0xbc,
-    0xce, 0x9b, 0x84, 0x6b, 0x34, 0x15, 0xbe, 0x0b, 0xa2, 0xa9, 0x52, 0xc3,
-    0x7d, 0xfc, 0x68, 0x10, 0xc4, 0x72, 0x6d, 0x01, 0x97, 0x4e, 0xba, 0x5d,
-    0x4c, 0x8a, 0xb5, 0x9a, 0x99, 0xb7, 0x5b, 0x7b, 0x9c, 0x6b, 0x86, 0x6d,
-    0xe4, 0xc3, 0x87, 0xed, 0x58, 0x4b, 0xf3, 0x91, 0xb7, 0x0c, 0xa8, 0x7a,
-    0x37, 0x47, 0x85, 0x44, 0x03, 0x2e, 0x00, 0xcb, 0xbf, 0xf4, 0xd7, 0x4a,
-    0x1b, 0x42, 0x99, 0x1e, 0x72, 0x9c, 0x8c, 0x4b, 0xcb, 0x98, 0x0a, 0x48,
-    0x7c, 0x55, 0x4b, 0xb7, 0x55, 0x6a, 0x24, 0x23, 0x83, 0xca, 0xb9, 0x36,
-    0x36, 0x63, 0x44, 0xe7, 0xe3, 0x3c, 0x8c, 0x91, 0x6d, 0x64, 0xb4, 0x6e,
-    0xc2, 0x99, 0x35, 0xbc, 0xa6, 0x5c, 0x8e, 0xda, 0x3f, 0x67, 0x55, 0x9e,
-    0xda, 0xda, 0x07, 0x30, 0x16, 0x44, 0xfb, 0xc4, 0x64, 0x3f, 0x9c, 0x2f,
-    0xea, 0x45, 0x19, 0x5d, 0x8c, 0x67, 0xce, 0x56, 0x87, 0xff, 0xd0, 0x64,
-    0xd2, 0x82, 0xca, 0x82, 0x3b, 0x44, 0x9f, 0x9b, 0x2e, 0xe5, 0x96, 0x29,
-    0x7f, 0xf6, 0xa3, 0x4d, 0x38, 0x54, 0xb5, 0x87, 0xc5, 0x96, 0xe3, 0xbc,
-    0x2f, 0x7c, 0x4e, 0x91, 0x33, 0x39, 0xbe, 0xc8, 0x54, 0x35, 0xb7, 0x83,
-    0x21, 0xb1, 0x23, 0xa8, 0x93, 0x56, 0x44, 0x41, 0xc5, 0x15, 0xa2, 0x80,
-    0x56, 0x31, 0x50, 0xd3, 0xf8, 0x0f, 0xfc, 0x68, 0x86, 0x74, 0x34, 0x61,
-    0x59, 0x46, 0x1d, 0x17, 0x6c, 0x77, 0xa4, 0xcc, 0xc0, 0x52, 0x73, 0x57,
-    0xc9, 0xd0, 0x0d, 0x17, 0x23, 0x73, 0x4e, 0x78, 0xb5, 0xb3, 0x74, 0xb2,
-    0xd8, 0x95, 0xb0, 0xe0, 0x8b, 0x33, 0xe9, 0x7b, 0x2d, 0x73, 0xa6, 0xb9,
-    0x94, 0xf9, 0x0e, 0x89, 0xbc, 0xab, 0xea, 0xc2, 0xbe, 0xe4, 0x98, 0xbb,
-    0x09, 0xc4, 0xbc, 0x03, 0xca, 0x2c, 0x8e, 0x00, 0xce, 0x99, 0xfa, 0x04,
-    0xfb, 0x04, 0x8d, 0x86, 0x4c, 0x3b, 0xb6, 0xe1, 0x23, 0x6e, 0x5c, 0xac,
-    0x3d, 0xe3, 0x04, 0x07, 0xc3, 0x28, 0x4b, 0x2c, 0x64, 0x3f, 0xe0, 0x2c,
-    0x6e, 0xfa, 0x02, 0x4d, 0x96, 0x40, 0x1f, 0x1b, 0xc4, 0x63, 0xe5, 0xbb,
-    0xd9, 0xc0, 0x8c, 0x81, 0x79, 0x2d, 0xba, 0xe5, 0x10, 0xf1, 0xb7, 0x27,
-    0xf3, 0xa1, 0xb5, 0x30, 0x40, 0x2b, 0x47, 0xc6, 0xb6, 0xdb, 0xd5, 0x14,
-    0x75, 0x79, 0x93, 0x8f, 0xa9, 0x72, 0xaf, 0xc4, 0x6e, 0x74, 0x26, 0x78,
-    0x2e, 0x26, 0xa9, 0xc8, 0xe2, 0xc5, 0x70, 0x45, 0x48, 0x2a, 0xdc, 0x10,
-    0x03, 0x17, 0x17, 0x3e, 0xe5, 0x1d, 0x03, 0xf3, 0x19, 0x7a, 0x10, 0x2c,
-    0x9f, 0xd7, 0xb6, 0x07, 0x35, 0x1b, 0x4a, 0xd5, 0xb6, 0xbd, 0xe4, 0x51,
-    0x13, 0xd6, 0x37, 0x33, 0x2a, 0x28, 0x8e, 0x4f, 0x6b, 0xb6, 0x7e, 0x44,
-    0x4c, 0x32, 0x3e, 0xe8, 0x21, 0x8b, 0x5c, 0x1d, 0x15, 0x99, 0xb5, 0x8d,
-    0xde, 0x35, 0x2f, 0xd6, 0xcd, 0x64, 0x7a, 0x52,
-  ]),
-  // 64-byte privateSeed
-  privateSeed: new Uint8Array([
-    0x46, 0x97, 0x3b, 0x12, 0xa0, 0x54, 0xa8, 0x9f, 0x47, 0xd5, 0x3a, 0xf5,
-    0x83, 0xad, 0x94, 0x67, 0x6b, 0xbe, 0x8a, 0xc1, 0x04, 0x6b, 0x07, 0x1d,
-    0x66, 0x6f, 0x55, 0x81, 0x3b, 0x68, 0x98, 0xaa, 0xaa, 0xcb, 0x55, 0x59,
-    0xd0, 0x07, 0xea, 0x68, 0x14, 0x68, 0x3b, 0x49, 0x9d, 0x8b, 0xe1, 0xa0,
-    0xf5, 0xbd, 0xf0, 0x52, 0x7a, 0xd9, 0xdf, 0xa8, 0x66, 0x90, 0x38, 0xfb,
-    0x33, 0xbe, 0x26, 0xc5,
-  ]),
-  // 1088-byte sampleCiphertext
-  sampleCiphertext: new Uint8Array([
-    0x1a, 0xd4, 0x01, 0xa3, 0xc4, 0x3e, 0x18, 0xa5, 0x80, 0x8d, 0x49, 0xbc,
-    0xfa, 0x19, 0x13, 0x2e, 0x0a, 0x3c, 0x0a, 0x55, 0x13, 0x79, 0x16, 0x9c,
-    0x07, 0x70, 0x37, 0x6a, 0x12, 0xd2, 0xdd, 0x49, 0x9e, 0xfb, 0xc8, 0x60,
-    0xe5, 0x06, 0x77, 0x07, 0xde, 0x7b, 0xe9, 0xb1, 0x64, 0x18, 0x5a, 0x46,
-    0x12, 0xdc, 0x88, 0xef, 0x8c, 0xc7, 0x55, 0xf2, 0x53, 0xfe, 0x90, 0x81,
-    0xb9, 0xfb, 0x25, 0x82, 0x7f, 0x2e, 0x31, 0x6a, 0x09, 0xae, 0x62, 0xeb,
-    0xf8, 0x5d, 0x97, 0x45, 0x46, 0x93, 0xfb, 0x22, 0x04, 0x22, 0xee, 0xc6,
-    0xd3, 0xa1, 0x78, 0x21, 0x84, 0x97, 0x7f, 0xce, 0xd1, 0x95, 0x1a, 0xd0,
-    0xa8, 0xb7, 0xea, 0xc8, 0x97, 0xf4, 0xe8, 0xe3, 0xbb, 0x7d, 0x15, 0xfd,
-    0x3f, 0x78, 0xed, 0x8d, 0x37, 0xea, 0xd1, 0xa5, 0x4e, 0xbf, 0xa2, 0x30,
-    0xaf, 0x95, 0xf3, 0x32, 0x6f, 0xbb, 0x05, 0x57, 0xbc, 0x55, 0x8a, 0x8b,
-    0x19, 0x50, 0xd9, 0xe5, 0x46, 0x3a, 0x4d, 0x2c, 0xea, 0xaa, 0x1f, 0x7a,
-    0x67, 0xf8, 0xd6, 0x25, 0xc9, 0x86, 0x40, 0xa8, 0x9e, 0xd4, 0xee, 0xc2,
-    0xe6, 0x3d, 0x34, 0xc0, 0x6d, 0x7b, 0x31, 0xff, 0xe8, 0x3f, 0x86, 0x1a,
-    0x3a, 0x7e, 0x50, 0xfe, 0x64, 0x4b, 0x6b, 0xc7, 0x2e, 0x78, 0xce, 0xb7,
-    0x73, 0x83, 0x1d, 0x1d, 0x90, 0x5f, 0x7a, 0x34, 0x08, 0xac, 0xb0, 0x73,
-    0xac, 0x81, 0xbf, 0x40, 0xed, 0x37, 0x66, 0xf2, 0x83, 0xa5, 0xbc, 0x07,
-    0xd2, 0x06, 0xa8, 0x26, 0x4a, 0xfd, 0xef, 0x77, 0x1a, 0xdc, 0xe3, 0x87,
-    0x8f, 0x8d, 0x1d, 0x34, 0x6f, 0x92, 0x92, 0xd6, 0xbb, 0xb8, 0xb9, 0xc6,
-    0xcb, 0x8e, 0x85, 0x7e, 0xd0, 0x47, 0x98, 0x52, 0x82, 0x89, 0x35, 0xbb,
-    0x68, 0xaa, 0x04, 0x69, 0x82, 0x84, 0x34, 0x06, 0x2a, 0xa5, 0xea, 0x49,
-    0x30, 0x7a, 0x80, 0xf1, 0x10, 0xff, 0xc1, 0x43, 0xac, 0x86, 0x44, 0xe5,
-    0xaa, 0x3a, 0x74, 0xe5, 0x85, 0x39, 0x86, 0xce, 0x97, 0xa2, 0xe6, 0x99,
-    0xad, 0xd9, 0xcb, 0x77, 0x53, 0xa1, 0x98, 0x3d, 0x08, 0xd2, 0x53, 0xfd,
-    0x5e, 0x25, 0xef, 0xc8, 0xd9, 0xf1, 0x10, 0xe2, 0xbb, 0xf8, 0x9b, 0x31,
-    0x95, 0x7f, 0xe0, 0xd3, 0xcd, 0xf5, 0xb1, 0xf6, 0x25, 0x6f, 0xf8, 0x8d,
-    0x7a, 0xa4, 0xec, 0xb6, 0xb5, 0xf9, 0x1d, 0x66, 0x20, 0xe2, 0xc8, 0x61,
-    0xdc, 0x87, 0x0a, 0x90, 0x38, 0x34, 0xb4, 0xf1, 0xb6, 0x08, 0xac, 0x90,
-    0x40, 0x43, 0xea, 0x5c, 0x5c, 0x0a, 0x1f, 0x8e, 0xc4, 0x4f, 0x91, 0xc5,
-    0x1c, 0x9a, 0x2e, 0x5f, 0xb8, 0x79, 0xd7, 0xdb, 0xfb, 0x9f, 0x94, 0x8c,
-    0x19, 0x17, 0xca, 0x60, 0x7c, 0xa1, 0x03, 0xa1, 0xbf, 0xea, 0xcc, 0xfa,
-    0xd2, 0xef, 0x34, 0xa8, 0x79, 0x9f, 0x39, 0x26, 0x13, 0x04, 0xd6, 0x77,
-    0x29, 0x38, 0xb5, 0x82, 0xa2, 0xea, 0x94, 0x8a, 0x28, 0x39, 0xff, 0xb4,
-    0x3d, 0xc3, 0x15, 0xd0, 0xae, 0x31, 0x1f, 0x1e, 0x54, 0x29, 0x4c, 0xb6,
-    0xdb, 0xc1, 0xef, 0xa9, 0x04, 0xa6, 0x66, 0xb0, 0xa3, 0x81, 0xc8, 0xb5,
-    0x28, 0xd1, 0x0a, 0x56, 0x26, 0x41, 0xea, 0xd9, 0x52, 0x93, 0xb7, 0x4e,
-    0xcc, 0x78, 0xc2, 0xe6, 0x4a, 0xf9, 0x8b, 0xa6, 0x38, 0x82, 0x78, 0xb5,
-    0x09, 0x1e, 0xf2, 0x9f, 0x8b, 0x50, 0x6e, 0x7e, 0xa4, 0xe2, 0xb8, 0x59,
-    0x1c, 0xca, 0x61, 0x45, 0x20, 0x5e, 0xfc, 0x91, 0xf9, 0xde, 0x7e, 0x28,
-    0x60, 0xd7, 0xe2, 0x89, 0x3c, 0x88, 0x88, 0x07, 0xbe, 0x0b, 0x76, 0x5a,
-    0x12, 0xa8, 0x56, 0x3c, 0xe0, 0x4f, 0xcb, 0x99, 0xd6, 0x85, 0x10, 0x31,
-    0x2f, 0x77, 0x4f, 0xcc, 0xcd, 0x4c, 0x5d, 0x0f, 0x87, 0x64, 0xcf, 0xb9,
-    0xff, 0xff, 0xfd, 0x67, 0xb2, 0xdc, 0x3f, 0xf5, 0xb4, 0xb4, 0x7d, 0xa0,
-    0x66, 0x54, 0x09, 0xd3, 0xdc, 0x4e, 0xc4, 0xda, 0x3e, 0x36, 0xb9, 0x91,
-    0xf9, 0xf3, 0xea, 0x2c, 0xc0, 0x1e, 0x34, 0x7d, 0x69, 0x25, 0x6f, 0xf7,
-    0x05, 0x7b, 0x20, 0x1f, 0x3e, 0x04, 0x34, 0x3b, 0x2b, 0xc8, 0x1e, 0x67,
-    0x00, 0x9e, 0xa6, 0x59, 0xc1, 0x20, 0xe0, 0xc6, 0x06, 0xed, 0x2a, 0xeb,
-    0xe8, 0xa6, 0x71, 0x96, 0x48, 0x1e, 0xf3, 0xc5, 0x30, 0x1b, 0xc1, 0x73,
-    0xa3, 0x3c, 0x61, 0xed, 0x93, 0x19, 0x16, 0xd2, 0x1a, 0x0e, 0x6d, 0x9a,
-    0xe7, 0x39, 0x81, 0xdd, 0x3e, 0xb2, 0xa3, 0x3b, 0x33, 0xa8, 0x4e, 0xce,
-    0xbf, 0xbe, 0x42, 0x24, 0x9f, 0x54, 0xa3, 0xd8, 0x17, 0x03, 0x8e, 0xc6,
-    0xc6, 0x0e, 0x89, 0x98, 0xdc, 0x9e, 0xbd, 0x17, 0xb9, 0x68, 0x87, 0xbd,
-    0x3c, 0x69, 0xc7, 0xb4, 0x54, 0x7f, 0x40, 0x2f, 0x24, 0x98, 0x1f, 0x52,
-    0x93, 0xe0, 0xce, 0x5e, 0x77, 0x07, 0xaa, 0xf3, 0x33, 0xb9, 0xbd, 0x98,
-    0x21, 0x95, 0xaf, 0xff, 0xab, 0x10, 0xa8, 0x0d, 0x53, 0xa9, 0xec, 0xca,
-    0x12, 0x95, 0x79, 0xd5, 0xf5, 0xfd, 0xdd, 0x6d, 0xc5, 0x24, 0x56, 0x40,
-    0xf8, 0x3c, 0xf3, 0xbf, 0x9a, 0xe7, 0xf8, 0x39, 0x45, 0x5a, 0x14, 0xae,
-    0xaf, 0xfc, 0x2a, 0x17, 0x7d, 0x7a, 0x5e, 0x93, 0x11, 0x0f, 0x74, 0xf9,
-    0xea, 0x27, 0xed, 0x22, 0x4d, 0xf2, 0x58, 0x68, 0x17, 0x53, 0x68, 0x3a,
-    0xe1, 0x75, 0x5a, 0xe4, 0xa8, 0xd6, 0x16, 0xfb, 0xae, 0x8c, 0xc6, 0x86,
-    0xea, 0x06, 0xa3, 0x1b, 0x39, 0xdf, 0x7a, 0x56, 0x37, 0x35, 0x83, 0x9a,
-    0xad, 0xc4, 0xac, 0x05, 0xf7, 0xf4, 0xb9, 0xed, 0xc6, 0xb1, 0x73, 0x57,
-    0x6f, 0xdc, 0xc7, 0xce, 0x30, 0x72, 0xdc, 0xed, 0x29, 0xde, 0xe8, 0x35,
-    0x59, 0x66, 0xdb, 0x7d, 0x25, 0xbb, 0x2f, 0x61, 0x3e, 0xa6, 0xe3, 0x2a,
-    0x7c, 0x51, 0x3c, 0xc2, 0x47, 0x4b, 0x71, 0xb3, 0xdb, 0x7d, 0x5f, 0x8a,
-    0x64, 0xc6, 0x6f, 0x7c, 0xbe, 0xad, 0xf3, 0x41, 0x7d, 0x7b, 0x7f, 0x60,
-    0xf2, 0x7e, 0x23, 0x56, 0x6a, 0xdb, 0x11, 0xda, 0x10, 0xc7, 0x04, 0x9c,
-    0xe1, 0x29, 0xfe, 0x55, 0xa6, 0x5a, 0xd1, 0x6f, 0x60, 0xdf, 0xec, 0xaa,
-    0x1f, 0xaa, 0x05, 0x36, 0xc5, 0x4f, 0x66, 0xa3, 0xa0, 0xe4, 0x1e, 0x04,
-    0x00, 0x10, 0xc2, 0x8b, 0x2c, 0xe6, 0xc5, 0xe5, 0xc9, 0xc0, 0x93, 0x59,
-    0x9b, 0x1b, 0xcb, 0x0d, 0xdd, 0x4d, 0x23, 0xef, 0x4a, 0x6a, 0x49, 0x13,
-    0x6a, 0x31, 0xd7, 0x69, 0xec, 0xd1, 0x4c, 0xa4, 0xdd, 0x83, 0xe6, 0x6d,
-    0x90, 0xa9, 0x3a, 0xc1, 0x01, 0x94, 0x88, 0x75, 0xb7, 0x84, 0xa3, 0x94,
-    0x0b, 0x02, 0x4e, 0x3f, 0x8c, 0xe2, 0xd0, 0x45, 0x42, 0xfe, 0x67, 0x14,
-    0xcb, 0xf0, 0x05, 0x39, 0xf6, 0x50, 0x00, 0x5b, 0xa5, 0x8e, 0xba, 0x04,
-    0x37, 0x7e, 0x37, 0x34, 0xbf, 0xe9, 0xff, 0x99, 0xb6, 0xca, 0xbf, 0xa0,
-    0x87, 0x43, 0x36, 0x9e, 0x48, 0x47, 0xe3, 0xb1, 0x54, 0x45, 0x25, 0x1a,
-    0x94, 0xb6, 0x42, 0x70, 0xf6, 0x18, 0xa5, 0x96, 0xce, 0x94, 0xe2, 0x2c,
-    0x1f, 0x71, 0xe4, 0x0f, 0xd1, 0x97, 0x65, 0x49, 0x8b, 0xc2, 0x1c, 0x9a,
-    0x59, 0xab, 0x7e, 0xb7, 0x7c, 0xae, 0xe8, 0x1e, 0xaf, 0xed, 0x0d, 0xe8,
-    0xd5, 0x42, 0x4e, 0xe3, 0xce, 0xff, 0x86, 0x0e, 0xab, 0xb3, 0xb1, 0x38,
-    0x1f, 0xa5, 0x28, 0x76, 0x42, 0xec, 0x50, 0xea, 0x9e, 0xe9, 0x57, 0x8a,
-    0x8b, 0x7a, 0xbc, 0x00, 0xeb, 0x18, 0x7b, 0x15, 0x8c, 0x75, 0x66, 0x9c,
-    0x17, 0x5d, 0x50, 0xe3, 0x00, 0xa4, 0xe0, 0x0b, 0xae, 0x5a, 0x53, 0x33,
-    0xa7, 0x59, 0x33, 0x93, 0x86, 0x01, 0x18, 0x3f, 0x8a, 0x69, 0xbf, 0x54,
-    0x7d, 0x5b, 0xe4, 0x9b, 0x7f, 0xae, 0xa3, 0x91, 0xbd, 0x2a, 0x4f, 0x5c,
-    0xab, 0x05, 0x76, 0x42, 0x20, 0x5b, 0x55, 0x43, 0x7f, 0x99, 0xcc, 0x81,
-    0x14, 0xcc, 0x21, 0xba, 0x9e, 0x9f, 0x16, 0xe8, 0x84, 0x4c, 0xf9, 0xda,
-    0xd5, 0x39, 0x31, 0x40, 0x9c, 0xf4, 0xef, 0x6c, 0x6e, 0x65, 0xe7, 0x7f,
-    0x21, 0xee, 0x2b, 0x3e, 0x70, 0x92, 0x71, 0x29, 0xa4, 0xb5, 0xd7, 0x80,
-    0x44, 0xea, 0x70, 0x31, 0x26, 0x4b, 0xce, 0x6a,
-  ]),
-  // 32-byte expectedSharedSecret
-  expectedSharedSecret: new Uint8Array([
-    0x53, 0x2e, 0x3b, 0x9a, 0xf0, 0x8e, 0x5f, 0x55, 0x28, 0x92, 0x9b, 0x76,
-    0x2f, 0xb6, 0xe4, 0xd3, 0x0b, 0x28, 0x86, 0xf0, 0x18, 0xf9, 0x70, 0x78,
-    0x41, 0x99, 0xf3, 0x15, 0xe3, 0xf5, 0xcf, 0xc3,
-  ]),
+  publicKey: hexStringToUint8Array(
+    '0f610218607bac1636d12a24507965bc4b6f3975699e24ba489ab00eb8bb94c416e09b5b3c2205da71a40af38b1095b998b734462a0cdf337be78525fbd984547a981e119a10a19bb62221f71760f4711b3d88317ef78384d52028a94977a7599610b34bc3394b909ccc3abf62fbc2cc66aec617cdc90917c180ba14816864f541c43a1f299877fa284aca655bd5a7b5da3b77e48696bff72525105934269fef4c0bb483ce3d8c126fa4c0e44a181f9731be1839ad0895e27b1bf2e589f308606c50c52d2c0c15785888655e721825d1a4b52565518559c3f2a7b4b58618e6e69149b02962217396897eb74212b1070d9fb09d0cf39375089bf3251ef992b255b15b83c9b475151b932283fcd943ee7a2e7cb248dfb8325dc0c70d557131cc696646a231755be20a9cee4415de085df3a41665560a59c15a9560879696c0bb344a2787916cb7773af05c65bb79cdf924751bcb4d8a20ae59a609c158b1419c83649a74e17e69765ad4f528ac66c98119c620a318c8179814c25758432a5cb6734e31a02aa9c8ba1488a11a9cf36929e2128db8766d95b2ab22b1155a2253e4277dc780b010e59a42ea95c6a9a0d6f945d57345e555c9f339808ae00aa5475ec6c4526bb010fcac24475a218a758e62f920567711c038196cd037abb57ad132ad622a2e3e39617cf366a398564f31adb5405ff6a920c5326ec726a397fc11cf79259e4862e6d33948299e55f56893eacd10dc9f899847ac127cb8b5527caa9e8cf4af1bf5c506014c76058b1ed10fa0f609b778aa26cacc3bb03e04b49e99fa7ac0330ef2925538804ebc24530003cf08173a4b5a787bcb3bb06b6b7de17a7ad74bc3125b9fa0cb46550cfdc9a9a8400a8fe51f9f39a28aa2a752c16119f925e4db6a4a37b26e85c78022b8952b30599833bf1896ba1a16fdb71e4a3031058500c85a05fd36b99741cac790243af94cfbe25dec5808fa43cfc792a9fcc1adf962079832897049b9999a71857288a0ea8423e17e1d50c8a56a97fbfc0ca4195fc9d20d6b7bbf625591a6858f75ca791b6557585b4f23868a387abd2008511cbb4b681c3f90499c53c16e8a3522495848c50a0e379267d0b9bcce9b846b3415be0ba2a952c37dfc6810c4726d01974eba5d4c8ab59a99b75b7b9c6b866de4c387ed584bf391b70ca87a37478544032e00cbbff4d74a1b42991e729c8c4bcb980a487c554bb7556a242383cab936366344e7e33c8c916d64b46ec29935bca65c8eda3f67559edada07301644fbc4643f9c2fea45195d8c67ce5687ffd064d282ca823b449f9b2ee596297ff6a34d3854b587c596e3bc2f7c4e913339bec85435b78321b123a893564441c515a280563150d3f80ffc688674346159461d176c77a4ccc0527357c9d00d1723734e78b5b374b2d895b0e08b33e97b2d73a6b994f90e89bcabeac2bee498bb09c4bc03ca2c8e00ce99fa04fb048d864c3bb6e1236e5cac3de30407c3284b2c643fe02c6efa024d96401f1bc463e5bbd9c08c81792dbae510f1b727f3a1b530402b47c6b6dbd5147579938fa972afc46e7426782e26a9c8e2c57045482adc100317173ee51d03f3197a102c9fd7b607351b4ad5b6bde45113d637332a288e4f6bb67e444c323ee8218b5c1d1599b58dde352fd6cd647a52'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '46973b12a054a89f47d53af583ad94676bbe8ac1046b071d666f55813b6898aaaacb5559d007ea6814683b499d8be1a0f5bdf0527ad9dfa8669038fb33be26c5'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    '1ad401a3c43e18a5808d49bcfa19132e0a3c0a551379169c0770376a12d2dd499efbc860e5067707de7be9b164185a4612dc88ef8cc755f253fe9081b9fb25827f2e316a09ae62ebf85d97454693fb220422eec6d3a1782184977fced1951ad0a8b7eac897f4e8e3bb7d15fd3f78ed8d37ead1a54ebfa230af95f3326fbb0557bc558a8b1950d9e5463a4d2ceaaa1f7a67f8d625c98640a89ed4eec2e63d34c06d7b31ffe83f861a3a7e50fe644b6bc72e78ceb773831d1d905f7a3408acb073ac81bf40ed3766f283a5bc07d206a8264afdef771adce3878f8d1d346f9292d6bbb8b9c6cb8e857ed0479852828935bb68aa0469828434062aa5ea49307a80f110ffc143ac8644e5aa3a74e5853986ce97a2e699add9cb7753a1983d08d253fd5e25efc8d9f110e2bbf89b31957fe0d3cdf5b1f6256ff88d7aa4ecb6b5f91d6620e2c861dc870a903834b4f1b608ac904043ea5c5c0a1f8ec44f91c51c9a2e5fb879d7dbfb9f948c1917ca607ca103a1bfeaccfad2ef34a8799f39261304d6772938b582a2ea948a2839ffb43dc315d0ae311f1e54294cb6dbc1efa904a666b0a381c8b528d10a562641ead95293b74ecc78c2e64af98ba6388278b5091ef29f8b506e7ea4e2b8591cca6145205efc91f9de7e2860d7e2893c888807be0b765a12a8563ce04fcb99d68510312f774fcccd4c5d0f8764cfb9fffffd67b2dc3ff5b4b47da0665409d3dc4ec4da3e36b991f9f3ea2cc01e347d69256ff7057b201f3e04343b2bc81e67009ea659c120e0c606ed2aebe8a67196481ef3c5301bc173a33c61ed931916d21a0e6d9ae73981dd3eb2a33b33a84ecebfbe42249f54a3d817038ec6c60e8998dc9ebd17b96887bd3c69c7b4547f402f24981f5293e0ce5e7707aaf333b9bd982195afffab10a80d53a9ecca129579d5f5fddd6dc5245640f83cf3bf9ae7f839455a14aeaffc2a177d7a5e93110f74f9ea27ed224df258681753683ae1755ae4a8d616fbae8cc686ea06a31b39df7a563735839aadc4ac05f7f4b9edc6b173576fdcc7ce3072dced29dee8355966db7d25bb2f613ea6e32a7c513cc2474b71b3db7d5f8a64c66f7cbeadf3417d7b7f60f27e23566adb11da10c7049ce129fe55a65ad16f60dfecaa1faa0536c54f66a3a0e41e040010c28b2ce6c5e5c9c093599b1bcb0ddd4d23ef4a6a49136a31d769ecd14ca4dd83e66d90a93ac101948875b784a3940b024e3f8ce2d04542fe6714cbf00539f650005ba58eba04377e3734bfe9ff99b6cabfa08743369e4847e3b15445251a94b64270f618a596ce94e22c1f71e40fd19765498bc21c9a59ab7eb77caee81eafed0de8d5424ee3ceff860eabb3b1381fa5287642ec50ea9ee9578a8b7abc00eb187b158c75669c175d50e300a4e00bae5a5333a75933938601183f8a69bf547d5be49b7faea391bd2a4f5cab057642205b55437f99cc8114cc21ba9e9f16e8844cf9dad53931409cf4ef6c6e65e77f21ee2b3e70927129a4b5d78044ea7031264bce6a'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '532e3b9af08e5f5528929b762fb6e4d30b2886f018f970784199f315e3f5cfc3'
+  ),
 };
 
 // ML-KEM-1024 test vectors
 ml_kem_vectors['ML-KEM-1024'] = {
-  // 1568-byte publicKey
-  publicKey: new Uint8Array([
-    0x51, 0xe6, 0x70, 0x71, 0x69, 0x47, 0x5b, 0x3a, 0x30, 0x8f, 0x01, 0x40,
-    0x59, 0x58, 0x3b, 0x83, 0x04, 0xcd, 0x2d, 0x93, 0x68, 0x7e, 0x53, 0x15,
-    0x83, 0x46, 0x44, 0x79, 0x35, 0x10, 0xd8, 0xbc, 0xb4, 0x6d, 0x90, 0x53,
-    0xaf, 0xe0, 0xcb, 0x91, 0x09, 0x5f, 0x39, 0xac, 0x78, 0x2b, 0x8a, 0x61,
-    0x27, 0x81, 0xc9, 0xff, 0x6a, 0x4e, 0xf7, 0xb1, 0x7b, 0xb7, 0x62, 0xc1,
-    0x38, 0xb5, 0x43, 0xf4, 0x86, 0x54, 0xe6, 0x79, 0x70, 0x66, 0xec, 0xce,
-    0x85, 0xd4, 0x3d, 0x42, 0xe7, 0x93, 0x44, 0x6b, 0x74, 0xe3, 0x49, 0x29,
-    0x6b, 0x44, 0x5a, 0xfd, 0x2c, 0x9f, 0x45, 0x64, 0x64, 0x97, 0xd1, 0x08,
-    0x3f, 0x32, 0x9b, 0xc5, 0x72, 0x3b, 0x3b, 0x62, 0x56, 0x39, 0x6a, 0x13,
-    0x5c, 0x31, 0x03, 0x00, 0x41, 0x1b, 0xfb, 0x17, 0x45, 0x03, 0x50, 0xb7,
-    0xe1, 0x80, 0x83, 0x2c, 0x00, 0x38, 0xe2, 0x45, 0x0e, 0x78, 0xf5, 0x18,
-    0xee, 0x31, 0x84, 0x42, 0xcc, 0xa1, 0x36, 0xab, 0x93, 0x8e, 0xf8, 0x79,
-    0x75, 0x25, 0x8b, 0xf2, 0xcc, 0x51, 0x62, 0xb1, 0xa9, 0x3d, 0x8a, 0x51,
-    0xea, 0x52, 0xa1, 0xa8, 0xd4, 0xca, 0x23, 0xb9, 0xb6, 0x0b, 0xd6, 0x8c,
-    0x7f, 0x41, 0x86, 0xa9, 0x80, 0x69, 0x99, 0xcc, 0x88, 0x6f, 0xa3, 0x69,
-    0x2f, 0xfc, 0xbb, 0x46, 0xaa, 0xa2, 0x8f, 0x85, 0x6f, 0x9a, 0x77, 0x43,
-    0x57, 0x40, 0x2f, 0xb0, 0xa5, 0xce, 0x80, 0xf6, 0x96, 0x31, 0xe5, 0x23,
-    0x36, 0x72, 0x9e, 0x04, 0x38, 0xa1, 0xe9, 0x3a, 0x21, 0x4a, 0xe9, 0x9f,
-    0x15, 0x26, 0x3e, 0xff, 0x13, 0x5d, 0xe0, 0xa9, 0x42, 0xd8, 0xb3, 0xc2,
-    0x61, 0xb4, 0x22, 0xc0, 0x34, 0xb1, 0xbe, 0xc7, 0x90, 0x36, 0xb0, 0xa0,
-    0x41, 0xc3, 0x7b, 0xe0, 0x33, 0x34, 0xae, 0x42, 0xcf, 0x86, 0x13, 0x28,
-    0x3e, 0xe8, 0x0e, 0x69, 0x31, 0x49, 0x89, 0xf3, 0x69, 0x6f, 0x18, 0x25,
-    0xbc, 0x53, 0xc8, 0x94, 0x32, 0x3e, 0x17, 0x75, 0xc7, 0x2f, 0x77, 0x94,
-    0x15, 0xb8, 0x84, 0x87, 0xec, 0x26, 0xf4, 0xb1, 0x64, 0x46, 0xa0, 0xaa,
-    0xb0, 0xe5, 0x22, 0x6b, 0x83, 0x7b, 0x8d, 0x13, 0x29, 0x7e, 0x31, 0xb4,
-    0x7b, 0x4b, 0x41, 0xa4, 0x9b, 0x82, 0x3f, 0x69, 0x64, 0xe5, 0x37, 0x8a,
-    0x78, 0x06, 0x3a, 0xfa, 0x24, 0xb5, 0xe6, 0x29, 0x4f, 0x27, 0x0b, 0xba,
-    0x5a, 0x7b, 0x90, 0xe4, 0x2a, 0x2d, 0x6b, 0xa4, 0x41, 0x9f, 0x85, 0x8a,
-    0xdb, 0xb1, 0x8f, 0x90, 0x1c, 0x37, 0xa0, 0xf2, 0x78, 0xbf, 0x6c, 0x46,
-    0x8e, 0x72, 0x3f, 0x00, 0xbc, 0xba, 0x37, 0x10, 0x80, 0x9b, 0xd5, 0x5e,
-    0x35, 0xbb, 0xb5, 0x20, 0xdc, 0x9f, 0x44, 0x61, 0x46, 0x65, 0x00, 0x6f,
-    0x71, 0x3b, 0x5b, 0xa2, 0x64, 0xbb, 0x26, 0xb7, 0x10, 0x6d, 0x89, 0xbb,
-    0x71, 0x4c, 0x65, 0xc0, 0xf3, 0x78, 0xdf, 0x16, 0x51, 0xa5, 0x75, 0xcd,
-    0x63, 0x77, 0xa2, 0x83, 0x74, 0xb7, 0x66, 0x8b, 0xb6, 0xb1, 0x43, 0x66,
-    0x12, 0xa3, 0x9c, 0x71, 0xea, 0xa4, 0x82, 0xeb, 0x78, 0xb7, 0xd0, 0x7d,
-    0x49, 0x14, 0x87, 0x3e, 0x36, 0x38, 0x42, 0x90, 0xa7, 0xc4, 0x47, 0x86,
-    0xe9, 0xb3, 0x7b, 0x8b, 0x42, 0x78, 0x82, 0x06, 0x9f, 0x0a, 0x90, 0x18,
-    0xb4, 0x87, 0xa5, 0xff, 0xa8, 0xbc, 0x83, 0xd5, 0x2a, 0xab, 0x57, 0x95,
-    0x63, 0x97, 0xac, 0x60, 0x56, 0x31, 0x3b, 0x94, 0xb5, 0x3c, 0xe1, 0xc3,
-    0x9b, 0x71, 0x7e, 0x9b, 0xe2, 0x8b, 0xc7, 0xca, 0x12, 0xc4, 0x93, 0x8e,
-    0x48, 0xbb, 0x03, 0x1a, 0x56, 0x39, 0x62, 0xc0, 0x5f, 0x25, 0xa4, 0x06,
-    0xda, 0x2b, 0x7c, 0x1b, 0x98, 0x3a, 0x55, 0x5c, 0x5a, 0xe7, 0x93, 0x62,
-    0x2c, 0x31, 0x93, 0xc4, 0xc1, 0x75, 0xfe, 0x0a, 0x8d, 0xfe, 0x20, 0xc1,
-    0xcb, 0xb9, 0x4d, 0x96, 0x97, 0x16, 0x01, 0x60, 0x87, 0x8c, 0x67, 0x20,
-    0xee, 0xf4, 0x4f, 0x8c, 0x22, 0x54, 0x9c, 0xf6, 0x2a, 0x2b, 0x4c, 0xbf,
-    0xfc, 0x11, 0x9b, 0xd1, 0xc4, 0x6a, 0x10, 0xd0, 0x66, 0x1d, 0x5c, 0x4b,
-    0x1a, 0x92, 0x77, 0xaa, 0x31, 0x00, 0xd8, 0xe3, 0x63, 0x68, 0x99, 0xbe,
-    0xe5, 0x43, 0x12, 0x7c, 0xbb, 0x2a, 0x8c, 0x70, 0xb6, 0x76, 0x8c, 0xc5,
-    0x1a, 0xa4, 0x39, 0x93, 0x87, 0x25, 0x87, 0x71, 0x87, 0xaa, 0x25, 0x3e,
-    0xea, 0x51, 0xc6, 0x78, 0x4c, 0x29, 0xb3, 0x65, 0x07, 0xe4, 0x03, 0x9c,
-    0x37, 0xb8, 0x45, 0xee, 0x4b, 0x05, 0x81, 0x55, 0xa3, 0xb8, 0x51, 0xca,
-    0x68, 0x5c, 0x05, 0x4f, 0x80, 0x86, 0xca, 0x95, 0x58, 0x24, 0xab, 0x41,
-    0x44, 0xc4, 0x36, 0x8d, 0xdc, 0x70, 0x76, 0x4a, 0x18, 0x4c, 0x2a, 0x2a,
-    0xbe, 0xcc, 0x84, 0xad, 0xd7, 0x65, 0x07, 0x36, 0xa0, 0xf8, 0x86, 0x5e,
-    0xc0, 0xc6, 0xb4, 0xbe, 0x22, 0x34, 0x5c, 0xeb, 0xc6, 0xed, 0x7a, 0x27,
-    0xd5, 0x61, 0x61, 0xf3, 0x50, 0xa6, 0x05, 0xeb, 0x4b, 0x3f, 0x18, 0xa6,
-    0x85, 0xdb, 0x16, 0x06, 0x35, 0x2e, 0x05, 0x2a, 0x97, 0xe9, 0xa5, 0xcf,
-    0xb3, 0xb1, 0xc9, 0x09, 0xf5, 0x54, 0x5c, 0xe0, 0xa4, 0x19, 0xc6, 0x05,
-    0xb7, 0x85, 0x94, 0x0f, 0x32, 0xc6, 0x22, 0xe3, 0x17, 0x87, 0xc5, 0xa3,
-    0x61, 0xf4, 0x5e, 0xcd, 0xa5, 0x0b, 0x4b, 0x75, 0x46, 0xe7, 0x55, 0xaa,
-    0x62, 0x67, 0x9f, 0x13, 0xea, 0xaa, 0x78, 0x75, 0x5f, 0x31, 0x18, 0x99,
-    0x1b, 0x0a, 0x57, 0x92, 0x49, 0x59, 0x9a, 0x39, 0x21, 0x47, 0x11, 0x52,
-    0x63, 0x4b, 0x4f, 0xe4, 0x01, 0xb1, 0x1c, 0xe7, 0x18, 0x2c, 0x54, 0xa3,
-    0x21, 0x89, 0x9a, 0x94, 0xb4, 0x45, 0xb7, 0xca, 0x32, 0xbe, 0x5c, 0x13,
-    0x02, 0xf7, 0x7e, 0x51, 0xdc, 0x86, 0xfc, 0xf3, 0x61, 0x59, 0x3b, 0x13,
-    0xeb, 0x9c, 0xb0, 0x1d, 0xf3, 0xb1, 0x69, 0x93, 0xc1, 0x57, 0xc5, 0x66,
-    0xac, 0x0b, 0xbc, 0xe3, 0x10, 0x83, 0xcb, 0xb1, 0x49, 0x53, 0x5b, 0x05,
-    0xfd, 0xc8, 0x66, 0x55, 0xa5, 0x76, 0x65, 0x42, 0x34, 0x1f, 0x99, 0xb9,
-    0xf2, 0x74, 0x77, 0x18, 0xfb, 0x58, 0xef, 0x1c, 0x00, 0x11, 0x18, 0x4c,
-    0x21, 0xe3, 0xca, 0x80, 0xb1, 0xb9, 0x12, 0x8b, 0x79, 0x6b, 0x16, 0x9c,
-    0x2b, 0x0a, 0xad, 0x8e, 0xbb, 0x2d, 0xa5, 0x36, 0x9f, 0x44, 0xdb, 0x2c,
-    0x99, 0x5c, 0xa5, 0x67, 0x56, 0xc6, 0x68, 0xe4, 0xbd, 0xfe, 0x38, 0x86,
-    0x2c, 0xc7, 0xba, 0xe4, 0xd1, 0xae, 0x50, 0x5c, 0x6e, 0x93, 0x6c, 0xba,
-    0xae, 0x9b, 0x42, 0xe5, 0xbb, 0x28, 0x68, 0xc1, 0x41, 0xc2, 0x5b, 0x81,
-    0xed, 0x7c, 0xc7, 0x06, 0x84, 0x6e, 0xa9, 0xa0, 0x59, 0xea, 0x65, 0x96,
-    0x02, 0xb4, 0x29, 0xdc, 0x91, 0x11, 0xf1, 0xb0, 0xb3, 0x18, 0xf7, 0x40,
-    0x2f, 0xe2, 0x06, 0x98, 0xa9, 0x3b, 0x77, 0x09, 0x78, 0xd6, 0x03, 0x5d,
-    0xb8, 0xd4, 0x06, 0x5c, 0x49, 0x27, 0x5f, 0xfa, 0xbe, 0x68, 0x75, 0xc6,
-    0x62, 0x15, 0x6d, 0x2a, 0x07, 0xbd, 0x3d, 0x91, 0xcc, 0x9a, 0x70, 0x3f,
-    0x0f, 0x1b, 0x63, 0x99, 0x03, 0x63, 0xe4, 0x9b, 0xbf, 0xb6, 0x7c, 0x86,
-    0x78, 0x27, 0x59, 0xf1, 0xe3, 0xaf, 0xd1, 0x09, 0x4d, 0x66, 0xb6, 0x10,
-    0x0d, 0x87, 0x2b, 0x72, 0x54, 0xbd, 0xa0, 0xb1, 0x7b, 0x17, 0xb9, 0xcd,
-    0x15, 0x44, 0x50, 0x9f, 0x9a, 0x72, 0xb7, 0x9c, 0x21, 0x96, 0x92, 0x54,
-    0x82, 0x3c, 0x50, 0x13, 0x24, 0x4c, 0x68, 0x1a, 0x77, 0x28, 0x29, 0x78,
-    0x69, 0xbb, 0x7c, 0xae, 0x71, 0x6f, 0x9d, 0x59, 0x86, 0x8d, 0x0c, 0x2a,
-    0xef, 0x98, 0x21, 0x53, 0xe2, 0x18, 0xab, 0x55, 0xb8, 0xce, 0x96, 0x9f,
-    0x31, 0x85, 0x26, 0x8a, 0x88, 0x0c, 0x31, 0x98, 0x87, 0x38, 0x58, 0x9d,
-    0x42, 0xb8, 0x1b, 0xbc, 0xe5, 0xae, 0xdb, 0x29, 0xb0, 0xe9, 0x93, 0x37,
-    0xf2, 0x38, 0x9a, 0xa5, 0x43, 0x50, 0x28, 0x97, 0x42, 0x45, 0x63, 0x84,
-    0x66, 0x91, 0x87, 0xd2, 0xc6, 0x91, 0x8c, 0x59, 0x03, 0x3c, 0x92, 0x49,
-    0x69, 0xa3, 0x67, 0x51, 0xb1, 0x01, 0x34, 0x54, 0x99, 0x75, 0xb2, 0x77,
-    0xaf, 0xd9, 0x03, 0x3f, 0x50, 0xce, 0x65, 0xdc, 0x63, 0x3e, 0x5a, 0x1d,
-    0x01, 0xa3, 0xb6, 0x13, 0x8c, 0x6f, 0x01, 0xf7, 0xae, 0xa1, 0x79, 0xc7,
-    0xc8, 0xc7, 0x9e, 0x4b, 0xfb, 0x20, 0x3f, 0xd9, 0xb2, 0x8f, 0xa2, 0x3c,
-    0x14, 0xe6, 0x55, 0xba, 0x77, 0x91, 0x92, 0x8a, 0xc4, 0x6f, 0xe1, 0xa6,
-    0xb8, 0xb9, 0x36, 0x58, 0x09, 0x27, 0x68, 0xe6, 0x5e, 0x85, 0xc5, 0xae,
-    0xd9, 0xe8, 0x97, 0xdd, 0x8a, 0x45, 0x71, 0x2a, 0xab, 0xcb, 0x7c, 0x19,
-    0x19, 0x07, 0x65, 0x68, 0x49, 0x55, 0x9e, 0xd8, 0x4d, 0x40, 0x77, 0xc1,
-    0x14, 0xd9, 0x11, 0xf9, 0xe8, 0x26, 0x70, 0x28, 0xa5, 0x85, 0x6a, 0x90,
-    0x23, 0xba, 0x51, 0x08, 0x67, 0x86, 0x68, 0x92, 0x67, 0xa5, 0x6b, 0x06,
-    0xe6, 0x28, 0x1f, 0x1b, 0xc3, 0x43, 0x4b, 0x01, 0xbf, 0x96, 0xb0, 0x24,
-    0x3e, 0x08, 0x86, 0xd7, 0xf4, 0x37, 0x25, 0xf9, 0xaa, 0x59, 0x8b, 0x51,
-    0x5c, 0xea, 0x40, 0x1b, 0x77, 0x51, 0xe1, 0xa2, 0x59, 0x81, 0x65, 0x26,
-    0x23, 0x2a, 0x75, 0xd0, 0x72, 0x74, 0xf6, 0xbc, 0x4b, 0xd0, 0xd1, 0xa6,
-    0x1e, 0xbb, 0x11, 0x80, 0x4a, 0xa7, 0x9f, 0x09, 0x40, 0x08, 0xe5, 0xa1,
-    0x90, 0x85, 0x43, 0x1a, 0xc1, 0x1c, 0x50, 0x8a, 0x6f, 0xbd, 0x50, 0x26,
-    0x8a, 0x8c, 0x80, 0x21, 0xc4, 0xb1, 0x9b, 0xfa, 0x56, 0x90, 0x97, 0x20,
-    0xbf, 0xb7, 0x26, 0xca, 0xe9, 0xa7, 0xb7, 0x73, 0x6f, 0xaf, 0x17, 0xcf,
-    0xba, 0x9b, 0x3b, 0x4a, 0x32, 0xad, 0xbb, 0x04, 0x50, 0xe9, 0x00, 0x24,
-    0xbb, 0xe8, 0x2c, 0xdb, 0xb0, 0x2f, 0x62, 0x00, 0x5e, 0xf3, 0x34, 0x79,
-    0x8c, 0xb3, 0xbd, 0x7f, 0xda, 0xa7, 0xfa, 0x63, 0x5f, 0xe3, 0xa6, 0x43,
-    0xef, 0x74, 0x5f, 0x10, 0x37, 0xcb, 0x6b, 0x82, 0x4b, 0x7c, 0x60, 0x85,
-    0x15, 0xe3, 0x7f, 0x5b, 0x73, 0xa4, 0x88, 0x24, 0x8d, 0xe1, 0x7c, 0x66,
-    0x5d, 0x3b, 0xb4, 0xd9, 0x25, 0x75, 0x26, 0x6a, 0x0f, 0x65, 0x65, 0x26,
-    0x4e, 0xb6, 0xa4, 0x64, 0x3b, 0x52, 0xb3, 0xd2, 0x3a, 0x80, 0x25, 0x46,
-    0x10, 0x58, 0x5c, 0x22, 0xc3, 0x30, 0xa1, 0xe2, 0x35, 0xeb, 0xc7, 0x3d,
-    0xe0, 0xba, 0xbf, 0x9b, 0x39, 0xa9, 0xc5, 0xf4, 0x8e, 0xf0, 0xac, 0x06,
-    0x0f, 0xe9, 0x6a, 0x00, 0xfa, 0x4b, 0xe7, 0x6b, 0xbc, 0x47, 0x28, 0x37,
-    0x1d, 0xe9, 0x64, 0x6d, 0xfa, 0x7d, 0x5c, 0x83, 0x3d, 0xe1, 0xf6, 0x46,
-    0x28, 0x76, 0x33, 0xde, 0xb4, 0x1f, 0x46, 0x76, 0xc7, 0x44, 0x72, 0x25,
-    0x07, 0xf1, 0xc3, 0x53, 0xa8, 0x5e, 0x85, 0xea, 0x10, 0xb3, 0xd4, 0x3e,
-    0x8a, 0x78, 0x4c, 0x3e, 0xf2, 0x62, 0xf2, 0x81, 0xbd, 0xd5, 0xdb, 0x44,
-    0xe0, 0x3c, 0x4e, 0xca, 0xd2, 0xa0, 0x5b, 0x48, 0x0b, 0xa1, 0x99, 0xbb,
-    0x32, 0xbb, 0x07, 0xaf, 0xc4, 0x62, 0x57, 0xf9, 0x5b, 0xdf, 0x51, 0x6f,
-    0xea, 0x63, 0xc6, 0x6c, 0xc4, 0x84, 0x26, 0xfa, 0xca, 0xcc, 0x06, 0x56,
-    0xb7, 0xf6, 0x01, 0x79, 0xf7, 0x92, 0xb7, 0xd6, 0x86, 0xdf, 0xe7, 0x07,
-    0xd7, 0xb9, 0x16, 0xb1, 0xe8, 0xb2, 0x49, 0x50, 0xc7, 0x4b, 0x9b, 0x60,
-    0x01, 0x60, 0x4e, 0x5d, 0x33, 0x3a, 0x35, 0x99, 0x2a, 0x7c, 0xc4, 0x4c,
-    0xe3, 0xbc, 0x1b, 0xbd, 0xb8, 0xc7, 0x2f, 0x08, 0x42, 0x8d, 0x8a, 0x6e,
-    0x59, 0x20, 0x61, 0x9d, 0x81, 0x96, 0xa7, 0xd3, 0x26, 0x95, 0x33, 0xbd,
-    0xcd, 0x34, 0x35, 0x18, 0x3b, 0x5d, 0x6e, 0x98,
-  ]),
-  // 64-byte privateSeed
-  privateSeed: new Uint8Array([
-    0xd7, 0x10, 0xa2, 0xbc, 0x47, 0x89, 0x36, 0x8c, 0xf2, 0x0a, 0xf5, 0xfe,
-    0xee, 0xdc, 0x8b, 0x9a, 0x8d, 0x0a, 0x88, 0xeb, 0xd7, 0x70, 0xf9, 0x1e,
-    0x9a, 0x44, 0x11, 0x46, 0x52, 0x6f, 0x6b, 0x0e, 0x71, 0x1d, 0x94, 0x5a,
-    0x87, 0x86, 0xbd, 0xce, 0x9f, 0x16, 0x7d, 0xdc, 0x5d, 0xa8, 0xc7, 0xab,
-    0x96, 0xdc, 0x30, 0x5d, 0x6a, 0x36, 0x63, 0x19, 0xd5, 0xf8, 0xa6, 0x92,
-    0x4f, 0x18, 0x39, 0x59,
-  ]),
-  // 1568-byte sampleCiphertext
-  sampleCiphertext: new Uint8Array([
-    0xd5, 0x4d, 0xf4, 0xd6, 0x79, 0x31, 0x4c, 0xfd, 0x6f, 0x32, 0x91, 0xcb,
-    0x64, 0x4b, 0x99, 0x73, 0x14, 0x5a, 0x78, 0x8c, 0x98, 0xef, 0x94, 0xe6,
-    0x8e, 0x9f, 0x8d, 0x1f, 0x92, 0xeb, 0x84, 0x23, 0x96, 0x84, 0x9e, 0x69,
-    0x14, 0xd8, 0xcf, 0x53, 0x09, 0x02, 0x57, 0x88, 0x2f, 0x26, 0xb1, 0xfb,
-    0x4c, 0x07, 0xa2, 0xb6, 0xad, 0xea, 0xf3, 0xbd, 0x56, 0x8c, 0x5d, 0x3c,
-    0x5b, 0x54, 0x32, 0x0d, 0x95, 0x0f, 0xa5, 0x59, 0x80, 0xaf, 0x8d, 0x96,
-    0xfd, 0x7d, 0x49, 0x65, 0x82, 0x5b, 0x63, 0x88, 0x42, 0x92, 0x9f, 0x7b,
-    0x6a, 0xcf, 0x5d, 0xfd, 0x30, 0x33, 0xf3, 0xf3, 0x45, 0xaf, 0x31, 0x32,
-    0x80, 0xe0, 0x10, 0x5f, 0xaa, 0xdd, 0x42, 0x71, 0x5f, 0xff, 0x55, 0x55,
-    0x0c, 0xaa, 0x64, 0x36, 0x89, 0x67, 0xf1, 0x58, 0xca, 0x3a, 0x7d, 0x00,
-    0xae, 0xb4, 0xdf, 0x1e, 0xcc, 0xde, 0x24, 0x0f, 0x5b, 0x21, 0x10, 0xef,
-    0xe6, 0x5f, 0x58, 0xe9, 0xb3, 0xee, 0x54, 0x98, 0x7e, 0x07, 0xea, 0xe1,
-    0x95, 0x27, 0x9a, 0xfa, 0x37, 0x3d, 0x74, 0x62, 0xa4, 0x8d, 0x9c, 0x79,
-    0xb7, 0xc8, 0xa3, 0xf8, 0x16, 0x2d, 0x84, 0x30, 0xbd, 0x0d, 0x97, 0xbd,
-    0x90, 0x14, 0x36, 0x29, 0x7c, 0x12, 0x3e, 0x41, 0xf7, 0x40, 0x96, 0x06,
-    0x54, 0x69, 0xd5, 0x87, 0xb9, 0xe7, 0x42, 0x77, 0x3f, 0xfe, 0xf9, 0x13,
-    0x46, 0xe3, 0x51, 0xbb, 0x95, 0xb4, 0x3b, 0x8c, 0x08, 0x2a, 0x28, 0x7b,
-    0x97, 0x98, 0x91, 0x17, 0x4e, 0x71, 0x86, 0xdc, 0x8c, 0xf2, 0xd6, 0x4a,
-    0x07, 0x71, 0x1f, 0x6e, 0x9f, 0x17, 0xcf, 0x02, 0xad, 0xdc, 0xc3, 0xb8,
-    0x03, 0xfd, 0xc2, 0xe3, 0xee, 0xc9, 0xd3, 0x91, 0x84, 0x1f, 0x0b, 0x38,
-    0x5e, 0x2d, 0x3e, 0x09, 0x08, 0xab, 0x84, 0x18, 0x82, 0x67, 0xce, 0xdd,
-    0xcf, 0xb6, 0x9d, 0x2f, 0x44, 0x4f, 0x69, 0x00, 0x88, 0x16, 0x45, 0x8d,
-    0xa4, 0xda, 0xd5, 0x9a, 0x79, 0xe3, 0x37, 0x83, 0x33, 0x9c, 0xcc, 0xeb,
-    0x55, 0x24, 0xa0, 0x22, 0x7f, 0x11, 0x4a, 0x23, 0x67, 0xdb, 0xcc, 0x5f,
-    0x97, 0x85, 0xef, 0x15, 0x66, 0x5e, 0x92, 0x1e, 0x87, 0x7b, 0x24, 0x05,
-    0x87, 0x67, 0x43, 0xec, 0xed, 0x6d, 0x76, 0xaf, 0x9d, 0x4a, 0xa6, 0xa6,
-    0x80, 0x33, 0xc2, 0x43, 0x51, 0x58, 0xd7, 0xb0, 0x10, 0x60, 0x58, 0xef,
-    0x98, 0x52, 0xa8, 0x1a, 0x46, 0x2b, 0xfb, 0x3c, 0xf8, 0xb1, 0x60, 0x27,
-    0xe5, 0xe0, 0x82, 0x50, 0xc1, 0x2c, 0xb1, 0xe4, 0x13, 0x06, 0x68, 0x17,
-    0x36, 0x23, 0x35, 0x6f, 0x97, 0x93, 0xdb, 0x05, 0xbd, 0x06, 0x5e, 0xa3,
-    0x6a, 0x61, 0x32, 0x6c, 0xca, 0xf5, 0x3d, 0x2e, 0xc0, 0xa1, 0x34, 0xdc,
-    0x1f, 0xc6, 0xc7, 0x2a, 0x40, 0x3d, 0x27, 0x46, 0x30, 0xb7, 0x34, 0x64,
-    0xaa, 0xa1, 0x6b, 0x46, 0xa7, 0x1c, 0x82, 0xd8, 0xa0, 0x27, 0xcb, 0x50,
-    0x05, 0xf2, 0x24, 0x26, 0xc0, 0xb5, 0x31, 0x4b, 0x04, 0xb7, 0x08, 0xd7,
-    0xac, 0xa3, 0xf4, 0xb8, 0x53, 0x8e, 0xc1, 0x92, 0x53, 0xf9, 0x40, 0xb4,
-    0xb8, 0x15, 0xaf, 0x22, 0xce, 0x82, 0xbd, 0xcd, 0x7d, 0xa8, 0x5a, 0x61,
-    0xac, 0x18, 0x7c, 0x92, 0xef, 0x38, 0xc8, 0xc2, 0x99, 0x00, 0x51, 0x91,
-    0x64, 0x82, 0x37, 0x47, 0xea, 0xa5, 0xf6, 0x8b, 0xea, 0x24, 0xe8, 0x7e,
-    0x62, 0x3c, 0xb7, 0x4d, 0xac, 0x2c, 0x7b, 0x57, 0xfa, 0x1f, 0x28, 0x53,
-    0x16, 0xfd, 0x74, 0x4b, 0x83, 0x80, 0x0e, 0xf3, 0x66, 0x36, 0xcd, 0xf5,
-    0x29, 0x23, 0x0d, 0xc6, 0x9e, 0x7b, 0xb2, 0x8b, 0xc5, 0xc6, 0x48, 0xdb,
-    0x1d, 0xbb, 0x61, 0x48, 0xae, 0x05, 0x10, 0x99, 0x9b, 0x48, 0x23, 0x8c,
-    0x10, 0x50, 0xee, 0x5e, 0xa0, 0x49, 0x86, 0x27, 0x4e, 0xfe, 0xa8, 0x63,
-    0xde, 0x71, 0xf5, 0x52, 0x8c, 0xef, 0xcc, 0xd3, 0x9e, 0x0e, 0x17, 0x9b,
-    0x57, 0x49, 0xb7, 0x27, 0x29, 0x01, 0x3c, 0xbb, 0x1e, 0x85, 0xb9, 0x6a,
-    0x13, 0x47, 0x59, 0xd8, 0x0b, 0xca, 0xb2, 0xa5, 0xe4, 0xeb, 0x93, 0xfd,
-    0x7e, 0xef, 0x26, 0xae, 0x23, 0xed, 0x1e, 0x07, 0xd5, 0x91, 0x72, 0xa4,
-    0x8d, 0x09, 0xae, 0xef, 0xfa, 0xfe, 0x12, 0xad, 0x46, 0xd7, 0x91, 0xbf,
-    0xc6, 0xa7, 0x13, 0x30, 0x7d, 0xad, 0x2b, 0x8e, 0xd4, 0x14, 0x87, 0xf2,
-    0x89, 0xeb, 0x2c, 0xca, 0xb8, 0x36, 0x12, 0xb0, 0xec, 0x61, 0xc8, 0xdc,
-    0x32, 0x80, 0xae, 0x89, 0x9a, 0x4b, 0x57, 0xe2, 0xe1, 0x33, 0xb5, 0xdb,
-    0x0d, 0x89, 0x6a, 0xd4, 0x18, 0xa5, 0xaf, 0xef, 0x5d, 0xab, 0x36, 0xf8,
-    0x7c, 0x64, 0x79, 0x32, 0x39, 0x67, 0x2d, 0x50, 0xa6, 0x7b, 0x6a, 0xc1,
-    0x6d, 0x6f, 0xcb, 0xac, 0x5d, 0x3e, 0x71, 0x1d, 0x48, 0x7c, 0xcd, 0x0e,
-    0x4a, 0xc1, 0xc9, 0x64, 0xaa, 0x51, 0x55, 0xcc, 0x3b, 0xa0, 0x10, 0xb5,
-    0x78, 0x3d, 0xcd, 0xd0, 0xef, 0x10, 0x56, 0x7e, 0x7c, 0xf1, 0x98, 0x62,
-    0xc0, 0x0d, 0x71, 0x23, 0x02, 0x41, 0xef, 0x13, 0x29, 0xc5, 0x21, 0x3d,
-    0x09, 0x83, 0xa5, 0x8f, 0x56, 0x5c, 0x12, 0xdd, 0x78, 0x6d, 0x68, 0xd8,
-    0xbc, 0x31, 0x15, 0x8d, 0xe6, 0xcd, 0x02, 0x73, 0xbd, 0xfd, 0x8e, 0x58,
-    0xf2, 0x16, 0x48, 0x96, 0x00, 0x57, 0x5b, 0x9f, 0x37, 0x34, 0xcf, 0xde,
-    0x2a, 0x22, 0xc6, 0xf3, 0x30, 0x17, 0x56, 0x28, 0x50, 0x19, 0xc7, 0x77,
-    0xf2, 0x3e, 0xed, 0x8f, 0x10, 0x11, 0x09, 0xe9, 0xff, 0xbd, 0x75, 0x65,
-    0x52, 0x3b, 0x5c, 0x0f, 0xb4, 0x95, 0x09, 0xe6, 0x6a, 0x28, 0x91, 0x5e,
-    0x26, 0xbf, 0xce, 0xfc, 0x75, 0x5c, 0xc0, 0x2d, 0xc8, 0x63, 0x7f, 0x31,
-    0xd3, 0x59, 0xf0, 0xe2, 0xa7, 0xe8, 0x21, 0x4c, 0x99, 0xd5, 0x2f, 0x29,
-    0x9f, 0x8c, 0x1f, 0x2c, 0xba, 0x34, 0xff, 0x1e, 0x96, 0x74, 0x58, 0x17,
-    0x1a, 0x40, 0xe3, 0xc4, 0x46, 0xf0, 0xfd, 0x2b, 0x44, 0x3a, 0x06, 0x03,
-    0x9f, 0x30, 0xac, 0xe8, 0xa0, 0x7e, 0xc9, 0xf1, 0x57, 0x7d, 0xb6, 0xf9,
-    0x52, 0x4f, 0x1e, 0x70, 0x5e, 0xd7, 0x97, 0xe4, 0xa6, 0xf9, 0x9f, 0xed,
-    0xa6, 0x05, 0x72, 0x1e, 0xbc, 0x68, 0x8f, 0x1a, 0x72, 0xe0, 0xb2, 0x67,
-    0xe9, 0xcc, 0x4f, 0x26, 0x4f, 0x5a, 0x6c, 0x46, 0xda, 0x62, 0x0a, 0x47,
-    0xf5, 0x89, 0xab, 0x0f, 0x80, 0x49, 0x3e, 0x18, 0xe5, 0xc0, 0x55, 0x9f,
-    0x97, 0x18, 0xcc, 0x99, 0xb3, 0xb2, 0xa9, 0xb8, 0xdb, 0xfe, 0x0d, 0x94,
-    0x16, 0xec, 0xe2, 0x62, 0x26, 0x5e, 0x93, 0x18, 0x09, 0x4a, 0x24, 0xf9,
-    0xc0, 0x10, 0x3c, 0xcd, 0xcf, 0x77, 0xd7, 0xcd, 0x00, 0xde, 0xcd, 0x22,
-    0x01, 0x60, 0x2b, 0x8f, 0x49, 0x86, 0x40, 0x70, 0x21, 0xee, 0x68, 0x3e,
-    0x1a, 0x1e, 0x21, 0x58, 0x7a, 0xff, 0x70, 0x52, 0xd3, 0x0f, 0x76, 0x97,
-    0x1e, 0x9c, 0x34, 0x86, 0xa4, 0x81, 0xdf, 0x81, 0xb2, 0x24, 0xc1, 0x69,
-    0x56, 0x52, 0x37, 0x46, 0x4e, 0xee, 0xa0, 0xd0, 0xc6, 0xb2, 0xe9, 0x3f,
-    0x35, 0xbd, 0xe3, 0xd0, 0x87, 0x36, 0xce, 0x85, 0xb8, 0xac, 0x48, 0xec,
-    0xf4, 0x9d, 0xa7, 0x90, 0xed, 0x8b, 0x26, 0xff, 0x13, 0x1e, 0x55, 0xa3,
-    0x81, 0x74, 0x03, 0xf5, 0x85, 0x03, 0xa2, 0x28, 0x43, 0x16, 0x55, 0xc2,
-    0x8b, 0xb5, 0x84, 0x32, 0x3e, 0xd0, 0x2b, 0xde, 0x2f, 0x70, 0x0c, 0x96,
-    0x4e, 0x59, 0x51, 0xb7, 0x19, 0x10, 0xdd, 0x19, 0x0d, 0x71, 0xfc, 0x37,
-    0xa1, 0xfd, 0x19, 0x31, 0xe7, 0xa6, 0x52, 0x5c, 0x23, 0x1d, 0xf5, 0xe0,
-    0x69, 0xe0, 0x2d, 0xb1, 0x76, 0xf2, 0xe0, 0xcf, 0xf5, 0x68, 0x33, 0x9d,
-    0x05, 0x0e, 0x7c, 0x76, 0x7a, 0x4a, 0xf8, 0x54, 0x09, 0xb6, 0x0f, 0x9a,
-    0x36, 0xba, 0x25, 0x26, 0x01, 0x57, 0xe4, 0x32, 0xc4, 0xa5, 0xe6, 0x57,
-    0x18, 0xe4, 0x74, 0xa2, 0xfd, 0xee, 0x8e, 0x95, 0x4f, 0x35, 0x33, 0x3c,
-    0xb0, 0x03, 0x5f, 0x65, 0xc8, 0x65, 0x59, 0x38, 0x9e, 0x98, 0x5f, 0x63,
-    0x3d, 0x13, 0xa6, 0x19, 0x3c, 0x6f, 0x81, 0x40, 0x27, 0x5a, 0x30, 0x5c,
-    0xbe, 0x67, 0x59, 0x96, 0xf6, 0x83, 0x53, 0x2f, 0xed, 0x01, 0x30, 0xb4,
-    0xae, 0x13, 0x0c, 0xee, 0xc7, 0x47, 0x6b, 0xa0, 0xb7, 0x9e, 0xf0, 0xc3,
-    0x60, 0x6e, 0x07, 0x88, 0x49, 0x47, 0xc1, 0x8f, 0x39, 0x20, 0xa3, 0x2a,
-    0x3b, 0x39, 0xf6, 0x6c, 0xcd, 0xa8, 0x2c, 0x15, 0x9b, 0x37, 0x18, 0xf2,
-    0x66, 0xd9, 0x0d, 0xe8, 0x31, 0xc9, 0x01, 0xcc, 0x75, 0x8c, 0xd0, 0xdf,
-    0xe4, 0xa4, 0xaf, 0xfb, 0x4d, 0xe7, 0x7a, 0xad, 0x1e, 0x8f, 0x9d, 0xdf,
-    0x5a, 0xcf, 0x39, 0xcb, 0x65, 0x94, 0xb5, 0x00, 0x99, 0x49, 0xe5, 0xbc,
-    0xa5, 0x02, 0x98, 0xd9, 0xad, 0x8b, 0xc7, 0xae, 0x02, 0x1c, 0x48, 0x9b,
-    0x30, 0x4d, 0x7b, 0xe8, 0xfc, 0xde, 0x0e, 0x18, 0xbf, 0x4a, 0x81, 0x7d,
-    0x79, 0xf7, 0xb5, 0x12, 0xd6, 0x2b, 0x30, 0xaf, 0xf6, 0xd2, 0xbc, 0x31,
-    0xa2, 0x94, 0x0d, 0x07, 0x4e, 0x6f, 0x78, 0xc0, 0x13, 0xc8, 0x22, 0x06,
-    0x96, 0xcf, 0xd0, 0x2e, 0xc8, 0x31, 0x45, 0xe7, 0xb9, 0x80, 0x2a, 0x97,
-    0x04, 0x2c, 0x28, 0xe9, 0xe6, 0x19, 0x57, 0xca, 0xfb, 0x7d, 0xc4, 0x5d,
-    0x2b, 0xa1, 0x29, 0x72, 0x23, 0xdb, 0x25, 0x3a, 0xd5, 0xc1, 0x7a, 0x71,
-    0xc7, 0xde, 0x34, 0xb6, 0x77, 0x27, 0xbf, 0xff, 0xb6, 0xea, 0x54, 0x24,
-    0x72, 0x58, 0x55, 0x0a, 0xf9, 0x63, 0x75, 0x1a, 0xe4, 0x3e, 0x2a, 0x24,
-    0x09, 0xb6, 0x35, 0x95, 0xe8, 0x23, 0x90, 0xfc, 0x24, 0xc6, 0x71, 0x82,
-    0xb5, 0x74, 0xad, 0xc1, 0x4c, 0xc7, 0xf6, 0x53, 0x64, 0x28, 0xad, 0x93,
-    0xee, 0x47, 0xe9, 0x1a, 0x58, 0x9a, 0x51, 0x96, 0x3d, 0xe7, 0x3a, 0xee,
-    0x5b, 0x8b, 0x05, 0x0e, 0x37, 0xda, 0x2c, 0x89, 0x9b, 0x0a, 0x7b, 0x67,
-    0xe5, 0x86, 0xc2, 0x5e, 0xfa, 0x76, 0xa2, 0x38, 0x91, 0xec, 0x12, 0xf9,
-    0x35, 0x47, 0x8c, 0x99, 0x70, 0xf7, 0xce, 0xe6, 0xac, 0xf9, 0x2e, 0x3f,
-    0x45, 0x7c, 0x35, 0xe6, 0x33, 0xbf, 0x2a, 0xcf, 0x08, 0x7b, 0xd0, 0xab,
-    0x5a, 0xc2, 0x7a, 0x6d, 0xf9, 0xfe, 0x09, 0x7a, 0x29, 0xe0, 0xcf, 0x38,
-    0x93, 0xdf, 0xe4, 0xda, 0x6b, 0x66, 0x0c, 0xe2, 0x83, 0x64, 0xa6, 0xfb,
-    0x74, 0x25, 0x78, 0x9b, 0x74, 0xf7, 0x05, 0xd8, 0xe1, 0x39, 0x48, 0x1b,
-    0x60, 0x06, 0x16, 0xc9, 0xc3, 0xa9, 0xc2, 0xad, 0xd0, 0xf8, 0x86, 0x2b,
-    0x44, 0xe4, 0xc1, 0x4e, 0xd4, 0x26, 0x8f, 0x8e, 0xd9, 0xa6, 0xa1, 0xef,
-    0xbb, 0xac, 0x2c, 0x98, 0x82, 0xba, 0xdd, 0x14, 0x8d, 0x14, 0xe0, 0x09,
-    0xd1, 0x50, 0x44, 0xcc, 0x4e, 0x03, 0x59, 0x92, 0x00, 0x9a, 0x60, 0x36,
-    0xba, 0xd6, 0xa9, 0xae, 0x75, 0xfd, 0x36, 0x59, 0x87, 0x7c, 0xd3, 0x47,
-    0xa4, 0x5d, 0x99, 0xe9, 0x9d, 0xb2, 0x17, 0x55, 0x83, 0xed, 0x3c, 0xeb,
-    0x25, 0x60, 0xa8, 0xfd, 0xcf, 0xa3, 0x5c, 0x15, 0x09, 0x31, 0x5d, 0x4c,
-    0x8f, 0xb0, 0xe4, 0xa0, 0xac, 0x29, 0x81, 0x13, 0x28, 0x56, 0x29, 0x26,
-    0x1d, 0xd9, 0xb2, 0xb3, 0x8f, 0xee, 0x18, 0x1c, 0xc9, 0x57, 0xa1, 0xcb,
-    0x58, 0x24, 0x71, 0x1a, 0x67, 0xb1, 0xdc, 0xe4, 0x0d, 0x99, 0xca, 0x28,
-    0xf9, 0x23, 0xb2, 0xf9, 0x9f, 0x2b, 0x38, 0x30, 0x96, 0x43, 0xb1, 0x4c,
-    0x01, 0x41, 0x35, 0x02, 0x12, 0x47, 0xb6, 0xe8, 0xd1, 0x15, 0xb2, 0x4b,
-    0xed, 0xf9, 0xbb, 0x20, 0x6c, 0x7e, 0xe1, 0xf9, 0x2a, 0xa6, 0x2c, 0xb9,
-    0x78, 0xc1, 0xb8, 0xdb, 0x4f, 0x25, 0x9a, 0x9c,
-  ]),
-  // 32-byte expectedSharedSecret
-  expectedSharedSecret: new Uint8Array([
-    0x2f, 0x52, 0x11, 0x10, 0xa9, 0xe8, 0x53, 0x86, 0x70, 0x13, 0xce, 0xe3,
-    0x4a, 0x38, 0xf1, 0x07, 0xbe, 0xa1, 0xc4, 0x68, 0x90, 0x67, 0x16, 0x08,
-    0xe4, 0xec, 0xa1, 0x13, 0xed, 0xe9, 0x09, 0x7e,
-  ]),
+  publicKey: hexStringToUint8Array(
+    '51e6707169475b3a308f014059583b8304cd2d93687e5315834644793510d8bcb46d9053afe0cb91095f39ac782b8a612781c9ff6a4ef7b17bb762c138b543f48654e6797066ecce85d43d42e793446b74e349296b445afd2c9f45646497d1083f329bc5723b3b6256396a135c310300411bfb17450350b7e180832c0038e2450e78f518ee318442cca136ab938ef87975258bf2cc5162b1a93d8a51ea52a1a8d4ca23b9b60bd68c7f4186a9806999cc886fa3692ffcbb46aaa28f856f9a774357402fb0a5ce80f69631e52336729e0438a1e93a214ae99f15263eff135de0a942d8b3c261b422c034b1bec79036b0a041c37be03334ae42cf8613283ee80e69314989f3696f1825bc53c894323e1775c72f779415b88487ec26f4b16446a0aab0e5226b837b8d13297e31b47b4b41a49b823f6964e5378a78063afa24b5e6294f270bba5a7b90e42a2d6ba4419f858adbb18f901c37a0f278bf6c468e723f00bcba3710809bd55e35bbb520dc9f44614665006f713b5ba264bb26b7106d89bb714c65c0f378df1651a575cd6377a28374b7668bb6b1436612a39c71eaa482eb78b7d07d4914873e36384290a7c44786e9b37b8b427882069f0a9018b487a5ffa8bc83d52aab57956397ac6056313b94b53ce1c39b717e9be28bc7ca12c4938e48bb031a563962c05f25a406da2b7c1b983a555c5ae793622c3193c4c175fe0a8dfe20c1cbb94d9697160160878c6720eef44f8c22549cf62a2b4cbffc119bd1c46a10d0661d5c4b1a9277aa3100d8e3636899bee543127cbb2a8c70b6768cc51aa439938725877187aa253eea51c6784c29b36507e4039c37b845ee4b058155a3b851ca685c054f8086ca955824ab4144c4368ddc70764a184c2a2abecc84add7650736a0f8865ec0c6b4be22345cebc6ed7a27d56161f350a605eb4b3f18a685db1606352e052a97e9a5cfb3b1c909f5545ce0a419c605b785940f32c622e31787c5a361f45ecda50b4b7546e755aa62679f13eaaa78755f3118991b0a579249599a3921471152634b4fe401b11ce7182c54a321899a94b445b7ca32be5c1302f77e51dc86fcf361593b13eb9cb01df3b16993c157c566ac0bbce31083cbb149535b05fdc86655a5766542341f99b9f2747718fb58ef1c0011184c21e3ca80b1b9128b796b169c2b0aad8ebb2da5369f44db2c995ca56756c668e4bdfe38862cc7bae4d1ae505c6e936cbaae9b42e5bb2868c141c25b81ed7cc706846ea9a059ea659602b429dc9111f1b0b318f7402fe20698a93b770978d6035db8d4065c49275ffabe6875c662156d2a07bd3d91cc9a703f0f1b63990363e49bbfb67c86782759f1e3afd1094d66b6100d872b7254bda0b17b17b9cd1544509f9a72b79c21969254823c5013244c681a7728297869bb7cae716f9d59868d0c2aef982153e218ab55b8ce969f3185268a880c31988738589d42b81bbce5aedb29b0e99337f2389aa54350289742456384669187d2c6918c59033c924969a36751b10134549975b277afd9033f50ce65dc633e5a1d01a3b6138c6f01f7aea179c7c8c79e4bfb203fd9b28fa23c14e655ba7791928ac46fe1a6b8b93658092768e65e85c5aed9e897dd8a45712aabcb7c191907656849559ed84d4077c114d911f9e8267028a5856a9023ba51086786689267a56b06e6281f1bc3434b01bf96b0243e0886d7f43725f9aa598b515cea401b7751e1a259816526232a75d07274f6bc4bd0d1a61ebb11804aa79f094008e5a19085431ac11c508a6fbd50268a8c8021c4b19bfa56909720bfb726cae9a7b7736faf17cfba9b3b4a32adbb0450e90024bbe82cdbb02f62005ef334798cb3bd7fdaa7fa635fe3a643ef745f1037cb6b824b7c608515e37f5b73a488248de17c665d3bb4d92575266a0f6565264eb6a4643b52b3d23a80254610585c22c330a1e235ebc73de0babf9b39a9c5f48ef0ac060fe96a00fa4be76bbc4728371de9646dfa7d5c833de1f646287633deb41f4676c744722507f1c353a85e85ea10b3d43e8a784c3ef262f281bdd5db44e03c4ecad2a05b480ba199bb32bb07afc46257f95bdf516fea63c66cc48426facacc0656b7f60179f792b7d686dfe707d7b916b1e8b24950c74b9b6001604e5d333a35992a7cc44ce3bc1bbdb8c72f08428d8a6e5920619d8196a7d3269533bdcd3435183b5d6e98'
+  ),
+  privateSeed: hexStringToUint8Array(
+    'd710a2bc4789368cf20af5feeedc8b9a8d0a88ebd770f91e9a441146526f6b0e711d945a8786bdce9f167ddc5da8c7ab96dc305d6a366319d5f8a6924f183959'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'd54df4d679314cfd6f3291cb644b9973145a788c98ef94e68e9f8d1f92eb842396849e6914d8cf53090257882f26b1fb4c07a2b6adeaf3bd568c5d3c5b54320d950fa55980af8d96fd7d4965825b638842929f7b6acf5dfd3033f3f345af313280e0105faadd42715fff55550caa64368967f158ca3a7d00aeb4df1eccde240f5b2110efe65f58e9b3ee54987e07eae195279afa373d7462a48d9c79b7c8a3f8162d8430bd0d97bd901436297c123e41f74096065469d587b9e742773ffef91346e351bb95b43b8c082a287b979891174e7186dc8cf2d64a07711f6e9f17cf02addcc3b803fdc2e3eec9d391841f0b385e2d3e0908ab84188267ceddcfb69d2f444f69008816458da4dad59a79e33783339ccceb5524a0227f114a2367dbcc5f9785ef15665e921e877b2405876743eced6d76af9d4aa6a68033c2435158d7b0106058ef9852a81a462bfb3cf8b16027e5e08250c12cb1e4130668173623356f9793db05bd065ea36a61326ccaf53d2ec0a134dc1fc6c72a403d274630b73464aaa16b46a71c82d8a027cb5005f22426c0b5314b04b708d7aca3f4b8538ec19253f940b4b815af22ce82bdcd7da85a61ac187c92ef38c8c29900519164823747eaa5f68bea24e87e623cb74dac2c7b57fa1f285316fd744b83800ef36636cdf529230dc69e7bb28bc5c648db1dbb6148ae0510999b48238c1050ee5ea04986274efea863de71f5528cefccd39e0e179b5749b72729013cbb1e85b96a134759d80bcab2a5e4eb93fd7eef26ae23ed1e07d59172a48d09aeeffafe12ad46d791bfc6a713307dad2b8ed41487f289eb2ccab83612b0ec61c8dc3280ae899a4b57e2e133b5db0d896ad418a5afef5dab36f87c64793239672d50a67b6ac16d6fcbac5d3e711d487ccd0e4ac1c964aa5155cc3ba010b5783dcdd0ef10567e7cf19862c00d71230241ef1329c5213d0983a58f565c12dd786d68d8bc31158de6cd0273bdfd8e58f216489600575b9f3734cfde2a22c6f3301756285019c777f23eed8f101109e9ffbd7565523b5c0fb49509e66a28915e26bfcefc755cc02dc8637f31d359f0e2a7e8214c99d52f299f8c1f2cba34ff1e967458171a40e3c446f0fd2b443a06039f30ace8a07ec9f1577db6f9524f1e705ed797e4a6f99feda605721ebc688f1a72e0b267e9cc4f264f5a6c46da620a47f589ab0f80493e18e5c0559f9718cc99b3b2a9b8dbfe0d9416ece262265e9318094a24f9c0103ccdcf77d7cd00decd2201602b8f4986407021ee683e1a1e21587aff7052d30f76971e9c3486a481df81b224c169565237464eeea0d0c6b2e93f35bde3d08736ce85b8ac48ecf49da790ed8b26ff131e55a3817403f58503a228431655c28bb584323ed02bde2f700c964e5951b71910dd190d71fc37a1fd1931e7a6525c231df5e069e02db176f2e0cff568339d050e7c767a4af85409b60f9a36ba25260157e432c4a5e65718e474a2fdee8e954f35333cb0035f65c86559389e985f633d13a6193c6f8140275a305cbe675996f683532fed0130b4ae130ceec7476ba0b79ef0c3606e07884947c18f3920a32a3b39f66ccda82c159b3718f266d90de831c901cc758cd0dfe4a4affb4de77aad1e8f9ddf5acf39cb6594b5009949e5bca50298d9ad8bc7ae021c489b304d7be8fcde0e18bf4a817d79f7b512d62b30aff6d2bc31a2940d074e6f78c013c8220696cfd02ec83145e7b9802a97042c28e9e61957cafb7dc45d2ba1297223db253ad5c17a71c7de34b67727bfffb6ea54247258550af963751ae43e2a2409b63595e82390fc24c67182b574adc14cc7f6536428ad93ee47e91a589a51963de73aee5b8b050e37da2c899b0a7b67e586c25efa76a23891ec12f935478c9970f7cee6acf92e3f457c35e633bf2acf087bd0ab5ac27a6df9fe097a29e0cf3893dfe4da6b660ce28364a6fb7425789b74f705d8e139481b600616c9c3a9c2add0f8862b44e4c14ed4268f8ed9a6a1efbbac2c9882badd148d14e009d15044cc4e035992009a6036bad6a9ae75fd3659877cd347a45d99e99db2175583ed3ceb2560a8fdcfa35c1509315d4c8fb0e4a0ac298113285629261dd9b2b38fee181cc957a1cb5824711a67b1dce40d99ca28f923b2f99f2b38309643b14c014135021247b6e8d115b24bedf9bb206c7ee1f92aa62cb978c1b8db4f259a9c'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '2f521110a9e853867013cee34a38f107bea1c46890671608e4eca113ede9097e'
+  ),
 };
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
index 2c7493dfffd6..41512090f573 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
@@ -20,6 +20,9 @@ const generateKeyTestVectors = [
     {name: "ML-KEM-512", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
     {name: "ML-KEM-768", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
     {name: "ML-KEM-1024", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "MLKEM768-P256", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "MLKEM768-X25519", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "MLKEM1024-P384", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
     {name: "X25519", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
     {name: "X448", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
     {name: "KMAC128", resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js
new file mode 100644
index 000000000000..40c69270c9a9
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js
@@ -0,0 +1,6 @@
+// META: title=WebCryptoAPI: generateKey() for Failures
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=algorithm_registry.js
+// META: script=failures.js
+run_test(["MLKEM768-P256", "MLKEM768-X25519", "MLKEM1024-P384"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
index c70ecb331873..894da971d898 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
@@ -47,23 +47,22 @@ function run_test(algorithmNames, slowTest) {
                 assert_unreached("generateKey threw an unexpected error: " + err.toString());
             })
             .then(async function (result) {
-                // TODO: remove this block to enable ML-KEM JWK when its definition is done in IETF JOSE WG
-                if (result.publicKey?.algorithm.name.startsWith('ML-KEM')) {
-                    const promises = [
-                        subtle.exportKey('spki', result.publicKey),
-                        extractable ? subtle.exportKey('pkcs8', result.privateKey) : undefined,
-                        subtle.exportKey('raw-public', result.publicKey),
-                    ];
-                    if (extractable)
-                        promises.push(subtle.exportKey('raw-seed', result.privateKey));
-                    await Promise.all(promises);
-                } else if (resultType === "CryptoKeyPair") {
-                    const promises = [
-                        subtle.exportKey('jwk', result.publicKey),
-                        extractable ? subtle.exportKey('jwk', result.privateKey) : undefined,
-                        subtle.exportKey('spki', result.publicKey),
-                        extractable ? subtle.exportKey('pkcs8', result.privateKey) : undefined,
-                    ];
+                if (resultType === "CryptoKeyPair") {
+                    // TODO: enable ML-KEM JWK when its definition is done in IETF JOSE WG.
+                    const isMlKem = result.publicKey.algorithm.name.startsWith('ML-KEM');
+                    const isHybridKem = result.publicKey.algorithm.name.startsWith('MLKEM');
+                    const promises = [];
+
+                    if (!isMlKem) {
+                        promises.push(subtle.exportKey('jwk', result.publicKey));
+                        promises.push(extractable ? subtle.exportKey('jwk', result.privateKey) : undefined);
+                    }
+
+                    if (!isHybridKem) {
+                        promises.push(subtle.exportKey('spki', result.publicKey));
+                        if (extractable)
+                            promises.push(subtle.exportKey('pkcs8', result.privateKey));
+                    }
 
                     switch (result.publicKey.algorithm.name.substring(0, 2)) {
                         case 'ML':
@@ -90,7 +89,7 @@ function run_test(algorithmNames, slowTest) {
 
                     const [jwkPub, jwkPriv] = await Promise.all(promises);
 
-                    if (extractable) {
+                    if (extractable && !isMlKem) {
                         // Test that the JWK public key is a superset of the JWK private key.
                         for (const [prop, value] of Object.entries(jwkPub)) {
                             if (prop !== 'key_ops') {
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js
new file mode 100644
index 000000000000..bca75d4b6d71
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js
@@ -0,0 +1,7 @@
+// META: title=WebCryptoAPI: generateKey() Successful Calls
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
+// META: script=successes.js
+run_test(["MLKEM768-P256", "MLKEM768-X25519", "MLKEM1024-P384"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js
index f67b11a47e63..c85d2a9e02ba 100644
--- a/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js
@@ -109,6 +109,24 @@ const algorithms = [
         generateKeyParams: { name: "ML-KEM-1024" },
         usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
         publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
+    },
+    {
+        name: "MLKEM768-P256",
+        generateKeyParams: { name: "MLKEM768-P256" },
+        usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
+        publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
+    },
+    {
+        name: "MLKEM768-X25519",
+        generateKeyParams: { name: "MLKEM768-X25519" },
+        usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
+        publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
+    },
+    {
+        name: "MLKEM1024-P384",
+        generateKeyParams: { name: "MLKEM1024-P384" },
+        usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
+        publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
     }
 ];
 
@@ -145,8 +163,9 @@ algorithms.forEach(function(algorithm) {
 
         // Verify that the derived public key matches the original public key
         // by comparing their exported forms
-        const originalExported = await crypto.subtle.exportKey("spki", keyPair.publicKey);
-        const derivedExported = await crypto.subtle.exportKey("spki", publicKey);
+        const exportFormat = algorithm.name.startsWith("MLKEM") ? "raw-public" : "spki";
+        const originalExported = await crypto.subtle.exportKey(exportFormat, keyPair.publicKey);
+        const derivedExported = await crypto.subtle.exportKey(exportFormat, publicKey);
 
         assert_array_equals(
             new Uint8Array(originalExported),
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js
new file mode 100644
index 000000000000..3227434ed449
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js
@@ -0,0 +1,11 @@
+// META: title=WebCryptoAPI: importKey() for Hybrid KEM keys
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=Hybrid-KEM_importKey_fixtures.js
+// META: script=ml_importKey.js
+
+var keyData = hybridKemKeyData;
+
+runTests("MLKEM768-P256");
+runTests("MLKEM768-X25519");
+runTests("MLKEM1024-P384");
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js
new file mode 100644
index 000000000000..50b656c284c7
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js
@@ -0,0 +1,56 @@
+var hybridKemKeyData = {
+  'MLKEM768-P256': {
+    privateUsages: ['decapsulateBits', 'decapsulateKey'],
+    publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['jwk', 'raw-public'],
+    privateFormats: ['jwk', 'raw-seed'],
+    'raw-public': hexStringToUint8Array(
+      '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220d422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf'
+    ),
+    'raw-seed': hexStringToUint8Array(
+      '0000000000000000000000000000000000000000000000000000000000000000'
+    ),
+    jwk: {
+      priv: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      kty: 'AKP',
+      alg: 'MLKEM768-P256',
+      pub: 'PSCfcWdS9kCOf4m87vl6w4hTAEU3eSdkTvBGwKfK6XjIhBoBM6rE8eGnAnJ39nEhnPWLhdKcj-wI7dQy54ejz5k2_gAmoRPLnvsdchQElSe_4hQeoXCwKUpZQDqwzhZ2Couqlbgjy7iqzcwX7zJ3UiPHkeN0AWOUH5uz9jNGvvHAUMMfkyxicZQpr_FMK9Q4qxNb7WktVsd8BMu__WM1tXgxi1E3cehLFOqCEmIUHKAGzLi_JQCqEAiXDyFv5_GuNBJaopBJLAaaGJIircMi-XZJx2LH0xKK07smZ5cdB0QBS8O2dEXLzQs-fqafscufnDMfl0h5IBhykpJtBKJaJlCrvUSYK7DDxjAf5qYTMNJNijxwIdw-M5LHmhObN2E7umeimEKYUHuEpNYe7xis-5ea8tOcqkwNtFE4FTWddvw3jGOn9PMFOxcWjQIhzwwu7FUUuiNfgdBNZ8O1xRgJSRdnHCanwEZFdTPMMoRFgSd6A-sGXEUpp3mppYePKqw_gdue09jJNFaXBYy7mdN5vKFtj9th0SmWA5BSR5G50-UBuQC9HlAC4JW-BsI_H7IS9YAfJLayjAxUk9JG0Cqin6Os--FaxOIS6wtvaeu-olmicDqkwwgiS9t0HGXHpdS_94gnlQe7_lE9eqVpTns832KrNkMnQtSgyps1cLp0L6gDtGmJyFJupYbMT8MoZhQ7eWAXJfpUX9KAtARTAxi7wzcRlHELbXS-qmKesYo2qVO3WRWulpmbpciM3FakaGHFADLJtjC8wURaMIeJebxVosCVW_OZsjEgO5DGUbav4OJCtaVDJQsUL3KR7XU9gWCY95EzAqjOkWQXFmI9T8KsZ3KqXzZ0BCt8ShiiGGKJpKxOIAd0WWygPmeYx1BrmEmZ22rBQlhrrgeZ8ed2-fUkfcV02FVt35u7xMo2QyY0V_dCSAENYtQxEmg2Cuy0kCtFC_IFDsuLp6koINIz9aFO0xIlodF8pvGegliUz7GAfZIsvWB2ETS-QZFEvPcgBjZqRGATetkTbBE_BetUxAlSDtxy5BUMw6JLD4Ge7BG70ZypZFsIEKYLSoqenDlVOWoWU5VbBHvPT5hDPCcjbFcNdfgJ5EqvLcM2ZYJjUYcsKTNQqzJFGMjAyAtSHIDIGla9yWilZQMVqDDIuxdTLGLMwjsdRkEsJWsiT9RnRJGANQHQFDElx1dyOWiZZbaYnKVheTwPhcYqnhNIfaF2YqcYjHCxBApn7Uw_hedONpGCL7ljFNYTT-amJrPL4UYdYqe1c7LMdVef-iKWfjbOsqGqC3GHWiJ1HXBrcsqezQyBAK0KpYAJpcg__-kXWea6oKk0Wvmf47aVCdvIQDKGiESrP2W7Hfi-rfNkQuSOM5yWcCOlJUEVRMeJovBNrNBv_veDAiEEULkx9rTDKqs0o_UmC4EPTJqUb8ItO6q6qAuo2ZVdbcNehgm0JWtILNydiXfBpHo1TnxSf9sWcuFmkXuVzWNRggJh2qs2H4oty7JAxVq9aoEF5SkbQntWbXMea3BHGJz_INixIOCz5yRy0bAIaBIgD9NpjiPwbk9OCLu1TMIEnAOchFvmWZmcj6SNf2IyfBRs8bwLC7G5GzAXS3vCINQiAjv_aw3uJjUyxQPzmC5NPicHG4VVeKmpqmO4qMM5vw',
+    },
+  },
+  'MLKEM768-X25519': {
+    privateUsages: ['decapsulateBits', 'decapsulateKey'],
+    publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['jwk', 'raw-public'],
+    privateFormats: ['jwk', 'raw-seed'],
+    'raw-public': hexStringToUint8Array(
+      '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062'
+    ),
+    'raw-seed': hexStringToUint8Array(
+      '0000000000000000000000000000000000000000000000000000000000000000'
+    ),
+    jwk: {
+      priv: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      kty: 'AKP',
+      alg: 'MLKEM768-X25519',
+      pub: 'PSCfcWdS9kCOf4m87vl6w4hTAEU3eSdkTvBGwKfK6XjIhBoBM6rE8eGnAnJ39nEhnPWLhdKcj-wI7dQy54ejz5k2_gAmoRPLnvsdchQElSe_4hQeoXCwKUpZQDqwzhZ2Couqlbgjy7iqzcwX7zJ3UiPHkeN0AWOUH5uz9jNGvvHAUMMfkyxicZQpr_FMK9Q4qxNb7WktVsd8BMu__WM1tXgxi1E3cehLFOqCEmIUHKAGzLi_JQCqEAiXDyFv5_GuNBJaopBJLAaaGJIircMi-XZJx2LH0xKK07smZ5cdB0QBS8O2dEXLzQs-fqafscufnDMfl0h5IBhykpJtBKJaJlCrvUSYK7DDxjAf5qYTMNJNijxwIdw-M5LHmhObN2E7umeimEKYUHuEpNYe7xis-5ea8tOcqkwNtFE4FTWddvw3jGOn9PMFOxcWjQIhzwwu7FUUuiNfgdBNZ8O1xRgJSRdnHCanwEZFdTPMMoRFgSd6A-sGXEUpp3mppYePKqw_gdue09jJNFaXBYy7mdN5vKFtj9th0SmWA5BSR5G50-UBuQC9HlAC4JW-BsI_H7IS9YAfJLayjAxUk9JG0Cqin6Os--FaxOIS6wtvaeu-olmicDqkwwgiS9t0HGXHpdS_94gnlQe7_lE9eqVpTns832KrNkMnQtSgyps1cLp0L6gDtGmJyFJupYbMT8MoZhQ7eWAXJfpUX9KAtARTAxi7wzcRlHELbXS-qmKesYo2qVO3WRWulpmbpciM3FakaGHFADLJtjC8wURaMIeJebxVosCVW_OZsjEgO5DGUbav4OJCtaVDJQsUL3KR7XU9gWCY95EzAqjOkWQXFmI9T8KsZ3KqXzZ0BCt8ShiiGGKJpKxOIAd0WWygPmeYx1BrmEmZ22rBQlhrrgeZ8ed2-fUkfcV02FVt35u7xMo2QyY0V_dCSAENYtQxEmg2Cuy0kCtFC_IFDsuLp6koINIz9aFO0xIlodF8pvGegliUz7GAfZIsvWB2ETS-QZFEvPcgBjZqRGATetkTbBE_BetUxAlSDtxy5BUMw6JLD4Ge7BG70ZypZFsIEKYLSoqenDlVOWoWU5VbBHvPT5hDPCcjbFcNdfgJ5EqvLcM2ZYJjUYcsKTNQqzJFGMjAyAtSHIDIGla9yWilZQMVqDDIuxdTLGLMwjsdRkEsJWsiT9RnRJGANQHQFDElx1dyOWiZZbaYnKVheTwPhcYqnhNIfaF2YqcYjHCxBApn7Uw_hedONpGCL7ljFNYTT-amJrPL4UYdYqe1c7LMdVef-iKWfjbOsqGqC3GHWiJ1HXBrcsqezQyBAK0KpYAJpcg__-kXWea6oKk0Wvmf47aVCdvIQDKGiESrP2W7Hfi-rfNkQuSOM5yWcCOlJUEVRMeJovBNrNBv_veDAiEEULkx9rTDKqs0o_UmC4EPTJqUb8ItO6q6qAuo2ZVdbcNehgm0JWtILNydiXfBpHo1TnxSf9sWcuFmkXuVzWNRggJh2qs2H4oty7JAxVq9aoEF5SkbQntWbXMea3BHGJz_INixIOCz5yRy0bAIaBIgD9NpjiPwbk9OCLu1TML2NgG3-FrM_uotF5ZMZrUZSw8I4YUZ-q7hlOPBAoIwYg',
+    },
+  },
+  'MLKEM1024-P384': {
+    privateUsages: ['decapsulateBits', 'decapsulateKey'],
+    publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['jwk', 'raw-public'],
+    privateFormats: ['jwk', 'raw-seed'],
+    'raw-public': hexStringToUint8Array(
+      'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d677d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c749c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b04d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e6853453b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e298c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cbaa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c5938258c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec06746749473e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed77cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865ab22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db657460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b510b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e78544887f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b388725758a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1adde369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a875d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a7372632ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a306e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e370941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da896133272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa702265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f'
+    ),
+    'raw-seed': hexStringToUint8Array(
+      '0000000000000000000000000000000000000000000000000000000000000000'
+    ),
+    jwk: {
+      priv: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      kty: 'AKP',
+      alg: 'MLKEM1024-P384',
+      pub: 'oQvItVTNUZgM27zMMEFCD9Mg_ot0x6hCeMY8FwcNwjG2GrJpudZ32SAmEYZlS0Vx9ReX1cNCuAcLxskryhat7MYx5OlMdQixEXMMdJxz4tam-XFVyyaczAanGiG-89JpRjyTUEin9GNsezIAc3CQI_ewTQUwVxqab3GCgIcLtjh10_WZvCKblYac1btdJmQIVtQLgoGY_fLAmZmP_fdy5GIzbFIc0ya15Jl72VwTXFe9AsevqAopI9UQlRd47lElsqoY-QRFRTuFeJIkclslknlpislCbIgrqrw41Ps6P2gxGAkYuYJeDkGBVNeK66tefnBm5pslZ0dr8Rd_4Hmjgpi-bwGwmMM4UaslMStS4ypXUMK3PSk8C4EEc7MQqvBi8ZkUxzd7LpA4j1db9eaFNFO5WnSqGNYtSuN-aZakirUhdIipLXsB4xXFC2ggQUN5KvxPg2fAzgZasyAUvbVRX-BZRgiq0SGJlHJK-qqi3wNV9GZmtuAqOHttPaRxPtthC7BIw6IHi4AOnqSD8gCcltJMcbLLyOEgDAJ3ODxcJ4leKYw2B3Ac5YcCqRkDJ0oEFAgjTLACHvKxxRMUGbRE3IS4nRR9H-Q8Q_Z22QZzXZyipZwiMtl_1Koa4rs9GxcMpVPLJXSVT9xmifrGI8uqMZgtgkJNWlZP73qLpRtE3xUFOytFvsSqHtSZKRI9r3VBdcWTgljGCLJNBiBCq0u-5eVTpepidSFziuWrLga9mLAgeHsvX6UetMRsK_kOVaSVYDQGZ_iKxBQyt_VR39mMA3x595tBuYWosfUTRVUM2BZxQ2IEB3jEPjeKKIOUvQKMjDG1qQS8SlZIpZYDXLOPDiduEsmpb4QlBWsFoTZkLdLLdUYwNkhboaUFOeQg4eMd-sUpytbGjsBnRnSUc-BQpKyStxmb7Osjm2wSyOcWtmYHrspkpYULAfmdCxdqd1l4Htd8sbpA0XrFxssGyULAAsLPbvyxIfEK0qRf94FCbnEEy9ynO4GGWrIrALqDQ1WuSFomLzVCSJMsK-F4Npo91-JCj9w3k0arK3VMQ9tldGDLCcXEi1gQy3pcYVbPh0QMnjakhpqKxFizgvwXiRWpzhvN2nxIgHwgfmVv-4C_M-MryMeyDvYFcmEs6sma0cVs5adkspt0wXpbUQsa_LGKGvw1wSrCE3JTJfm3ouszj-TACAwxpYqZXbcCfZAOeFRIh_kK2kZ9Djg8EZxTmTELxnNYdOiAT_bCuuV_LDNXy2JwM8EqWSSyDOWr8RMXK9K3cIbKxUOBF5O7pxc0yfAFrCZWRgvDCkQrOIcldYpiPje6bik6v7hPNEIp83PCFMp3anwFrcRl_tk7nPd_ACKrcfGt3jad2PQgpYwFfBTMGNxH2nwSsIZHPqtBllKWcAHE5Co4HIulOah10hqZRRM7q5vB5TpgDed8v7Kuq2sZztTG6qiZjuahV3JV9xMtgKMtbAxuxEycSyhpmmRbsLyVjgAnUHeSUwlRmwgkxwAN-mGRLsBJBjoGfQCwWQU-UIpb_uY0c4acioUQr4mM11coVPXDivlvX5enNyYy6nu0tvuDHGEq9xGR_5gGs3m81DxgWbex-VN0FESvcTwVXZYnIrlHqiOjKomzVqanUIqtY5aMHep4_xiqwnqJqntCsNdIHdPMZJQh5ROXeCIYrFRBdgulGgMo1mtDb-wy16pNaODK0bwU9yQckDSA-AmYP8LDDZMTjPY7WbxzesCBkok9A5GHqBG-89Mgnre40eBbWyUc73YKIQsnMoZ6syBJujw1TjhYrue3HfeSkkcw2OhC5IQSK1BnewowbmHPIbYgkdoYuTcZKTagnlpBjPeLZmFX3Ud68cNqEjIBKVIoQONwlBFXgIeCpTNbCsENcOG-r9QBB0uEuYJsxYqtIXuuD0GbLaiWEzJy2PIsb0IPzHOPzMEIL8k8ffCZTGvPLMiikDe2uytLzvSw7oyvhQa8XsuggqVoBsHO3guUQzimmmaCVMEVCuBQMOJWsrZ2YboCfZdXbaYTrIx8KQUfEkC5awwSfiZNXh27_pVhpWfVyRA2c7RGs8zqbF9_NPCTSKXUpYsEmIcdyUDul7UMAzb5pgwymfmVYKxwZXonvvpwImXOWQWD4EooMmCS096iEY3R316B19MBTsS1zmfctF7wAXad1dWtp2k00410CSRxK_rmchadj4dEwVE0bShfu2U_g6oP',
+    },
+  },
+};
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
index abccc10c63fb..463213a80147 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
@@ -4,6 +4,8 @@ var keyData = {
   'ML-DSA-44': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-44'],
     spki: mldsaKeyFixtures.spki['ML-DSA-44'],
     'raw-public': hexStringToUint8Array(
@@ -23,6 +25,8 @@ var keyData = {
   'ML-DSA-65': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-65'],
     spki: mldsaKeyFixtures.spki['ML-DSA-65'],
     'raw-public': hexStringToUint8Array(
@@ -42,6 +46,8 @@ var keyData = {
   'ML-DSA-87': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-87'],
     spki: mldsaKeyFixtures.spki['ML-DSA-87'],
     'raw-public': hexStringToUint8Array(
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js
index f3a5f6687dc5..3adec94ec410 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js
@@ -2,6 +2,8 @@ var keyData = {
   'ML-KEM-512': {
     privateUsages: ['decapsulateBits', 'decapsulateKey'],
     publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: new Uint8Array([
       48, 84, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 4, 1, 4, 66,
       128, 64, 165, 38, 193, 164, 132, 122, 104, 173, 83, 214, 227, 31, 231,
@@ -33,6 +35,8 @@ var keyData = {
   'ML-KEM-768': {
     privateUsages: ['decapsulateBits', 'decapsulateKey'],
     publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: new Uint8Array([
       48, 84, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 4, 2, 4, 66,
       128, 64, 166, 200, 29, 100, 198, 48, 80, 164, 143, 215, 2, 108, 106, 162,
@@ -63,6 +67,8 @@ var keyData = {
   'ML-KEM-1024': {
     privateUsages: ['decapsulateBits', 'decapsulateKey'],
     publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: new Uint8Array([
       48, 84, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 4, 3, 4, 66,
       128, 64, 152, 117, 178, 230, 181, 134, 244, 129, 167, 125, 166, 8, 181,
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
index a33c3a85b912..545cec51b59f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
@@ -11,7 +11,7 @@ function runTests(algorithmName) {
   [true, false].forEach(function (extractable) {
     // Test public keys first
     allValidUsages(data.publicUsages, true).forEach(function (usages) {
-      ['spki', 'jwk', 'raw-public'].forEach(function (format) {
+      data.publicFormats.forEach(function (format) {
         if (format === 'jwk') {
           // Not all fields used for public keys
           testFormat(
@@ -37,7 +37,7 @@ function runTests(algorithmName) {
 
     // Next, test private keys
     allValidUsages(data.privateUsages).forEach(function (usages) {
-      ['pkcs8', 'jwk', 'raw-seed'].forEach(function (format) {
+      data.privateFormats.forEach(function (format) {
         testFormat(format, algorithm, data, algorithmName, usages, extractable);
       });
     });
diff --git a/test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js b/test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js
new file mode 100644
index 000000000000..465f86df55a8
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js
@@ -0,0 +1,32 @@
+// META: title=WebCryptoAPI: Hybrid KEM CryptoKey serialization
+// META: script=../util/helpers.js
+// META: script=serialization.js
+run_test([
+  {
+    name: 'MLKEM768-P256',
+    resultType: 'CryptoKeyPair',
+    usages: [
+      'decapsulateBits', 'decapsulateKey', 'encapsulateBits', 'encapsulateKey'
+    ],
+    publicFormat: 'raw-public',
+    privateFormat: 'raw-seed'
+  },
+  {
+    name: 'MLKEM768-X25519',
+    resultType: 'CryptoKeyPair',
+    usages: [
+      'decapsulateBits', 'decapsulateKey', 'encapsulateBits', 'encapsulateKey'
+    ],
+    publicFormat: 'raw-public',
+    privateFormat: 'raw-seed'
+  },
+  {
+    name: 'MLKEM1024-P384',
+    resultType: 'CryptoKeyPair',
+    usages: [
+      'decapsulateBits', 'decapsulateKey', 'encapsulateBits', 'encapsulateKey'
+    ],
+    publicFormat: 'raw-public',
+    privateFormat: 'raw-seed'
+  },
+]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
index a8f730e9bfc4..5c4699dcfb7f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
@@ -33,6 +33,24 @@ const modernAlgorithms = {
       'decapsulateKey', 'decapsulateBits', 'getPublicKey'
     ],
   },
+  'MLKEM768-P256': {
+    operations: [
+      'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
+      'decapsulateKey', 'decapsulateBits', 'getPublicKey'
+    ],
+  },
+  'MLKEM768-X25519': {
+    operations: [
+      'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
+      'decapsulateKey', 'decapsulateBits', 'getPublicKey'
+    ],
+  },
+  'MLKEM1024-P384': {
+    operations: [
+      'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
+      'decapsulateKey', 'decapsulateBits', 'getPublicKey'
+    ],
+  },
 
   // Symmetric algorithms
   'ChaCha20-Poly1305': {
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/helpers.js b/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
index cc44dd16b1c9..86a4a79f0b9d 100644
--- a/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
+++ b/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
@@ -31,6 +31,9 @@ var registeredAlgorithmNames = [
     "ML-KEM-512",
     "ML-KEM-768",
     "ML-KEM-1024",
+    "MLKEM768-P256",
+    "MLKEM768-X25519",
+    "MLKEM1024-P384",
     "ChaCha20-Poly1305",
     "Argon2i",
     "Argon2d",
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index fa3732a0e9fd..9e7979e55460 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -100,7 +100,7 @@
     "path": "web-locks"
   },
   "WebCryptoAPI": {
-    "commit": "e235e089b4e44a598f2d61e93732e0c4d9f03e04",
+    "commit": "55ce71bb9deaf4b8a30fe80f95558a10699fb433",
     "path": "WebCryptoAPI"
   },
   "webidl": {
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 7715d5456152..eb85fa94e63e 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -54,21 +54,25 @@ if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   skip(
     'encap_decap/encap_decap_bits.tentative.https.any.js',
     'encap_decap/encap_decap_keys.tentative.https.any.js',
+    'generateKey/failures_Hybrid-KEM.tentative.https.any.js',
     'generateKey/failures_ML-DSA.tentative.https.any.js',
     'generateKey/failures_ML-KEM.tentative.https.any.js',
+    'generateKey/successes_Hybrid-KEM.tentative.https.any.js',
     'generateKey/successes_ML-DSA.tentative.https.any.js',
     'generateKey/successes_ML-KEM.tentative.https.any.js',
+    'import_export/Hybrid-KEM_importKey.tentative.https.any.js',
     'import_export/ML-DSA_importKey.tentative.https.any.js',
     'import_export/ML-KEM_importKey.tentative.https.any.js',
+    'serialization/hybridkem.tentative.https.window.js',
     'serialization/mldsa.tentative.https.any.js',
     'serialization/mlkem.tentative.https.any.js',
     'sign_verify/mldsa.tentative.https.any.js');
 
   skipSubtests(
-    ['getPublicKey.tentative.https.any.js', /ml-(?:kem|dsa)/i],
+    ['getPublicKey.tentative.https.any.js', /ml-?(?:kem|dsa)/i],
     [
       'supports-modern.tentative.https.any.js',
-      /(?:ml-(?:kem|dsa)|(?:en|de)capsulateKey)/i,
+      /(?:ml-?(?:kem|dsa)|(?:en|de)capsulateKey)/i,
     ]);
 }
 
@@ -79,26 +83,30 @@ if (isBoringSSL) {
     'digest/cshake.tentative.https.any.js',
     'digest/sha3.tentative.https.any.js',
     'generateKey/failures_Ed448.tentative.https.any.js',
+    'generateKey/failures_Hybrid-KEM.tentative.https.any.js',
     'generateKey/failures_X448.tentative.https.any.js',
     'generateKey/successes_Ed448.tentative.https.any.js',
+    'generateKey/successes_Hybrid-KEM.tentative.https.any.js',
     'generateKey/successes_X448.tentative.https.any.js',
+    'import_export/Hybrid-KEM_importKey.tentative.https.any.js',
     'import_export/okp_importKey_Ed448.tentative.https.any.js',
     'import_export/okp_importKey_failures_Ed448.tentative.https.any.js',
     'import_export/okp_importKey_failures_X448.tentative.https.any.js',
     'import_export/okp_importKey_X448.tentative.https.any.js',
     'serialization/ed448.tentative.https.any.js',
+    'serialization/hybridkem.tentative.https.window.js',
     'serialization/x448.tentative.https.any.js',
     'sign_verify/eddsa_curve448.tentative.https.any.js');
 
   skipSubtests(
-    ['encap_decap/encap_decap_bits.tentative.https.any.js', /ml-kem-512/i],
-    ['encap_decap/encap_decap_keys.tentative.https.any.js', /ml-kem-512/i],
+    ['encap_decap/encap_decap_bits.tentative.https.any.js', /(?:ml-kem-512|mlkem)/i],
+    ['encap_decap/encap_decap_keys.tentative.https.any.js', /(?:ml-kem-512|mlkem)/i],
     ['generateKey/failures_ML-KEM.tentative.https.any.js', /ml-kem-512/i],
     ['generateKey/successes_ML-KEM.tentative.https.any.js', /ml-kem-512/i],
-    ['getPublicKey.tentative.https.any.js', /(?:ed448|x448|ml-kem-512)/i],
+    ['getPublicKey.tentative.https.any.js', /(?:ed448|x448|ml-kem-512|mlkem)/i],
     ['import_export/ML-KEM_importKey.tentative.https.any.js', /ml-kem-512/i],
     ['serialization/mlkem.tentative.https.any.js', /ml-kem-512/i],
-    ['supports-modern.tentative.https.any.js', /ml-kem-512/i]);
+    ['supports-modern.tentative.https.any.js', /(?:ml-kem-512|mlkem)/i]);
 }
 
 if (hasFIPS(3)) {
@@ -144,12 +152,16 @@ if (hasFIPS(3, 5)) {
     'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',
+    'generateKey/failures_Hybrid-KEM.tentative.https.any.js',
+    'generateKey/successes_Hybrid-KEM.tentative.https.any.js',
     'generateKey/successes_X25519.https.any.js',
     'generateKey/successes_X448.tentative.https.any.js',
+    'import_export/Hybrid-KEM_importKey.tentative.https.any.js',
     'import_export/okp_importKey_X25519.https.any.js',
     'import_export/okp_importKey_X448.tentative.https.any.js',
     'import_export/okp_importKey_failures_X25519.https.any.js',
     'import_export/okp_importKey_failures_X448.tentative.https.any.js',
+    'serialization/hybridkem.tentative.https.window.js',
     'serialization/x25519.https.any.js',
     'serialization/x448.tentative.https.any.js');
 
@@ -158,11 +170,14 @@ if (hasFIPS(3, 5)) {
       'derive_bits_keys/derived_bits_length.https.any.js',
       /^X25519 derivation/,
     ],
-    ['getPublicKey.tentative.https.any.js', /(?:X25519|X448)/],
+    ['encap_decap/encap_decap_bits.tentative.https.any.js', /mlkem/i],
+    ['encap_decap/encap_decap_keys.tentative.https.any.js', /mlkem/i],
+    ['getPublicKey.tentative.https.any.js', /(?:X25519|X448|MLKEM)/],
     [
       'import_export/raw_format_aliases.tentative.https.any.js',
       /(?:X25519|X448)/,
     ],
+    ['supports-modern.tentative.https.any.js', /mlkem/i],
     [
       'supports.tentative.https.any.js',
       /(?:X25519|^deriveKey promise tests|^supports validates the ECDH public key$)/,

From a701540af365e893d65c36730621b349b989ff91 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pipobscure@users.noreply.github.com>
Date: Mon, 7 Sep 2026 16:48:56 +0200
Subject: [PATCH 146/202] vfs: answer for unowned paths under reserved root

The module loader manufactures paths under the reserved VFS root that
no layer owns: resolving a mount point as a directory first probes the
sibling names `<mount>.js`, `<mount>.json` and `<mount>.node`, and a
package.json walk-up passes the parents of the mount point. The lookup
declined those because their layer segment is not a plain id, so they
fell through to the native loader and the real file system.

On POSIX that is harmless (ENOTDIR under /dev/null), but on Windows
the root sits under `\\.\nul`, and `\\.\nul\<anything>` opens the NUL
device: libuv reports it as a character device and a read returns
nothing. The loader therefore picked `\\.\nul\vfs\<id>.js` as an
existing file, and the native walk-up above it then read the device as
an empty package.json and failed with ERR_INVALID_PACKAGE_CONFIG for
`\\.\nul\package.json`. Any require() of a mount point hits this on
Windows.

Distinguish "under the root but unowned" from "outside the root" in the
lookup and have every loader override report the former as not found:
stat gives ENOENT, reads and realpath throw ENOENT, the package.json
lookups return their "no package.json" results, and upward walks stop
at the reserved root. Paths outside the root still go to the native
loader as before.

Refs: https://github.com/nodejs/node/pull/65748
Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65814
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 lib/internal/vfs/setup.js                     | 110 ++++++++++++------
 .../test-vfs-reserved-root-unowned.js         |  59 ++++++++++
 2 files changed, 133 insertions(+), 36 deletions(-)
 create mode 100644 test/parallel/test-vfs-reserved-root-unowned.js

diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index a45cd47a9bf4..3e6f246d794a 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -35,6 +35,7 @@ const { assertEncoding, setVfsHandlers } = require('internal/fs/utils');
 const permission = require('internal/process/permission');
 const { getOptionValue } = require('internal/options');
 const nativeModulesBinding = internalBinding('modules');
+const { UV_ENOENT } = internalBinding('uv');
 let debug = require('internal/util/debuglog').debuglog('vfs', (fn) => {
   debug = fn;
 });
@@ -115,29 +116,50 @@ function deregisterVFS(vfs) {
 }
 
 /**
- * Resolves a path string to the active VFS that owns it, or null.
- * Ownership is decidable from the path alone: all mount points live
- * under the reserved `${os.devNull}/vfs/<id>` namespace, so a single
- * prefix comparison rejects every real-file-system path and a map
- * lookup finds the owning layer. The normalized path is returned
+ * Resolves a path string to the reserved VFS root, or null for a path
+ * outside it. Ownership is decidable from the path alone: all mount
+ * points live under the reserved `${os.devNull}/vfs/<id>` namespace, so
+ * a single prefix comparison rejects every real-file-system path and a
+ * map lookup finds the owning layer. The normalized path is returned
  * alongside the layer so downstream helpers can skip renormalization.
+ *
+ * A path under the root that no active layer owns comes back with
+ * `vfs: null` rather than as `null`, because the two cases must not be
+ * treated alike by the module loader. The loader manufactures such
+ * paths itself: resolving a mount point as a directory first probes the
+ * sibling names `<mount>.js`, `<mount>.json`, ..., and a package.json
+ * walk-up passes the parents of the mount point. They cannot name
+ * anything real, but on Windows the root sits under `\\.\nul`, and
+ * `\\.\nul\<anything>` opens the NUL device, which stats as a character
+ * device and reads as empty. Handed to the native loader, such a probe
+ * "finds" a file and the walk-up above it rejects the empty device as an
+ * invalid package.json, so the loader must answer for the whole root.
  * @param {string} inputPath
- * @returns {{ vfs: object, normalized: string }|null}
+ * @returns {{ vfs: object|null, normalized: string }|null}
  */
-function findVFS(inputPath) {
+function findVFSOrRoot(inputPath) {
   const normalized = normalizeMountedPath(inputPath);
   if (!StringPrototypeStartsWith(normalized, normalizedVfsRootPrefix)) {
     return null;
   }
   const layerId = getLayerIdFromPath(normalized);
-  if (layerId === -1) return null;
-  const vfs = activeVFSLayers.get(layerId);
+  const vfs = layerId === -1 ? undefined : activeVFSLayers.get(layerId);
   if (vfs === undefined || !vfs.shouldHandleNormalized(normalized)) {
-    return null;
+    return { vfs: null, normalized };
   }
   return { vfs, normalized };
 }
 
+/**
+ * Resolves a path string to the active VFS that owns it, or null.
+ * @param {string} inputPath
+ * @returns {{ vfs: object, normalized: string }|null}
+ */
+function findVFS(inputPath) {
+  const r = findVFSOrRoot(inputPath);
+  return r === null || r.vfs === null ? null : r;
+}
+
 /**
  * Drop the cache entries under `vfs`'s mount point from the
  * JS-reachable loader caches. Real-fs entries and other-VFS entries
@@ -210,16 +232,16 @@ function findVFSForStat(filename) {
 }
 
 /**
- * Finds the VFS owning `filename` and reads it.
+ * Reads `filename` from the VFS that owns it, reporting a missing file
+ * or a directory the way the native loader's read does.
+ * @param {object} vfs The VFS owning filename
  * @param {string} filename The absolute path to read
  * @param {string|object} options Read options
- * @returns {{ vfs: object, content: Buffer|string }|null}
+ * @returns {Buffer|string}
  */
-function findVFSForRead(filename, options) {
-  const r = findVFS(filename);
-  if (r === null) return null;
+function readVFS(vfs, filename, options) {
   try {
-    return { vfs: r.vfs, content: r.vfs.readFileSync(filename, options) };
+    return vfs.readFileSync(filename, options);
   } catch (e) {
     const code = e?.code;
     if (code === 'ENOENT' || code === 'EISDIR') {
@@ -794,30 +816,40 @@ function installModuleLoaderOverrides() {
   // wrapLoaderMethod then falls through to the native binding.
   setLoaderOverrides({
     internalModuleStat(filename) {
-      const result = findVFSForStat(filename);
-      return result !== null ? result.result : undefined;
+      const r = findVFSOrRoot(filename);
+      if (r === null) return undefined;
+      return r.vfs === null ? UV_ENOENT : vfsStat(r.vfs, filename);
     },
     readFileSync(filename, options) {
       const pathStr = typeof filename === 'string' ? filename :
         (filename instanceof URL ? fileURLToPath(filename) : String(filename));
-      const result = findVFSForRead(pathStr, options);
-      return result !== null ? result.content : undefined;
+      const r = findVFSOrRoot(pathStr);
+      if (r === null) return undefined;
+      if (r.vfs === null) throw createENOENT('open', pathStr);
+      return readVFS(r.vfs, pathStr, options);
     },
     realpathSync(filename) {
-      return findVFSWith(filename, 'realpath', (vfs, n) => vfs.realpathSync(n));
+      const r = findVFSOrRoot(filename);
+      if (r === null) return undefined;
+      if (r.vfs === null || !r.vfs.existsSync(filename)) {
+        throw createENOENT('realpath', filename);
+      }
+      return r.vfs.realpathSync(filename);
     },
     getResolutionRoot(pathStr) {
-      const r = findVFS(pathStr);
+      const r = findVFSOrRoot(pathStr);
       if (r === null) return undefined;
-      const mountPoint = r.vfs.mountPoint;
       // The boundary is compared as a plain string prefix by the
-      // callers, so only report it when the input carries the mount
-      // point verbatim.
-      return StringPrototypeStartsWith(pathStr, mountPoint) ?
-        mountPoint : undefined;
+      // callers, so only report it when the input carries it verbatim.
+      // An unowned path stops at the reserved root itself, so no
+      // node_modules lookup walks out into the real file system.
+      const boundary = r.vfs === null ?
+        getNormalizedVfsRoot() : r.vfs.mountPoint;
+      return StringPrototypeStartsWith(pathStr, boundary) ?
+        boundary : undefined;
     },
     legacyMainResolve(pkgPath, main, base) {
-      if (findVFS(pkgPath) === null) return undefined;
+      if (findVFSOrRoot(pkgPath) === null) return undefined;
 
       for (let i = 0; i < legacyMainResolveExtensions.length; i++) {
         const byMain = i <= kResolvedByMainIndexNode;
@@ -835,14 +867,14 @@ function installModuleLoaderOverrides() {
       throw new ERR_MODULE_NOT_FOUND(initial, base, undefined);
     },
     getFormatOfExtensionlessFile(filePath) {
-      let result;
+      const r = findVFSOrRoot(filePath);
+      if (r === null) return undefined;
+      let content;
       try {
-        result = findVFSForRead(filePath, null);
+        content = r.vfs === null ? null : readVFS(r.vfs, filePath, null);
       } catch {
         return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
       }
-      if (result === null) return undefined;
-      const content = result.content;
       // Wasm magic bytes: 0x00 0x61 0x73 0x6d
       if (content && content.length >= 4 &&
           content[0] === 0x00 && content[1] === 0x61 &&
@@ -852,8 +884,9 @@ function installModuleLoaderOverrides() {
       return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
     },
     readPackageJSON(jsonPath, isESM, base, specifier) {
-      const r = findVFS(jsonPath);
+      const r = findVFSOrRoot(jsonPath);
       if (r === null) return undefined;
+      if (r.vfs === null) return kLoaderOverrideNoResult;
       const { vfs } = r;
       if (vfsStat(vfs, jsonPath) !== 0) return kLoaderOverrideNoResult;
       let content;
@@ -868,8 +901,9 @@ function installModuleLoaderOverrides() {
         content, jsonPath, isESM, base, specifier);
     },
     getNearestParentPackageJSON(checkPath) {
-      const r = findVFS(checkPath);
+      const r = findVFSOrRoot(checkPath);
       if (r === null) return undefined;
+      if (r.vfs === null) return kLoaderOverrideNoResult;
       const found = findVFSPackageJSON(r.vfs, checkPath, r.normalized);
       return found.tuple ?? kLoaderOverrideNoResult;
     },
@@ -884,8 +918,11 @@ function installModuleLoaderOverrides() {
       } else {
         filePath = resolved;
       }
-      const r = findVFS(filePath);
+      const r = findVFSOrRoot(filePath);
       if (r === null) return undefined;
+      // The "not found" marker is the package.json beside the queried
+      // path, which is what the native binding reports for it.
+      if (r.vfs === null) return join(dirname(filePath), 'package.json');
       const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
       if (found.tuple !== undefined) return found.tuple;
       return found.sentinel;
@@ -901,8 +938,9 @@ function installModuleLoaderOverrides() {
       } else {
         filePath = url;
       }
-      const r = findVFS(filePath);
+      const r = findVFSOrRoot(filePath);
       if (r === null) return undefined;
+      if (r.vfs === null) return kLoaderOverrideNoResult;
       const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
       if (found.tuple !== undefined) {
         // Tuple shape: [name, main, type, imports, exports, filePath].
diff --git a/test/parallel/test-vfs-reserved-root-unowned.js b/test/parallel/test-vfs-reserved-root-unowned.js
new file mode 100644
index 000000000000..e6a5b319f610
--- /dev/null
+++ b/test/parallel/test-vfs-reserved-root-unowned.js
@@ -0,0 +1,59 @@
+// Flags: --experimental-vfs --expose-internals
+'use strict';
+
+// The module loader manufactures paths under the reserved VFS root that no
+// layer owns: resolving a mount point as a directory first probes the sibling
+// names `<mount>.js`, `<mount>.json`, ..., and a package.json walk-up passes
+// the parents of the mount point. Such paths cannot name anything real, but
+// they must still be answered by the VFS instead of being handed to the native
+// loader: on Windows the reserved root sits under `\\.\nul`, and
+// `\\.\nul\<anything>` opens the NUL device, which stats as a character device
+// and reads as empty. The native loader would then "find" a file at
+// `<mount>.js` and reject the empty package.json above it as invalid JSON.
+
+require('../common');
+const assert = require('assert');
+const path = require('path');
+const { pathToFileURL } = require('url');
+const vfs = require('node:vfs');
+const { loaderMethods } = require('internal/modules/helpers');
+const { getNormalizedVfsRoot } = require('internal/vfs/router');
+
+const layer = vfs.create();
+layer.writeFileSync('/index.js', 'module.exports = "ran";');
+const mountPoint = layer.mount();
+
+const root = getNormalizedVfsRoot();
+const unowned = [
+  `${mountPoint}.js`,
+  `${mountPoint}.json`,
+  `${mountPoint}.node`,
+  path.join(root, 'package.json'),
+  path.join(root, 'nope', 'index.js'),
+];
+
+for (const p of unowned) {
+  assert.ok(loaderMethods.internalModuleStat(p) < 0, p);
+  assert.throws(() => loaderMethods.readFileSync(p), { code: 'ENOENT' }, p);
+  assert.throws(() => loaderMethods.realpathSync(p), { code: 'ENOENT' }, p);
+  assert.strictEqual(loaderMethods.getNearestParentPackageJSON(p), undefined, p);
+  assert.strictEqual(loaderMethods.readPackageJSON(p, false), undefined, p);
+  assert.strictEqual(loaderMethods.getPackageType(pathToFileURL(p).href), undefined, p);
+  // The "not found" marker is the last candidate examined, like the native
+  // binding returns.
+  assert.strictEqual(
+    loaderMethods.getPackageScopeConfig(pathToFileURL(p).href),
+    path.join(path.dirname(p), 'package.json'), p);
+  // Upward walks (node_modules lookups) stop at the reserved root rather than
+  // continuing into the real file system.
+  assert.strictEqual(loaderMethods.getResolutionRoot(p), root, p);
+}
+
+// Paths outside the reserved root are still left to the native loader.
+assert.strictEqual(loaderMethods.getResolutionRoot(__filename), undefined);
+
+// The mount point itself resolves as a directory to its index through the
+// layer, which is the sequence that produced the sibling probes above.
+assert.strictEqual(require(mountPoint), 'ran');
+
+layer.unmount();

From 0f5cb92cf35297d40d9d13b1982f920c3ba31ac8 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sun, 12 Jul 2026 15:34:00 +0200
Subject: [PATCH 147/202] stream: allocate stream read buffers from a slab

Read buffers for streams that emit their data to JS were allocated per
read: a 64KB backing store, tracked in a map, and then - since reads
rarely fill the whole buffer - reallocated to the right size and copied.

Allocate read buffers from a 64KB slab instead. Reads reserve the
suggested size from the slab and JS receives a view over the slab's
ArrayBuffer at the read's offset, using the offset mechanism that
onStreamRead already supports. Unused reservation space is rewound when
a read returns less than was reserved, so small reads (e.g. TLS records)
share a slab.

This removes the per-read allocations, the map bookkeeping and the
resize copy.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64455
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
---
 benchmark/net/tcp-raw-c2s.js                  | 10 +-
 benchmark/net/tcp-raw-pipe.js                 | 13 ++-
 benchmark/net/tcp-raw-s2c.js                  | 10 +-
 lib/internal/webstreams/adapters.js           |  4 +-
 src/env.cc                                    | 99 +++++++++++++++++++
 src/env.h                                     | 64 ++++++++++++
 src/stream_base.cc                            | 33 ++++---
 ...t-whatwg-webstreams-adapters-streambase.js | 15 ++-
 8 files changed, 221 insertions(+), 27 deletions(-)

diff --git a/benchmark/net/tcp-raw-c2s.js b/benchmark/net/tcp-raw-c2s.js
index 5b174f50e81c..24e35906c925 100644
--- a/benchmark/net/tcp-raw-c2s.js
+++ b/benchmark/net/tcp-raw-c2s.js
@@ -23,7 +23,11 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   const serverHandle = new TCP(TCPConstants.SERVER);
@@ -55,9 +59,7 @@ function main({ dur, len, type }) {
       if (!buffer)
         fail('read');
 
-      // Don't slice the buffer. The point of this is to isolate, not
-      // simulate real traffic.
-      bytes += buffer.byteLength;
+      bytes += streamBaseState[kReadBytesOrError];
     };
 
     clientHandle.readStart();
diff --git a/benchmark/net/tcp-raw-pipe.js b/benchmark/net/tcp-raw-pipe.js
index fbaa21b5a309..36ddb822e04e 100644
--- a/benchmark/net/tcp-raw-pipe.js
+++ b/benchmark/net/tcp-raw-pipe.js
@@ -23,7 +23,12 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    kArrayBufferOffset,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   function fail(err, syscall) {
@@ -50,9 +55,11 @@ function main({ dur, len, type }) {
       if (!buffer)
         fail('read');
 
+      const nread = streamBaseState[kReadBytesOrError];
+      const offset = streamBaseState[kArrayBufferOffset];
       const writeReq = new WriteWrap();
       writeReq.async = false;
-      err = clientHandle.writeBuffer(writeReq, Buffer.from(buffer));
+      err = clientHandle.writeBuffer(writeReq, Buffer.from(buffer, offset, nread));
 
       if (err)
         fail(err, 'write');
@@ -94,7 +101,7 @@ function main({ dur, len, type }) {
     if (!buffer)
       fail('read');
 
-    bytes += buffer.byteLength;
+    bytes += streamBaseState[kReadBytesOrError];
   };
 
   connectReq.oncomplete = function(err) {
diff --git a/benchmark/net/tcp-raw-s2c.js b/benchmark/net/tcp-raw-s2c.js
index 3ca03529fcea..a847b8c28dcd 100644
--- a/benchmark/net/tcp-raw-s2c.js
+++ b/benchmark/net/tcp-raw-s2c.js
@@ -23,7 +23,11 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   const serverHandle = new TCP(TCPConstants.SERVER);
@@ -116,9 +120,7 @@ function main({ dur, len, type }) {
         if (!buffer)
           fail('read');
 
-        // Don't slice the buffer. The point of this is to isolate, not
-        // simulate real traffic.
-        bytes += buffer.byteLength;
+        bytes += streamBaseState[kReadBytesOrError];
       };
 
       clientHandle.readStart();
diff --git a/lib/internal/webstreams/adapters.js b/lib/internal/webstreams/adapters.js
index c00cc38ceef8..ef99ad1d39f6 100644
--- a/lib/internal/webstreams/adapters.js
+++ b/lib/internal/webstreams/adapters.js
@@ -94,6 +94,7 @@ const {
 const {
   WriteWrap,
   ShutdownWrap,
+  kArrayBufferOffset,
   kReadBytesOrError,
   kLastWriteWasAsync,
   streamBaseState,
@@ -1121,7 +1122,8 @@ function newReadableStreamFromStreamBase(streamBase, strategy, options = kEmptyO
         return;
       }
 
-      controller.enqueue(arrayBuffer);
+      const offset = streamBaseState[kArrayBufferOffset];
+      controller.enqueue(new Uint8Array(arrayBuffer, offset, nread));
 
       if (controller.desiredSize <= 0)
         streamBase.readStop();
diff --git a/src/env.cc b/src/env.cc
index 5626b2a7e10e..bac9a87f490f 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -822,6 +822,105 @@ void Environment::recycle_managed_buffer(std::unique_ptr<BackingStore> bs) {
     managed_buffer_cache_ = std::move(bs);
 }
 
+uv_buf_t StreamReadSlab::Allocate(Isolate* isolate, size_t suggested) {
+  DCHECK_GT(suggested, 0);
+  // Reads always get the full `suggested` size: handing out a smaller
+  // remainder would shrink the read() buffer and fragment large reads into
+  // more system calls, which costs more than the slab tail it saves.
+  size_t remaining = current_.bs ? current_.size() - current_.offset : 0;
+  if (remaining < suggested) {
+    // Retire the current slab; it stays alive through `retired_` if reads
+    // are still pending on it, or through JS views over it otherwise.
+    if (current_.bs && current_.pending > 0)
+      retired_.push_back(std::move(current_));
+    current_ = Slab();
+    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+        isolate,
+        std::max(kSlabSize, suggested),
+        BackingStoreInitializationMode::kUninitialized);
+    current_.bs = std::move(bs);
+  }
+  char* base = current_.data() + current_.offset;
+  current_.offset += suggested;
+  current_.last_base = base;
+  current_.last_end = current_.offset;
+  current_.pending++;
+  return uv_buf_init(base, suggested);
+}
+
+StreamReadSlab::Slab* StreamReadSlab::FindSlab(const char* base) {
+  if (current_.Contains(base)) return &current_;
+  for (Slab& slab : retired_)
+    if (slab.Contains(base)) return &slab;
+  return nullptr;
+}
+
+void StreamReadSlab::CompleteReservation(Slab* slab,
+                                         const uv_buf_t& buf,
+                                         size_t used) {
+  DCHECK_GT(slab->pending, 0);
+  slab->pending--;
+  if (buf.base == slab->last_base && slab->offset == slab->last_end) {
+    // This was the most recent reservation and nothing was reserved after
+    // it: rewind the unused remainder so it can be reserved again.
+    slab->offset = (buf.base - slab->data()) + used;
+    slab->last_end = slab->offset;
+  }
+  if (slab != &current_ && slab->pending == 0) {
+    for (auto it = retired_.begin(); it != retired_.end(); ++it) {
+      if (&*it == slab) {
+        retired_.erase(it);
+        break;
+      }
+    }
+  }
+}
+
+bool StreamReadSlab::Commit(Isolate* isolate,
+                            const uv_buf_t& buf,
+                            size_t nread,
+                            Local<ArrayBuffer>* ab,
+                            size_t* offset) {
+  Slab* slab = FindSlab(buf.base);
+  if (slab == nullptr) return false;
+  DCHECK_LE(nread, buf.len);
+
+  // A partial read would leave the rest of its reservation as waste once
+  // the slab retires - memory that counts towards V8's external memory and
+  // drives up GC frequency. If most of the reservation would be wasted,
+  // give the read a right-sized copy instead (as if it had never been read
+  // into the slab) and return its reservation in full. Reads that (mostly)
+  // fill their reservation get a zero-copy view into the slab.
+  if (nread < buf.len - buf.len / 4 && buf.base == slab->last_base &&
+      slab->offset == slab->last_end) {
+    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+        isolate, nread, BackingStoreInitializationMode::kUninitialized);
+    memcpy(bs->Data(), buf.base, nread);
+    *ab = ArrayBuffer::New(isolate, std::move(bs));
+    *offset = 0;
+    CompleteReservation(slab, buf, 0);
+    return true;
+  }
+
+  *offset = buf.base - slab->data();
+  if (slab->ab.IsEmpty()) {
+    *ab = ArrayBuffer::New(isolate, slab->bs);
+    slab->ab.Reset(isolate, *ab);
+  } else {
+    *ab = slab->ab.Get(isolate);
+  }
+  CompleteReservation(slab, buf, nread);
+  return true;
+}
+
+bool StreamReadSlab::Release(const uv_buf_t& buf) {
+  if (buf.base == nullptr) return true;
+  Slab* slab = FindSlab(buf.base);
+  if (slab == nullptr) return false;
+  CompleteReservation(slab, buf, 0);
+  return true;
+}
+
 std::string Environment::GetExecPath(const std::vector<std::string>& argv) {
   char exec_path_buf[2 * PATH_MAX];
   size_t exec_path_len = sizeof(exec_path_buf);
diff --git a/src/env.h b/src/env.h
index 4410ccb3e101..6a94dae269d2 100644
--- a/src/env.h
+++ b/src/env.h
@@ -287,6 +287,63 @@ struct ContextInfo {
 
 class EnabledDebugList;
 
+// A bump allocator for stream read buffers. Reads reserve a chunk of the
+// current slab and, once completed, are handed to JS as a view (ArrayBuffer +
+// offset) over the slab, so that no per-read allocation or copy is needed.
+// Unused reservation space is rewound when a read returns fewer bytes than
+// were reserved. Slabs with reads still pending when a new slab is started
+// (possible when multiple reads are in flight, e.g. on Windows) are kept
+// alive in `retired_` until those reads complete.
+class StreamReadSlab {
+ public:
+  // Sized to match the read buffer size that libuv suggests for stream
+  // reads: a slab typically serves a single large read (still avoiding the
+  // copy that right-sizing the buffer would need), or many small ones.
+  // Larger slabs amortize allocations further, but stay alive (pinned by
+  // chunk views) long enough to be promoted to V8's old generation, where
+  // their external memory is only reclaimed by major GCs.
+  static constexpr size_t kSlabSize = 64 * 1024;
+
+  // Reserve `suggested` bytes. Starts a new slab if the current one does
+  // not have enough space left.
+  uv_buf_t Allocate(v8::Isolate* isolate, size_t suggested);
+  // Commit a completed read of `nread` bytes into the buffer previously
+  // returned by Allocate(), rewinding the unused remainder of the
+  // reservation if possible. Returns the slab's ArrayBuffer and the offset
+  // of `buf.base` within it. Returns false if the buffer was not allocated
+  // from this slab (e.g. reads rerouted from another stream listener).
+  bool Commit(v8::Isolate* isolate,
+              const uv_buf_t& buf,
+              size_t nread,
+              v8::Local<v8::ArrayBuffer>* ab,
+              size_t* offset);
+  // Return an unused reservation (failed or empty read). Returns false if
+  // the buffer was not allocated from this slab.
+  bool Release(const uv_buf_t& buf);
+
+ private:
+  struct Slab {
+    std::shared_ptr<v8::BackingStore> bs;
+    v8::Global<v8::ArrayBuffer> ab;
+    size_t offset = 0;          // Bump pointer.
+    size_t pending = 0;         // Reservations not yet committed/released.
+    char* last_base = nullptr;  // Most recent reservation...
+    size_t last_end = 0;        // ...and the bump pointer after it.
+
+    char* data() const { return static_cast<char*>(bs->Data()); }
+    size_t size() const { return bs->ByteLength(); }
+    bool Contains(const char* p) const {
+      return bs && p >= data() && p < data() + size();
+    }
+  };
+
+  Slab* FindSlab(const char* base);
+  void CompleteReservation(Slab* slab, const uv_buf_t& buf, size_t used);
+
+  Slab current_;
+  std::vector<Slab> retired_;
+};
+
 namespace per_process {
 extern std::shared_ptr<KVStore> system_environment;
 }
@@ -1082,6 +1139,10 @@ class Environment final : public MemoryRetainer {
   // Only buffers that were not exposed externally may be recycled.
   void recycle_managed_buffer(std::unique_ptr<v8::BackingStore> bs);
 
+  StreamReadSlab& stream_read_slab() {
+    return stream_read_slab_;
+  }
+
   void AddUnmanagedFd(int fd);
   void RemoveUnmanagedFd(int fd);
 
@@ -1309,6 +1370,9 @@ class Environment final : public MemoryRetainer {
       released_allocated_buffers_;
   std::unique_ptr<v8::BackingStore> managed_buffer_cache_;
 
+  // Used by EmitToJSStreamListener to allocate stream read buffers.
+  StreamReadSlab stream_read_slab_;
+
   v8::CpuProfiler* cpu_profiler_ = nullptr;
   std::vector<v8::ProfilerId> pending_profiles_;
 };
diff --git a/src/stream_base.cc b/src/stream_base.cc
index 688e2edb4557..1c27a7a4e31e 100644
--- a/src/stream_base.cc
+++ b/src/stream_base.cc
@@ -684,7 +684,7 @@ void StreamResource::ClearError() {
 uv_buf_t EmitToJSStreamListener::OnStreamAlloc(size_t suggested_size) {
   CHECK_NOT_NULL(stream_);
   Environment* env = static_cast<StreamBase*>(stream_)->stream_env();
-  return env->allocate_managed_buffer(suggested_size);
+  return env->stream_read_slab().Allocate(env->isolate(), suggested_size);
 }
 
 void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
@@ -694,25 +694,34 @@ void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
   Context::Scope context_scope(env->context());
-  std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
 
   if (nread <= 0)  {
-    env->recycle_managed_buffer(std::move(bs));
+    if (!env->stream_read_slab().Release(buf_))
+      env->recycle_managed_buffer(env->release_managed_buffer(buf_));
     if (nread < 0)
       stream->CallJSOnreadMethod(nread, Local<ArrayBuffer>());
     return;
   }
 
-  CHECK_LE(static_cast<size_t>(nread), bs->ByteLength());
-  if (static_cast<size_t>(nread) != bs->ByteLength()) {
-    std::unique_ptr<BackingStore> old_bs = std::move(bs);
-    bs = ArrayBuffer::NewBackingStore(
-        isolate, nread, BackingStoreInitializationMode::kUninitialized);
-    memcpy(bs->Data(), old_bs->Data(), nread);
-    env->recycle_managed_buffer(std::move(old_bs));
+  CHECK_LE(static_cast<size_t>(nread), buf_.len);
+  size_t offset = 0;
+  Local<ArrayBuffer> ab;
+  if (!env->stream_read_slab().Commit(isolate, buf_, nread, &ab, &offset)) {
+    // The buffer was allocated through allocate_managed_buffer() by another
+    // stream listener (e.g. StreamPipe's) whose read was rerouted here after
+    // that listener was removed.
+    std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
+    CHECK_LE(static_cast<size_t>(nread), bs->ByteLength());
+    if (static_cast<size_t>(nread) != bs->ByteLength()) {
+      std::unique_ptr<BackingStore> old_bs = std::move(bs);
+      bs = ArrayBuffer::NewBackingStore(
+          isolate, nread, BackingStoreInitializationMode::kUninitialized);
+      memcpy(bs->Data(), old_bs->Data(), nread);
+      env->recycle_managed_buffer(std::move(old_bs));
+    }
+    ab = ArrayBuffer::New(isolate, std::move(bs));
   }
-
-  stream->CallJSOnreadMethod(nread, ArrayBuffer::New(isolate, std::move(bs)));
+  stream->CallJSOnreadMethod(nread, ab, offset);
 }
 
 
diff --git a/test/parallel/test-whatwg-webstreams-adapters-streambase.js b/test/parallel/test-whatwg-webstreams-adapters-streambase.js
index bd864ab8c141..8a42dd6a9b76 100644
--- a/test/parallel/test-whatwg-webstreams-adapters-streambase.js
+++ b/test/parallel/test-whatwg-webstreams-adapters-streambase.js
@@ -35,6 +35,8 @@ const {
 {
   const buf = Buffer.from('hello');
   const check = new Uint8Array(buf);
+  const buf2 = Buffer.from('world');
+  const check2 = new Uint8Array(buf2);
 
   const stream = new JSStream();
 
@@ -47,13 +49,20 @@ const {
     assert.deepStrictEqual(new Uint8Array(value), check);
 
     reader.read().then(common.mustCall(({ done, value }) => {
-      assert(done);
-      assert.strictEqual(value, undefined);
-    }));
+      assert(!done);
+      assert.deepStrictEqual(new Uint8Array(value), check2);
 
+      reader.read().then(common.mustCall(({ done, value }) => {
+        assert(done);
+        assert.strictEqual(value, undefined);
+      }));
+    }));
   }));
 
+  // Two reads land in the same read buffer; the second chunk must be
+  // sliced from its offset within it.
   stream.readBuffer(buf);
+  stream.readBuffer(buf2);
   stream.emitEOF();
 }
 

From b113d09c7145d5727f8d9382723b4b842f069014 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Sun, 12 Jul 2026 15:34:14 +0200
Subject: [PATCH 148/202] stream: create write request objects lazily

Every stream write created a WriteWrap JS object up front, even though
most writes complete synchronously via uv_try_write() and never use it.

Let stream_base_commons pass null instead of a request object.
StreamBase::Write() already creates the wrap object only when the write
does not complete synchronously; return that object to JS (which
attaches oncomplete/callback to it) and a plain error code otherwise.

Writes that complete synchronously now cross the JS/C++ boundary once
and allocate nothing. Callers that pass in a request object
(child_process IPC, webstreams adapters) behave as before.

Since Http2Stream::DoWrite() can invoke the completion callback
synchronously - before JS has attached oncomplete - such completions
are now recorded on the request object's writeStatus field and replayed
by stream_base_commons after dispatch. This also replaces a Has() plus
name-based MakeCallback() pair with a single Get().

Also pre-create the JS fields of WriteWrap instances in the object
template, as was already done for ShutdownWrap, so that they are
in-object properties.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64455
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
---
 lib/internal/stream_base_commons.js | 141 ++++++++++++++--------------
 src/env_properties.h                |   1 +
 src/stream_base.cc                  | 105 +++++++++++++++++----
 src/stream_base.h                   |  10 ++
 src/stream_wrap.cc                  |  15 +++
 5 files changed, 185 insertions(+), 87 deletions(-)

diff --git a/lib/internal/stream_base_commons.js b/lib/internal/stream_base_commons.js
index 6d144f8a0fa6..7bf3a2bab638 100644
--- a/lib/internal/stream_base_commons.js
+++ b/lib/internal/stream_base_commons.js
@@ -8,11 +8,10 @@ const {
 const { Buffer } = require('buffer');
 const { FastBuffer } = require('internal/buffer');
 const {
-  WriteWrap,
   kReadBytesOrError,
   kArrayBufferOffset,
   kBytesWritten,
-  kLastWriteWasAsync,
+  kLastWriteErr,
   streamBaseState,
 } = internalBinding('stream_wrap');
 const { UV_EOF } = internalBinding('uv');
@@ -43,41 +42,6 @@ const kBuffer = Symbol('kBuffer');
 const kBufferGen = Symbol('kBufferGen');
 const kBufferCb = Symbol('kBufferCb');
 
-function handleWriteReq(req, data, encoding) {
-  const { handle } = req;
-
-  switch (encoding) {
-    case 'buffer':
-    {
-      const ret = handle.writeBuffer(req, data);
-      if (streamBaseState[kLastWriteWasAsync])
-        req.buffer = data;
-      return ret;
-    }
-    case 'latin1':
-    case 'binary':
-      return handle.writeLatin1String(req, data);
-    case 'utf8':
-    case 'utf-8':
-      return handle.writeUtf8String(req, data);
-    case 'ascii':
-      return handle.writeAsciiString(req, data);
-    case 'ucs2':
-    case 'ucs-2':
-    case 'utf16le':
-    case 'utf-16le':
-      return handle.writeUcs2String(req, data);
-    default:
-    {
-      const buffer = Buffer.from(data, encoding);
-      const ret = handle.writeBuffer(req, buffer);
-      if (streamBaseState[kLastWriteWasAsync])
-        req.buffer = buffer;
-      return ret;
-    }
-  }
-}
-
 function onWriteComplete(status) {
   debug('onWriteComplete', status, this.error);
 
@@ -105,21 +69,8 @@ function onWriteComplete(status) {
     this.callback(null);
 }
 
-function createWriteWrap(handle, callback) {
-  const req = new WriteWrap();
-
-  req.handle = handle;
-  req.oncomplete = onWriteComplete;
-  req.async = false;
-  req.bytes = 0;
-  req.buffer = null;
-  req.callback = callback;
-
-  return req;
-}
-
 function writevGeneric(self, data, cb) {
-  const req = createWriteWrap(self[kHandle], cb);
+  const handle = self[kHandle];
   const allBuffers = data.allBuffers;
   let chunks;
   if (allBuffers) {
@@ -134,33 +85,87 @@ function writevGeneric(self, data, cb) {
       chunks[i * 2 + 1] = entry.encoding;
     }
   }
-  const err = req.handle.writev(req, chunks, allBuffers);
-
-  // Retain chunks
-  if (err === 0) req._chunks = chunks;
+  const ret = handle.writev(null, chunks, allBuffers);
 
-  afterWriteDispatched(req, err, cb);
-  return req;
+  return afterWriteDispatched(handle, ret, chunks, cb);
 }
 
 function writeGeneric(self, data, encoding, cb) {
-  const req = createWriteWrap(self[kHandle], cb);
-  const err = handleWriteReq(req, data, encoding);
+  const handle = self[kHandle];
+  let ret;
+  let buffer = null;
 
-  afterWriteDispatched(req, err, cb);
-  return req;
+  switch (encoding) {
+    case 'buffer':
+      buffer = data;
+      ret = handle.writeBuffer(null, data);
+      break;
+    case 'latin1':
+    case 'binary':
+      ret = handle.writeLatin1String(null, data);
+      break;
+    case 'utf8':
+    case 'utf-8':
+      ret = handle.writeUtf8String(null, data);
+      break;
+    case 'ascii':
+      ret = handle.writeAsciiString(null, data);
+      break;
+    case 'ucs2':
+    case 'ucs-2':
+    case 'utf16le':
+    case 'utf-16le':
+      ret = handle.writeUcs2String(null, data);
+      break;
+    default:
+      buffer = Buffer.from(data, encoding);
+      ret = handle.writeBuffer(null, buffer);
+      break;
+  }
+
+  return afterWriteDispatched(handle, ret, buffer, cb);
 }
 
-function afterWriteDispatched(req, err, cb) {
-  req.bytes = streamBaseState[kBytesWritten];
-  req.async = !!streamBaseState[kLastWriteWasAsync];
+// `ret` is either a numeric error code (when the write - or its failure -
+// completed synchronously and no write request was created) or the WriteWrap
+// object of a dispatched write.
+function afterWriteDispatched(handle, ret, buffer, cb) {
+  const bytes = streamBaseState[kBytesWritten];
+
+  if (typeof ret === 'number') {
+    // The write (or its failure) completed synchronously.
+    if (ret !== 0)
+      cb(new ErrnoException(ret, 'write'));
+    else if (typeof cb === 'function')
+      cb();
+    return { async: false, bytes };
+  }
 
-  if (err !== 0)
-    return cb(new ErrnoException(err, 'write', req.error));
+  const req = ret;
+  const err = streamBaseState[kLastWriteErr];
+  if (err !== 0) {
+    cb(new ErrnoException(err, 'write', req.error));
+    return { async: false, bytes };
+  }
 
-  if (!req.async && typeof req.callback === 'function') {
-    req.callback();
+  req.handle = handle;
+  req.oncomplete = onWriteComplete;
+  req.callback = cb;
+  req.async = true;
+  req.bytes = bytes;
+  // Retain the data (or chunks) being written until the write completes.
+  req.buffer = buffer;
+
+  // If the write completed synchronously inside the write call, before
+  // `oncomplete` could be attached, the completion status has been recorded;
+  // deliver it now.
+  const status = req.writeStatus;
+  if (status !== null) {
+    req.writeStatus = null;
+    req.oncomplete(status);
   }
+
+  return req;
 }
 
 function onStreamRead(arrayBuffer) {
diff --git a/src/env_properties.h b/src/env_properties.h
index fc1772f926e5..bfb981d1c89b 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -407,6 +407,7 @@
   V(writable_string, "writable")                                               \
   V(write_host_object_string, "_writeHostObject")                              \
   V(write_queue_size_string, "writeQueueSize")                                 \
+  V(write_status_string, "writeStatus")                                        \
   V(zlib_string, "zlib")                                                       \
   V(zstd_string, "zstd")
 
diff --git a/src/stream_base.cc b/src/stream_base.cc
index 1c27a7a4e31e..e0f3b941ae67 100644
--- a/src/stream_base.cc
+++ b/src/stream_base.cc
@@ -175,6 +175,23 @@ int StreamBase::Shutdown(const FunctionCallbackInfo<Value>& args) {
 void StreamBase::SetWriteResult(const StreamWriteResult& res) {
   env_->stream_base_state()[kBytesWritten] = res.bytes;
   env_->stream_base_state()[kLastWriteWasAsync] = res.async;
+  env_->stream_base_state()[kLastWriteErr] = res.err;
+}
+
+// Finish a JS-initiated write. When the caller did not pass a request
+// object (`lazy_req`), the write wrap object exists only if the write did
+// not complete synchronously; hand it to JS so that it can attach its
+// completion callback. Otherwise the numeric error code (via JSMethod) is
+// all JS needs.
+int StreamBase::FinishWrite(const v8::FunctionCallbackInfo<v8::Value>& args,
+                            const StreamWriteResult& res,
+                            bool lazy_req) {
+  SetWriteResult(res);
+  if (lazy_req && res.wrap_obj) {
+    args.GetReturnValue().Set(res.wrap_obj->object());
+    return kReturnValueSet;
+  }
+  return res.err;
 }
 
 int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
@@ -182,10 +199,13 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
 
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsArray());
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  // When no request object is passed in, one is created by Write() only if
+  // the write does not complete synchronously; see FinishWrite().
+  const bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   Local<Array> chunks = args[1].As<Array>();
   bool all_buffers = args[2]->IsTrue();
 
@@ -287,20 +307,19 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
   }
 
   StreamWriteResult res = Write(*bufs, count, nullptr, req_wrap_obj);
-  SetWriteResult(res);
   if (res.wrap != nullptr && storage_size > 0)
     res.wrap->SetBackingStore(std::move(bs));
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
-
 int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsUint8Array());
 
   Environment* env = Environment::GetCurrent(args);
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   uv_buf_t buf;
   buf.base = Buffer::Data(args[1]);
   buf.len = Buffer::Length(args[1]);
@@ -310,6 +329,16 @@ int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   if (args[2]->IsObject() && IsIPCPipe()) {
     Local<Object> send_handle_obj = args[2].As<Object>();
 
+    if (lazy_req) {
+      // Sending a handle requires a request object up front to reference it.
+      if (!env->write_wrap_template()
+               ->NewInstance(env->context())
+               .ToLocal(&req_wrap_obj)) {
+        return UV_EBUSY;
+      }
+      StreamReq::ResetObject(req_wrap_obj);
+    }
+
     HandleWrap* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, send_handle_obj, UV_EINVAL);
     send_handle = reinterpret_cast<uv_stream_t*>(wrap->GetHandle());
@@ -323,20 +352,18 @@ int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   StreamWriteResult res = Write(&buf, 1, send_handle, req_wrap_obj);
-  SetWriteResult(res);
-
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
-
 template <enum encoding enc>
 int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsString());
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  const bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   Local<String> string = args[1].As<String>();
   Local<Object> send_handle_obj;
   if (args[2]->IsObject())
@@ -417,6 +444,16 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   uv_stream_t* send_handle = nullptr;
 
   if (IsIPCPipe() && !send_handle_obj.IsEmpty()) {
+    if (lazy_req && req_wrap_obj.IsEmpty()) {
+      // Sending a handle requires a request object up front to reference it.
+      if (!env->write_wrap_template()
+               ->NewInstance(env->context())
+               .ToLocal(&req_wrap_obj)) {
+        return UV_EBUSY;
+      }
+      StreamReq::ResetObject(req_wrap_obj);
+    }
+
     HandleWrap* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, send_handle_obj, UV_EINVAL);
     send_handle = reinterpret_cast<uv_stream_t*>(wrap->GetHandle());
@@ -432,11 +469,10 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   StreamWriteResult res = Write(&buf, 1, send_handle, req_wrap_obj, try_write);
   res.bytes += synchronously_written;
 
-  SetWriteResult(res);
   if (res.wrap != nullptr)
     res.wrap->SetBackingStore(std::move(bs));
 
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
 
@@ -662,7 +698,8 @@ void StreamBase::JSMethod(const FunctionCallbackInfo<Value>& args) {
   if (!wrap->IsAlive()) return args.GetReturnValue().Set(UV_EINVAL);
 
   AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(wrap->GetAsyncWrap());
-  args.GetReturnValue().Set((wrap->*Method)(args));
+  int ret = (wrap->*Method)(args);
+  if (ret != kReturnValueSet) args.GetReturnValue().Set(ret);
 }
 
 int StreamResource::DoTryWrite(uv_buf_t** bufs, size_t* count) {
@@ -773,20 +810,50 @@ void ReportWritesToJSStreamListener::OnStreamAfterReqFinished(
   CHECK(!async_wrap->persistent().IsEmpty());
   Local<Object> req_wrap_obj = async_wrap->object();
 
+  Local<Value> oncomplete;
+  if (!req_wrap_obj->Get(env->context(), env->oncomplete_string())
+           .ToLocal(&oncomplete)) {
+    return;
+  }
+
+  const char* msg = stream->Error();
+
+  if (!oncomplete->IsFunction()) {
+    // The completion callback has not been attached yet: the write finished
+    // synchronously inside the JS write call, before the request object was
+    // returned to JS. Record the status so that JS can replay the callback.
+    if (req_wrap_obj
+            ->Set(env->context(),
+                  env->write_status_string(),
+                  Integer::New(env->isolate(), status))
+            .IsNothing()) {
+      return;
+    }
+    if (msg != nullptr) {
+      if (req_wrap_obj
+              ->Set(env->context(),
+                    env->error_string(),
+                    OneByteString(env->isolate(), msg))
+              .IsNothing()) {
+        return;
+      }
+      stream->ClearError();
+    }
+    return;
+  }
+
   Local<Value> argv[] = {
     Integer::New(env->isolate(), status),
     stream->GetObject(),
     Undefined(env->isolate())
   };
 
-  const char* msg = stream->Error();
   if (msg != nullptr) {
     argv[2] = OneByteString(env->isolate(), msg);
     stream->ClearError();
   }
 
-  if (req_wrap_obj->Has(env->context(), env->oncomplete_string()).FromJust())
-    async_wrap->MakeCallback(env->oncomplete_string(), arraysize(argv), argv);
+  async_wrap->MakeCallback(oncomplete.As<Function>(), arraysize(argv), argv);
 }
 
 void ReportWritesToJSStreamListener::OnStreamAfterWrite(
diff --git a/src/stream_base.h b/src/stream_base.h
index cb795a541297..450205a1b863 100644
--- a/src/stream_base.h
+++ b/src/stream_base.h
@@ -10,6 +10,8 @@
 
 #include "v8.h"
 
+#include <climits>  // INT_MIN
+
 namespace node {
 
 // Forward declarations
@@ -405,14 +407,22 @@ class StreamBase : public StreamResource {
     kArrayBufferOffset,
     kBytesWritten,
     kLastWriteWasAsync,
+    kLastWriteErr,
     kNumStreamBaseStateFields
   };
 
  private:
+  // Sentinel return value for JS methods that have set their own (object)
+  // return value and must not have it overwritten by JSMethod().
+  static constexpr int kReturnValueSet = INT_MIN;
+
   Environment* env_;
   EmitToJSStreamListener default_listener_;
 
   void SetWriteResult(const StreamWriteResult& res);
+  int FinishWrite(const v8::FunctionCallbackInfo<v8::Value>& args,
+                  const StreamWriteResult& res,
+                  bool lazy_req);
   static void AddAccessor(v8::Isolate* isolate,
                           v8::Local<v8::Signature> sig,
                           enum v8::PropertyAttribute attributes,
diff --git a/src/stream_wrap.cc b/src/stream_wrap.cc
index 6b85d6533879..c7d3c4745511 100644
--- a/src/stream_wrap.cc
+++ b/src/stream_wrap.cc
@@ -95,6 +95,20 @@ void LibuvStreamWrap::Initialize(Local<Object> target,
   Local<FunctionTemplate> ww =
       FunctionTemplate::New(isolate, IsConstructCallCallback);
   ww->InstanceTemplate()->SetInternalFieldCount(WriteWrap::kInternalFieldCount);
+  // Pre-create the fields that JS attaches to write requests, so that they
+  // are in-object properties and the object shape stays monomorphic.
+  ww->InstanceTemplate()->Set(env->oncomplete_string(), v8::Null(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "callback"),
+                              v8::Null(isolate));
+  ww->InstanceTemplate()->Set(env->handle_string(), v8::Null(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "async"),
+                              v8::False(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "bytes"),
+                              v8::Integer::New(isolate, 0));
+  ww->InstanceTemplate()->Set(env->buffer_string(), v8::Null(isolate));
+  // Slot for a completion that fires before JS attaches `oncomplete`; see
+  // ReportWritesToJSStreamListener::OnStreamAfterReqFinished().
+  ww->InstanceTemplate()->Set(env->write_status_string(), v8::Null(isolate));
   ww->Inherit(AsyncWrap::GetConstructorTemplate(env));
   SetConstructorFunction(context, target, "WriteWrap", ww);
   env->set_write_wrap_template(ww->InstanceTemplate());
@@ -103,6 +117,7 @@ void LibuvStreamWrap::Initialize(Local<Object> target,
   NODE_DEFINE_CONSTANT(target, kArrayBufferOffset);
   NODE_DEFINE_CONSTANT(target, kBytesWritten);
   NODE_DEFINE_CONSTANT(target, kLastWriteWasAsync);
+  NODE_DEFINE_CONSTANT(target, kLastWriteErr);
   target
       ->Set(context,
             FIXED_ONE_BYTE_STRING(isolate, "streamBaseState"),

From b4c83f5904c9bae64a18c2db12e49ea68d07dd6c Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Mon, 7 Sep 2026 19:55:48 +0200
Subject: [PATCH 149/202] build: fix quiet default for make builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Makefile documents quiet output unless V=1 and sets `V ?= 0`, but
it forwards `V=$(V)` to the gyp-generated makefile, which tests
`ifdef V`. "0" is a non-empty value there, so every make build has
printed the full compiler command lines regardless. Default V to empty
so the sub-make takes its quiet_ rules; `make V=1` and V=1 in the
environment stay verbose, and the ninja and cpplint checks already
compare against 1.

Refs: https://github.com/nodejs/node/pull/26740
Refs: https://github.com/nodejs/build/issues/4419
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65826
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index afa55b2da33e..8dec67750f0c 100644
--- a/Makefile
+++ b/Makefile
@@ -98,7 +98,7 @@ BUILD_RELEASE_FLAGS ?= $(BUILD_DOWNLOAD_FLAGS) $(BUILD_INTL_FLAGS)
 
 # Default to quiet/pretty builds.
 # To do verbose builds, run `make V=1` or set the V environment variable.
-V ?= 0
+V ?=
 
 # Use -e to double check in case it's a broken link
 available-node = \

From 8d1d7b67e440585471508f90fd229c2a66240e8b Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Mon, 7 Sep 2026 23:21:55 +0200
Subject: [PATCH 150/202] inspector: fix crash when the IsolateData has no
 platform

An embedder that creates its IsolateData without a MultiIsolatePlatform
(allowed; node.h says only Workers need one) and keeps the inspector
segfaulted on the first `console.log()`, `console.time()` or profiler
use after a `node:inspector` session was connected: V8 calls the
inspector client's `currentTimeMS()` there, and
`NodeInspectorClient::currentTimeMS()` dereferenced
`isolate_data()->platform()` unconditionally.

Fall back to the wall clock when there is no platform, which is what
`NodePlatform::CurrentClockTimeMillis()` returns anyway.

Refs: https://github.com/nodejs/node/pull/21917
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65818
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 src/inspector_agent.cc          |  4 +++-
 test/cctest/test_environment.cc | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/inspector_agent.cc b/src/inspector_agent.cc
index fbafc55f1b74..83d3398da36b 100644
--- a/src/inspector_agent.cc
+++ b/src/inspector_agent.cc
@@ -864,7 +864,9 @@ class NodeInspectorClient : public V8InspectorClient {
   }
 
   double currentTimeMS() override {
-    return env_->isolate_data()->platform()->CurrentClockTimeMillis();
+    MultiIsolatePlatform* platform = env_->isolate_data()->platform();
+    if (platform == nullptr) return GetCurrentTimeInMicroseconds() / 1000;
+    return platform->CurrentClockTimeMillis();
   }
 
   std::unique_ptr<StringBuffer> resourceNameToUrl(
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index fe9915185b71..5426a3a2f3e4 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -702,6 +702,34 @@ TEST_F(EnvironmentTest, InspectorMultipleEmbeddedEnvironments) {
   CHECK_EQ(data.extracted_value, 42);
   CHECK_EQ(from_inspector->IntegerValue(context).FromJust(), 42);
 }
+
+TEST_F(EnvironmentTest, InspectorWithoutPlatform) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  node::IsolateData* isolate_data = node::CreateIsolateData(
+      isolate_, &NodeTestFixture::current_loop, nullptr);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+  std::vector<std::string> args(*argv, *argv + 1);
+  node::Environment* env =
+      node::CreateEnvironment(isolate_data, context, args, args);
+  CHECK_NOT_NULL(env);
+
+  v8::Local<v8::Value> result =
+      node::LoadEnvironment(env,
+                            "const { Session } = require('inspector');\n"
+                            "const session = new Session();\n"
+                            "session.connect();\n"
+                            "console.time('t'); console.timeEnd('t');\n"
+                            "session.disconnect();\n"
+                            "return 42;")
+          .ToLocalChecked();
+  EXPECT_EQ(result->Int32Value(context).FromJust(), 42);
+
+  node::FreeEnvironment(env);
+  node::FreeIsolateData(isolate_data);
+}
+
 #endif  // HAVE_INSPECTOR
 
 TEST_F(EnvironmentTest, ExitHandlerTest) {

From 1e0ebefc75929820adfb36683180d5dafe892ae0 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Mon, 7 Sep 2026 23:32:59 +0200
Subject: [PATCH 151/202] src: fix null pointer call when running without a
 startup snapshot

Without a startup snapshot (`--no-node-snapshot`, a
`--without-node-snapshot` build, or an embedder Environment that was
bootstrapped from scratch) starting a Worker made a member call through
a null `SnapshotData*`, and so did `NodeMainInstance` while setting
itself up. It only worked because the function called does not touch
`this`; UBSan reports it for every such Worker. The call existed
because `IsolateData::CreateIsolateData()` took an
`EmbedderSnapshotData*` and unwrapped it straight away, so the two
internal callers wrapped their possibly-null `SnapshotData*` with
`AsEmbedderWrapper()` only for it to be unwrapped again.

Let the internal function take the `SnapshotData*` itself, unwrap in
the public `CreateIsolateData()` only, and drop `AsEmbedderWrapper()`,
which has no other users.

Refs: https://github.com/nodejs/node/pull/47731
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65820
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 src/api/environment.cc          |  6 +++++-
 src/env.cc                      |  4 +---
 src/env.h                       |  3 +--
 src/node_main_instance.cc       | 10 +++++-----
 src/node_snapshotable.cc        |  4 ----
 src/node_worker.cc              | 14 +++++++-------
 test/cctest/test_environment.cc | 12 ++++++++++++
 7 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/src/api/environment.cc b/src/api/environment.cc
index 40aef133596e..30ec537bf5d1 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -391,7 +391,11 @@ IsolateData* CreateIsolateData(
     ArrayBufferAllocator* allocator,
     const EmbedderSnapshotData* embedder_snapshot_data) {
   return IsolateData::CreateIsolateData(
-      isolate, loop, platform, allocator, embedder_snapshot_data);
+      isolate,
+      loop,
+      platform,
+      allocator,
+      SnapshotData::FromEmbedderWrapper(embedder_snapshot_data));
 }
 
 void FreeIsolateData(IsolateData* isolate_data) {
diff --git a/src/env.cc b/src/env.cc
index bac9a87f490f..d35c28fcf7ed 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -600,10 +600,8 @@ IsolateData* IsolateData::CreateIsolateData(
     uv_loop_t* loop,
     MultiIsolatePlatform* platform,
     ArrayBufferAllocator* allocator,
-    const EmbedderSnapshotData* embedder_snapshot_data,
+    const SnapshotData* snapshot_data,
     std::shared_ptr<PerIsolateOptions> options) {
-  const SnapshotData* snapshot_data =
-      SnapshotData::FromEmbedderWrapper(embedder_snapshot_data);
   if (options == nullptr) {
     options = per_process::cli_options->per_isolate->Clone();
   }
diff --git a/src/env.h b/src/env.h
index 6a94dae269d2..29754ddb6371 100644
--- a/src/env.h
+++ b/src/env.h
@@ -143,7 +143,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
       uv_loop_t* event_loop,
       MultiIsolatePlatform* platform = nullptr,
       ArrayBufferAllocator* node_allocator = nullptr,
-      const EmbedderSnapshotData* embedder_snapshot_data = nullptr,
+      const SnapshotData* snapshot_data = nullptr,
       std::shared_ptr<PerIsolateOptions> options = nullptr);
   ~IsolateData();
 
@@ -662,7 +662,6 @@ struct SnapshotData {
   static bool FromBlob(SnapshotData* out, std::string_view in);
   static const SnapshotData* FromEmbedderWrapper(
       const EmbedderSnapshotData* data);
-  EmbedderSnapshotData::Pointer AsEmbedderWrapper() const;
 
   ~SnapshotData();
 };
diff --git a/src/node_main_instance.cc b/src/node_main_instance.cc
index 6f674df3ed0d..bc07d6aaf426 100644
--- a/src/node_main_instance.cc
+++ b/src/node_main_instance.cc
@@ -51,11 +51,11 @@ NodeMainInstance::NodeMainInstance(const SnapshotData* snapshot_data,
 
   // If the indexes are not nullptr, we are not deserializing
   isolate_data_.reset(
-      CreateIsolateData(isolate_,
-                        event_loop,
-                        platform,
-                        array_buffer_allocator_.get(),
-                        snapshot_data->AsEmbedderWrapper().get()));
+      IsolateData::CreateIsolateData(isolate_,
+                                     event_loop,
+                                     platform,
+                                     array_buffer_allocator_.get(),
+                                     snapshot_data));
 
   isolate_data_->max_young_gen_size =
       isolate_params_->constraints.max_young_generation_size_in_bytes();
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index e861e499534c..37123682dd16 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -628,10 +628,6 @@ const SnapshotData* SnapshotData::FromEmbedderWrapper(
   return data != nullptr ? data->impl_ : nullptr;
 }
 
-EmbedderSnapshotData::Pointer SnapshotData::AsEmbedderWrapper() const {
-  return EmbedderSnapshotData::Pointer{new EmbedderSnapshotData(this, false)};
-}
-
 bool SnapshotData::FromFile(SnapshotData* out, FILE* in) {
   return FromBlob(out, ReadFileSync(in));
 }
diff --git a/src/node_worker.cc b/src/node_worker.cc
index 1a12946593ab..951da2e1e0f5 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -204,13 +204,13 @@ class WorkerThreadData {
       isolate->SetStackLimit(w->stack_base_);
 
       HandleScope handle_scope(isolate);
-      isolate_data_.reset(IsolateData::CreateIsolateData(
-          isolate,
-          &loop_,
-          w_->platform_,
-          allocator.get(),
-          w->snapshot_data()->AsEmbedderWrapper().get(),
-          std::move(w_->per_isolate_opts_)));
+      isolate_data_.reset(
+          IsolateData::CreateIsolateData(isolate,
+                                         &loop_,
+                                         w_->platform_,
+                                         allocator.get(),
+                                         w->snapshot_data(),
+                                         std::move(w_->per_isolate_opts_)));
       CHECK(isolate_data_);
       CHECK(!isolate_data_->is_building_snapshot());
       isolate_data_->set_worker_context(w_);
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 5426a3a2f3e4..bc83daa67921 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -355,6 +355,18 @@ TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   EXPECT_TRUE(called_cb_2);
 }
 
+TEST_F(EnvironmentTest, WorkerInEnvironmentWithoutSnapshot) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  Env env{handle_scope, argv};
+  CHECK_NULL(isolate_data_->snapshot_data());
+  node::LoadEnvironment(*env,
+                        "const { Worker } = require('worker_threads');"
+                        "new Worker('process.exit(0)', { eval: true });")
+      .ToLocalChecked();
+  EXPECT_EQ(node::SpinEventLoop(*env).FromJust(), 0);
+}
+
 TEST_F(EnvironmentTest, NoEnvironmentSanity) {
   const v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = v8::Context::New(isolate_);

From 72c1feaf0460649c537669cc56e4f4ebdcfb59cb Mon Sep 17 00:00:00 2001
From: Christian Aurich <christian.aurichzm@gmail.com>
Date: Mon, 7 Sep 2026 20:22:00 -0300
Subject: [PATCH 152/202] quic: reject zero addressLRUSize

SocketAddressLRU::Upsert always inserts an entry before evicting down
to max_size_. With max_size_ == 0, it evicts the entry it just
inserted and then accesses the now-missing key via
map_[address]->second. operator[] recreates the key with a
default-constructed std::list iterator, which is then dereferenced.
This is undefined behavior, observed as a SIGSEGV in Endpoint::Receive
on the first UDP packet accepted by a QuicEndpoint constructed with
{ addressLRUSize: 0 }.

SocketAddressLRU has no useful semantics for a zero-capacity cache,
and Upsert's callers rely on it returning a valid pointer. Reject 0
(and 0n) at the options-parsing boundary instead of changing Upsert's
contract.

Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65827
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/quic.md                                       |  4 ++--
 src/quic/endpoint.cc                                  | 11 +++++++++++
 test/parallel/test-quic-internal-endpoint-options.mjs |  2 +-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/doc/api/quic.md b/doc/api/quic.md
index a9e7414f4a3e..9cbff24bc086 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -2779,8 +2779,8 @@ added: v23.8.0
 
 The endpoint maintains an internal cache of validated socket addresses as a
 performance optimization. This option sets the maximum number of addresses
-that are cached. This is an advanced option that users typically won't have
-need to specify.
+that are cached. The value must be greater than `0`. This is an advanced option
+that users typically won't have need to specify.
 
 #### `endpointOptions.disableStatelessReset`
 
diff --git a/src/quic/endpoint.cc b/src/quic/endpoint.cc
index a6a4109509ae..8a92986c5a9c 100644
--- a/src/quic/endpoint.cc
+++ b/src/quic/endpoint.cc
@@ -249,6 +249,17 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
     return Nothing<Options>();
   }
 
+  // SocketAddressLRU::Upsert requires a positive capacity. With max_size_ ==
+  // 0, the newly inserted entry is immediately evicted, and the final
+  // map_[address] creates a default list iterator that is then
+  // dereferenced, causing UB (observed as a SIGSEGV in Endpoint::Receive on
+  // the first accepted connection).
+  if (options.address_lru_size == 0) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The addressLRUSize option must be greater than 0");
+    return Nothing<Options>();
+  }
+
   Local<Value> address;
   if (!params->Get(env->context(), env->address_string()).ToLocal(&address)) {
     return Nothing<Options>();
diff --git a/test/parallel/test-quic-internal-endpoint-options.mjs b/test/parallel/test-quic-internal-endpoint-options.mjs
index 29529c05e613..a81832c71094 100644
--- a/test/parallel/test-quic-internal-endpoint-options.mjs
+++ b/test/parallel/test-quic-internal-endpoint-options.mjs
@@ -56,7 +56,7 @@ const cases = [
     valid: [
       1, 10, 100, 1000, 10000, 10000n,
     ],
-    invalid: [-1, -1n, 'a', null, false, true, {}, [], () => {}]
+    invalid: [-1, -1n, 0, 0n, 'a', null, false, true, {}, [], () => {}]
   },
   {
     key: 'retryRate',

From 278a9b21b3fc4eac9b79ec3f95d97039cf33b9e9 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 7 Sep 2026 21:32:28 -0400
Subject: [PATCH 153/202] tools: update nixpkgs-unstable to
 e5ead30d0824debba629dcf0720abeddee5

PR-URL: https://github.com/nodejs/node/pull/65836
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 tools/nix/pkgs-26.05.nix | 4 ++--
 tools/nix/pkgs.nix       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/nix/pkgs-26.05.nix b/tools/nix/pkgs-26.05.nix
index ad1278343aab..6e406d6b708b 100644
--- a/tools/nix/pkgs-26.05.nix
+++ b/tools/nix/pkgs-26.05.nix
@@ -1,10 +1,10 @@
 arg:
 let
   repo = "https://github.com/NixOS/nixpkgs";
-  rev = "f6107e546a5012172d93e79f1f7950da02ad798f";
+  rev = "c19db427a1fdfc7591c0b0baeb4665dcef2c61da";
   nixpkgs = import (builtins.fetchTarball {
     url = "${repo}/archive/${rev}.tar.gz";
-    sha256 = "04n8l03dspn0747lc2vhkzbxbjc9wyx0ay959wdj35qnpyzxap5w";
+    sha256 = "0chqd1d3hbqwnz7arg5lh6iqv13n13zlhia52wxn72h3r5mi5jcy";
   }) arg;
 in
 # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index 6f9b5043d9b6..f93caa4d2a16 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -1,10 +1,10 @@
 arg:
 let
   repo = "https://github.com/NixOS/nixpkgs";
-  rev = "0e7911a191ea0fb9d6e8e771d24736d3618f8b1f";
+  rev = "e5ead30d0824debba629dcf0720abeddee57b7d6";
   nixpkgs = import (builtins.fetchTarball {
     url = "${repo}/archive/${rev}.tar.gz";
-    sha256 = "13ry2zkl0bbh7k7l0fpkb4xjsglzr3mzshvpcw4j9fn4s66jbmrq";
+    sha256 = "0sydiakqjp2qhr8h573bv48ng8928rjpwkx600xmxvsyz8kwczn1";
   }) arg;
 in
 # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel

From 884eda9f2bb0448ee51873b598ba8aaa593bf87c Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 7 Sep 2026 21:32:37 -0400
Subject: [PATCH 154/202] deps: update zlib to 1.3.2.1-motley-285e94b

PR-URL: https://github.com/nodejs/node/pull/65835
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 deps/zlib/crc32_simd.c | 2 +-
 src/zlib_version.h     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps/zlib/crc32_simd.c b/deps/zlib/crc32_simd.c
index 20204e322ebe..f9d52a6311e9 100644
--- a/deps/zlib/crc32_simd.c
+++ b/deps/zlib/crc32_simd.c
@@ -22,7 +22,7 @@
 #include <immintrin.h>
 
 #if defined(__GNUC__) || defined(__clang__)
-__attribute__((__target__("avx512f,avx512vl,vpclmulqdq")))
+__attribute__((__target__("avx512f,pclmul,vpclmulqdq")))
 #endif
 uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
     const unsigned char *buf,
diff --git a/src/zlib_version.h b/src/zlib_version.h
index a9d28e3a7cd4..42c81bc0ae5d 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.2.1-motley-5eb4d7e"
+#define ZLIB_VERSION "1.3.2.1-motley-285e94b"
 #endif  // SRC_ZLIB_VERSION_H_

From 2452a0c87695cd3dfab2081c5c12adea50e9f06e Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 7 Sep 2026 21:32:47 -0400
Subject: [PATCH 155/202] deps: update simdjson to 4.6.11

PR-URL: https://github.com/nodejs/node/pull/65834
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 deps/simdjson/simdjson.cpp | 339 +++++++++++++++++++++++++------------
 deps/simdjson/simdjson.h   | 258 +++++++++++++++++++++++-----
 2 files changed, 453 insertions(+), 144 deletions(-)

diff --git a/deps/simdjson/simdjson.cpp b/deps/simdjson/simdjson.cpp
index 92d971fd448b..71f443b3d2bb 100644
--- a/deps/simdjson/simdjson.cpp
+++ b/deps/simdjson/simdjson.cpp
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.cpp:  */
 /* begin file simdjson.cpp */
 #define SIMDJSON_SRC_SIMDJSON_CPP
@@ -240,7 +240,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -10052,9 +10052,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -10065,6 +10070,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -13541,7 +13547,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -13575,7 +13588,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -13597,7 +13610,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -13976,11 +13989,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -14005,6 +14013,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -14021,7 +14035,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -16588,9 +16602,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -16601,6 +16620,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19936,7 +19956,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -19970,7 +19997,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -19992,7 +20019,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -20371,11 +20398,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -20400,6 +20422,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -20416,7 +20444,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -22979,9 +23007,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22992,6 +23025,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -26326,7 +26360,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -26360,7 +26401,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -26382,7 +26423,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -26761,11 +26802,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -26790,6 +26826,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -26806,7 +26848,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -29527,9 +29569,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -29540,6 +29587,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -32987,7 +33035,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -33021,7 +33076,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -33043,7 +33098,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -33422,11 +33477,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -33451,6 +33501,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -33467,7 +33523,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -36435,9 +36491,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36448,6 +36509,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -40210,7 +40272,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -40244,7 +40313,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -40266,7 +40335,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -40645,11 +40714,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -40674,6 +40738,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -40690,7 +40760,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -43189,9 +43259,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -43202,6 +43277,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -46464,7 +46540,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -46498,7 +46581,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -46520,7 +46603,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -46899,11 +46982,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -46928,6 +47006,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -46944,7 +47028,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -49380,9 +49464,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -49393,6 +49482,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -52622,7 +52712,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -52656,7 +52753,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -52678,7 +52775,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -53057,11 +53154,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -53086,6 +53178,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -53102,7 +53200,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -55559,9 +55657,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -55572,6 +55675,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -59199,7 +59303,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -59233,7 +59344,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -59255,7 +59366,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -59634,11 +59745,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -59663,6 +59769,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -59679,7 +59791,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -61715,9 +61827,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -61728,6 +61845,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -63685,7 +63803,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -63719,7 +63844,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -63741,7 +63866,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -64949,8 +65074,8 @@ simdjson_inline void validate_utf8_character() {
   // 2-byte
   if ((buf[idx] & 0x20) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+1 > len || !is_continuation(buf[idx+1]))) {
-      if (idx+1 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+1 >= len || !is_continuation(buf[idx+1]))) {
+      if (idx+1 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64964,8 +65089,8 @@ simdjson_inline void validate_utf8_character() {
   // 3-byte
   if ((buf[idx] & 0x10) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+2 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
-      if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+2 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
+      if (idx+2 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64980,8 +65105,8 @@ simdjson_inline void validate_utf8_character() {
 
   // 4-byte
   // missing continuation
-  if (simdjson_unlikely(idx+3 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
-    if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+  if (simdjson_unlikely(idx+3 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
+    if (idx+3 >= len && is_streaming(partial)) { idx = len; return; }
     error = UTF8_ERROR;
     idx++;
     return;
@@ -65103,9 +65228,15 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       add_structural();
     // Primitive or invalid character (invalid characters will be checked in stage 2)
     } else {
-      // Anything else, add the structural and go until we find the next one
+      // Anything else, add the structural and go until we find the next one.
+      // We also stop on '"' so that an unclosed string still reaches
+      // validate_string(); a quote swallowed by the run would hide it. A
+      // quote cannot occur inside a valid primitive. We deliberately do not
+      // stop on every ESC_ASCII character: that also covers a backslash and the
+      // control characters, and ending the run there makes the fallback
+      // disagree with the SIMD kernels.
       add_structural();
-      while (idx+1<len && !char_is_space_or_operator(buf[idx+1])) {
+      while (idx+1<len && !char_is_space_or_operator(buf[idx+1]) && buf[idx+1] != '"') {
         idx++;
       };
     }
@@ -65125,7 +65256,7 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       if (simdjson_unlikely(parser.n_structural_indexes == 0)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
index 55346b59ef59..43fe09631c01 100644
--- a/deps/simdjson/simdjson.h
+++ b/deps/simdjson/simdjson.h
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.h:  */
 /* begin file simdjson.h */
 #ifndef SIMDJSON_H
@@ -260,7 +260,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -2538,7 +2538,7 @@ namespace std {
 #define SIMDJSON_SIMDJSON_VERSION_H
 
 /** The version of simdjson being used (major.minor.revision) */
-#define SIMDJSON_VERSION "4.6.9"
+#define SIMDJSON_VERSION "4.6.11"
 
 namespace simdjson {
 enum {
@@ -2553,7 +2553,7 @@ enum {
   /**
    * The revision (major.minor.REVISION) of simdjson being used.
    */
-  SIMDJSON_VERSION_REVISION = 9
+  SIMDJSON_VERSION_REVISION = 11
 };
 } // namespace simdjson
 
@@ -4734,6 +4734,7 @@ inline char *allocate_padded_buffer(size_t length) noexcept {
 inline padded_string::padded_string() noexcept = default;
 inline padded_string::padded_string(size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
+  if (data_ptr == nullptr) { viable_size = 0; }
 }
 inline padded_string::padded_string(const char *data, size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
@@ -6351,6 +6352,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
   /**
@@ -9945,6 +9958,9 @@ simdjson_inline size_t document_stream::iterator::current_index() const noexcept
 
 simdjson_inline std::string_view document_stream::iterator::source() const noexcept {
   const char* start = reinterpret_cast<const char*>(stream->buf) + current_index();
+  if (stream->error) {
+    return std::string_view(start, stream->len - current_index());
+  }
   bool object_or_array = ((*start == '[') || (*start == '{'));
   if(object_or_array) {
     size_t next_doc_index = stream->batch_start + stream->parser->implementation->structural_indexes[stream->parser->implementation->next_structural_index - 1];
@@ -14993,9 +15009,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -15006,6 +15027,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -17206,9 +17228,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -17219,6 +17246,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19906,9 +19934,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -19919,6 +19952,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -22606,9 +22640,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22619,6 +22658,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -25421,9 +25461,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -25434,6 +25479,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -28553,9 +28599,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -28566,6 +28617,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -31185,9 +31237,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -31198,6 +31255,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -33795,9 +33853,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -33808,6 +33871,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -36422,9 +36486,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36435,6 +36504,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -39845,7 +39915,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -41940,7 +42010,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -44522,7 +44592,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -47104,7 +47174,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -49801,7 +49871,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -52815,7 +52885,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -55303,7 +55373,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -57814,7 +57884,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -60329,7 +60399,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -66951,6 +67021,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -70987,7 +71069,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -80330,6 +80412,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -84366,7 +84460,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -94196,6 +94290,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -98232,7 +98338,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -108062,6 +108168,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -112098,7 +112216,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -122043,6 +122161,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -126079,7 +126209,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -136341,6 +136471,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -140377,7 +140519,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -150113,6 +150255,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -154149,7 +154303,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -163908,6 +164062,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -167944,7 +168110,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -177707,6 +177873,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -181743,7 +181921,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();

From ad2d4525740a3d6fbcd7a3f580ea2b68156a508c Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Mon, 7 Sep 2026 21:32:56 -0400
Subject: [PATCH 156/202] deps: update googletest to
 283c17563fe7a1111cd7f581aa5d541e8baeff2f

PR-URL: https://github.com/nodejs/node/pull/65833
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .../include/gtest/gtest-assertion-result.h    | 10 +--
 .../googletest/include/gtest/gtest-matchers.h | 11 +---
 .../googletest/include/gtest/gtest-printers.h | 10 +--
 deps/googletest/include/gtest/gtest.h         |  8 +--
 .../include/gtest/internal/gtest-port.h       | 66 +------------------
 .../include/gtest/internal/gtest-string.h     |  5 --
 .../include/gtest/internal/gtest-type-util.h  |  8 +--
 deps/googletest/src/gtest-port.cc             |  6 +-
 deps/googletest/src/gtest.cc                  |  9 ---
 9 files changed, 21 insertions(+), 112 deletions(-)

diff --git a/deps/googletest/include/gtest/gtest-assertion-result.h b/deps/googletest/include/gtest/gtest-assertion-result.h
index a72ac939102e..882e9849353a 100644
--- a/deps/googletest/include/gtest/gtest-assertion-result.h
+++ b/deps/googletest/include/gtest/gtest-assertion-result.h
@@ -143,13 +143,9 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
   // Used in EXPECT_TRUE/FALSE(assertion_result).
   AssertionResult(const AssertionResult& other);
 
-// C4800 is a level 3 warning in Visual Studio 2015 and earlier.
-// This warning is not emitted in Visual Studio 2017.
-// This warning is off by default starting in Visual Studio 2019 but can be
-// enabled with command-line options.
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
+  // C4800 is off by default starting in Visual Studio 2019 but can be
+  // enabled with command-line options.
   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 /* forcing value to bool */)
-#endif
 
   // Used in the EXPECT_TRUE/FALSE(bool_expression).
   //
@@ -171,9 +167,7 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
                              int> = 0>
   explicit AssertionResult(const T& success) : success_(success) {}
 
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
   GTEST_DISABLE_MSC_WARNINGS_POP_()
-#endif
 
   // Assignment operator.
   AssertionResult& operator=(AssertionResult other) {
diff --git a/deps/googletest/include/gtest/gtest-matchers.h b/deps/googletest/include/gtest/gtest-matchers.h
index b5950425cc69..4d7a541d0f1f 100644
--- a/deps/googletest/include/gtest/gtest-matchers.h
+++ b/deps/googletest/include/gtest/gtest-matchers.h
@@ -52,16 +52,9 @@
 #include "gtest/internal/gtest-internal.h"
 #include "gtest/internal/gtest-port.h"
 
-// MSVC warning C5046 is new as of VS2017 version 15.8.
-#if defined(_MSC_VER) && _MSC_VER >= 1915
-#define GTEST_MAYBE_5046_ 5046
-#else
-#define GTEST_MAYBE_5046_
-#endif
-
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(
-    4251 GTEST_MAYBE_5046_ /* class A needs to have dll-interface to be used by
-                              clients of class B */
+    // class A needs to have dll-interface to be used by clients of class B
+    4251 5046
     /* Symbol involving type with internal linkage not defined */)
 
 namespace testing {
diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index f647ee691263..1288313b99ff 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -104,6 +104,8 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 #define GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 
+#include <stdint.h>
+
 #include <any>
 #include <functional>
 #include <memory>
@@ -279,15 +281,13 @@ struct ProtobufPrinter {
 
 struct ConvertibleToIntegerPrinter {
   // Since T has no << operator or PrintTo() but can be implicitly
-  // converted to BiggestInt, we print it as a BiggestInt.
+  // converted to intmax_t, we print it as an intmax_t.
   //
   // Most likely T is an enum type (either named or unnamed), in which
   // case printing it as an integer is the desired behavior.  In case
   // T is not an enum, printing it as an integer is the best we can do
   // given that it has no user-defined printer.
-  static void PrintValue(internal::BiggestInt value, ::std::ostream* os) {
-    *os << value;
-  }
+  static void PrintValue(intmax_t value, ::std::ostream* os) { *os << value; }
 };
 
 struct ConvertibleToStringViewPrinter {
@@ -347,7 +347,7 @@ struct FindFirstPrinter<
 //  - Print object pointers.
 //  - Print protocol buffers.
 //  - Use the stream operator, if available.
-//  - Print types convertible to BiggestInt.
+//  - Print types convertible to intmax_t.
 //  - Print types convertible to StringView, if available.
 //  - Fallback to printing the raw bytes of the object.
 template <typename T>
diff --git a/deps/googletest/include/gtest/gtest.h b/deps/googletest/include/gtest/gtest.h
index 9fe7fb44239e..7c003c5d60e3 100644
--- a/deps/googletest/include/gtest/gtest.h
+++ b/deps/googletest/include/gtest/gtest.h
@@ -1419,14 +1419,14 @@ class [[nodiscard]] EqHelper {
   }
 
   // With this overloaded version, we allow anonymous enums to be used
-  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous
-  // enums can be implicitly cast to BiggestInt.
+  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous enums can be
+  // implicitly cast to intmax_t.
   //
   // Even though its body looks the same as the above version, we
   // cannot merge the two, as it will make anonymous enums unhappy.
   static AssertionResult Compare(const char* lhs_expression,
-                                 const char* rhs_expression, BiggestInt lhs,
-                                 BiggestInt rhs) {
+                                 const char* rhs_expression, intmax_t lhs,
+                                 intmax_t rhs) {
     return CmpHelperEQ(lhs_expression, rhs_expression, lhs, rhs);
   }
 
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 94a56ce3dd9b..154be3c16029 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -236,7 +236,6 @@
 // Integer types:
 //   TypeWithSize   - maps an integer to a int type.
 //   TimeInMillis   - integers of known sizes.
-//   BiggestInt     - the biggest signed integer type.
 //
 // Command-line utilities:
 //   GetInjectableArgvs() - returns the command line as a vector of strings.
@@ -342,13 +341,6 @@
 #define GTEST_INIT_GOOGLE_TEST_NAME_ "testing::InitGoogleTest"
 #endif  // !defined(GTEST_INIT_GOOGLE_TEST_NAME_)
 
-// Determines the version of gcc that is used to compile this.
-#ifdef __GNUC__
-// 40302 means version 4.3.2.
-#define GTEST_GCC_VER_ \
-  (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
-#endif  // __GNUC__
-
 // Macros for disabling Microsoft Visual C++ warnings.
 //
 //   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 4385)
@@ -456,14 +448,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #if defined(_MSC_VER) && defined(_CPPUNWIND)
 // MSVC defines _CPPUNWIND to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__BORLANDC__)
-// C++Builder's implementation of the STL uses the _HAS_EXCEPTIONS
-// macro to enable exceptions, so we'll do the same.
-// Assumes that exceptions are enabled by default.
-#ifndef _HAS_EXCEPTIONS
-#define _HAS_EXCEPTIONS 1
-#endif  // _HAS_EXCEPTIONS
-#define GTEST_HAS_EXCEPTIONS _HAS_EXCEPTIONS
 #elif defined(__clang__)
 // clang defines __EXCEPTIONS if and only if exceptions are enabled before clang
 // 220714, but if and only if cleanups are enabled after that. In Obj-C++ files,
@@ -481,23 +465,11 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #elif defined(__GNUC__) && defined(__EXCEPTIONS) && __EXCEPTIONS
 // gcc defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__SUNPRO_CC)
-// Sun Pro CC supports exceptions.  However, there is no compile-time way of
-// detecting whether they are enabled or not.  Therefore, we assume that
-// they are enabled unless the user tells us otherwise.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__IBMCPP__) && defined(__EXCEPTIONS) && __EXCEPTIONS
-// xlC defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__HP_aCC)
-// Exception handling is in effect by default in HP aCC compiler. It has to
-// be turned of by +noeh compiler option if desired.
-#define GTEST_HAS_EXCEPTIONS 1
 #else
 // For other compilers, we assume exceptions are disabled to be
 // conservative.
 #define GTEST_HAS_EXCEPTIONS 0
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER) && defined(_CPPUNWIND)
 #endif  // GTEST_HAS_EXCEPTIONS
 
 // MSVC either defines wchar_t as a typedef of unsigned short, or as a native
@@ -621,16 +593,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 #define GTEST_HAS_RTTI __has_feature(cxx_rtti)
 
-// Starting with version 9.0 IBM Visual Age defines __RTTI_ALL__ to 1 if
-// both the typeid and dynamic_cast features are present.
-#elif defined(__IBMCPP__) && (__IBMCPP__ >= 900)
-
-#ifdef __RTTI_ALL__
-#define GTEST_HAS_RTTI 1
-#else
-#define GTEST_HAS_RTTI 0
-#endif
-
 #else
 
 // For all other compilers, we assume RTTI is enabled.
@@ -752,8 +714,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 // Typed tests need <typeinfo> and variadic macros, which GCC, VC++ 8.0,
 // Sun Pro CC, IBM Visual Age, and HP aCC support.
-#if defined(__GNUC__) || defined(_MSC_VER) || defined(__SUNPRO_CC) || \
-    defined(__IBMCPP__) || defined(__HP_aCC)
+#if defined(__GNUC__) || defined(_MSC_VER)
 #define GTEST_HAS_TYPED_TEST 1
 #define GTEST_HAS_TYPED_TEST_P 1
 #endif
@@ -867,8 +828,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #ifndef GTEST_HAS_SEH
 // The user didn't tell us, so we need to figure it out.
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// These two compilers are known to support SEH.
+#ifdef _MSC_VER
 #define GTEST_HAS_SEH 1
 #else
 // Assume no SEH.
@@ -2146,12 +2106,6 @@ inline bool IsDir(const StatStruct& st) { return S_ISDIR(st.st_mode); }
 
 #ifdef GTEST_OS_WINDOWS
 
-#ifdef __BORLANDC__
-inline int DoIsATTY(int fd) { return isatty(fd); }
-inline int StrCaseCmp(const char* s1, const char* s2) {
-  return stricmp(s1, s2);
-}
-#else  // !__BORLANDC__
 #if defined(GTEST_OS_WINDOWS_MOBILE) || defined(GTEST_OS_ZOS) || \
     defined(GTEST_OS_IOS) || defined(GTEST_OS_WINDOWS_PHONE) ||  \
     defined(GTEST_OS_WINDOWS_RT) || defined(ESP_PLATFORM)
@@ -2162,7 +2116,6 @@ inline int DoIsATTY(int fd) { return _isatty(fd); }
 inline int StrCaseCmp(const char* s1, const char* s2) {
   return _stricmp(s1, s2);
 }
-#endif  // __BORLANDC__
 
 #else
 
@@ -2264,11 +2217,6 @@ inline const char* GetEnv(const char* name) {
   // We are on an embedded platform, which has no environment variables.
   static_cast<void>(name);  // To prevent 'unused argument' warning.
   return nullptr;
-#elif defined(__BORLANDC__) || defined(__SunOS_5_8) || defined(__SunOS_5_9)
-  // Environment variables which we programmatically clear will be set to the
-  // empty string rather than unset (NULL).  Handle that case.
-  const char* const env = getenv(name);
-  return (env != nullptr && env[0] != '\0') ? env : nullptr;
 #else
   return getenv(name);
 #endif
@@ -2303,14 +2251,6 @@ GTEST_DISABLE_DEPRECATED_POP_()
 #define GTEST_SNPRINTF_ snprintf
 #endif
 
-// The biggest signed integer type the compiler supports.
-//
-// long long is guaranteed to be at least 64-bits in C++11.
-using BiggestInt = long long;  // NOLINT
-
-// The maximum number a BiggestInt can represent.
-constexpr BiggestInt kMaxBiggestInt = (std::numeric_limits<BiggestInt>::max)();
-
 // This template class serves as a compile-time function from size to
 // type.  It maps a size in bytes to a primitive type with that
 // size. e.g.
diff --git a/deps/googletest/include/gtest/internal/gtest-string.h b/deps/googletest/include/gtest/internal/gtest-string.h
index 2363034fc0db..d0652c13c68e 100644
--- a/deps/googletest/include/gtest/internal/gtest-string.h
+++ b/deps/googletest/include/gtest/internal/gtest-string.h
@@ -43,11 +43,6 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 #define GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 
-#ifdef __BORLANDC__
-// string.h is not guaranteed to provide strcpy on C++ Builder.
-#include <mem.h>
-#endif
-
 #include <string.h>
 
 #include <cstdint>
diff --git a/deps/googletest/include/gtest/internal/gtest-type-util.h b/deps/googletest/include/gtest/internal/gtest-type-util.h
index 78da05316d6b..fb4d6823744e 100644
--- a/deps/googletest/include/gtest/internal/gtest-type-util.h
+++ b/deps/googletest/include/gtest/internal/gtest-type-util.h
@@ -47,8 +47,6 @@
 // libstdc++ (which is where cxxabi.h comes from).
 #if GTEST_HAS_CXXABI_H_
 #include <cxxabi.h>
-#elif defined(__HP_aCC)
-#include <acxx_demangle.h>
 #endif  // GTEST_HASH_CXXABI_H_
 
 namespace testing {
@@ -90,13 +88,11 @@ inline std::string CanonicalizeForStdLibVersioning(std::string s) {
 // GetTypeName(const std::type_info&) returns a human-readable name of type T.
 inline std::string GetTypeName(const std::type_info& type) {
   const char* const name = type.name();
-#if GTEST_HAS_CXXABI_H_ || defined(__HP_aCC)
+#if GTEST_HAS_CXXABI_H_
   int status = 0;
   // gcc's implementation of typeid(T).name() mangles the type name,
   // so we have to demangle it.
-#if GTEST_HAS_CXXABI_H_
   using abi::__cxa_demangle;
-#endif  // GTEST_HAS_CXXABI_H_
   char* const readable_name = __cxa_demangle(name, nullptr, nullptr, &status);
   const std::string name_str(status == 0 ? readable_name : name);
   free(readable_name);
@@ -117,7 +113,7 @@ inline std::string GetTypeName(const std::type_info& type) {
   return s;
 #else
   return name;
-#endif  // GTEST_HAS_CXXABI_H_ || __HP_aCC
+#endif  // GTEST_HAS_CXXABI_H_
 }
 #endif  // GTEST_HAS_RTTI
 
diff --git a/deps/googletest/src/gtest-port.cc b/deps/googletest/src/gtest-port.cc
index 5aa800305c7a..be5b16e76d3e 100644
--- a/deps/googletest/src/gtest-port.cc
+++ b/deps/googletest/src/gtest-port.cc
@@ -1242,14 +1242,14 @@ static std::string GetCapturedStream(CapturedStream** captured_stream) {
   return content;
 }
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// MSVC and C++Builder do not provide a definition of STDERR_FILENO.
+#if defined(_MSC_VER)
+// MSVC does not provide a definition of STDERR_FILENO.
 const int kStdOutFileno = 1;
 const int kStdErrFileno = 2;
 #else
 const int kStdOutFileno = STDOUT_FILENO;
 const int kStdErrFileno = STDERR_FILENO;
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER)
 
 // Starts capturing stdout.
 void CaptureStdout() {
diff --git a/deps/googletest/src/gtest.cc b/deps/googletest/src/gtest.cc
index 30a2bb7de0bc..47c60da22916 100644
--- a/deps/googletest/src/gtest.cc
+++ b/deps/googletest/src/gtest.cc
@@ -5289,17 +5289,8 @@ void TestEventListeners::SuppressEventForwarding(bool suppress) {
 // call this before main() starts, from which point on the return
 // value will never change.
 UnitTest* UnitTest::GetInstance() {
-  // CodeGear C++Builder insists on a public destructor for the
-  // default implementation.  Use this implementation to keep good OO
-  // design with private destructor.
-
-#if defined(__BORLANDC__)
-  static UnitTest* const instance = new UnitTest;
-  return instance;
-#else
   static UnitTest instance;
   return &instance;
-#endif  // defined(__BORLANDC__)
 }
 
 // Gets the number of successful test suites.

From b949c28b7957f913bfbf042e6b07a22af59f1f3f Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Tue, 8 Sep 2026 03:33:06 +0200
Subject: [PATCH 157/202] doc: note that FreeEnvironment() runs a shared event
 loop

The embedder docs say each Environment has exactly one `uv_loop_t` and
that an `IsolateData` can be shared between Environments, and
`CreateIsolateData()` takes the loop, so several same-thread
Environments naturally end up on one loop. Nothing mentions that
`FreeEnvironment()` then runs that loop, with JavaScript disallowed on
the isolate, until the freed Environment's handles are gone, so the
other Environments' callbacks can fire inside it. Document that, and
point at it from `FreeEnvironment()` in node.h.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65691
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 doc/api/embedding.md | 10 ++++++++++
 src/node.h           |  3 +++
 2 files changed, 13 insertions(+)

diff --git a/doc/api/embedding.md b/doc/api/embedding.md
index 0309e1120969..dfb84b49ef9b 100644
--- a/doc/api/embedding.md
+++ b/doc/api/embedding.md
@@ -93,6 +93,16 @@ to as `node::Environment`. Each `node::Environment` is associated with:
   that `node::IsolateData` is shared only among `node::Environment`s that
   use the same `v8::Isolate`, Node.js does not perform this check.
 
+`node::Environment`s that share a `node::IsolateData` also share its
+`uv_loop_t`. `node::FreeEnvironment()` runs that loop until the handles of the
+`node::Environment` being freed have closed, and JavaScript execution is
+disallowed on the whole `v8::Isolate` while it does, so pending timers, I/O
+callbacks and thread pool completions that belong to other `node::Environment`s
+on the same loop can run inside that call without being able to call into
+JavaScript. `node::Environment`s that are freed independently of one another
+should each use their own `uv_loop_t` and `node::IsolateData`, or the embedder
+should make sure the others have no pending work when one of them is freed.
+
 In order to set up a `v8::Isolate`, an `v8::ArrayBuffer::Allocator` needs
 to be provided. One possible choice is the default Node.js allocator, which
 can be created through `node::ArrayBufferAllocator::Create()`. Using the Node.js
diff --git a/src/node.h b/src/node.h
index 8e7d1e6a2516..33b85611c0d2 100644
--- a/src/node.h
+++ b/src/node.h
@@ -880,6 +880,9 @@ NODE_EXTERN v8::MaybeLocal<v8::Value> LoadEnvironment(
     const ModuleData* entry_point,
     EmbedderPreloadCallback preload = nullptr);
 
+// Runs `env`'s event loop until its handles have closed, with JavaScript
+// execution disallowed on the isolate; see doc/api/embedding.md if that loop
+// is shared with other Environments.
 NODE_EXTERN void FreeEnvironment(Environment* env);
 
 // Set a callback that is called when process.exit() is called from JS,

From 2f0892aaa744a66c5c5168a26d19bd9a7197677f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=ED=98=9C=EB=AF=B8?=
 <103042868+hyemimi@users.noreply.github.com>
Date: Tue, 8 Sep 2026 11:34:31 +0900
Subject: [PATCH 158/202] typings: add missing sea binding properties

Signed-off-by: hyemimi <hyemi7375@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65815
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 typings/internalBinding/sea.d.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/typings/internalBinding/sea.d.ts b/typings/internalBinding/sea.d.ts
index 15f4430d87d1..258e7f112ed0 100644
--- a/typings/internalBinding/sea.d.ts
+++ b/typings/internalBinding/sea.d.ts
@@ -1,5 +1,8 @@
 export interface SeaBinding {
   getAsset(key: string): ArrayBuffer | undefined;
+  getAssetKeys(): string[];
   isExperimentalSeaWarningNeeded(): boolean;
   isSea(): boolean;
+  isVfsEnabled(): boolean;
+  mainCodePath?: string;
 }

From be41ec79177c18a85142ddf719bfd943c35a38d0 Mon Sep 17 00:00:00 2001
From: greenhead <greenheadhq@gmail.com>
Date: Tue, 8 Sep 2026 11:34:41 +0900
Subject: [PATCH 159/202] typings: add timeoutInfo to TimersBinding

Signed-off-by: greenhead <greenheadhq@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65811
Refs: https://github.com/nodejs/node/pull/46014
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 typings/internalBinding/timers.d.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/typings/internalBinding/timers.d.ts b/typings/internalBinding/timers.d.ts
index e03deeeca240..ccdee1db5044 100644
--- a/typings/internalBinding/timers.d.ts
+++ b/typings/internalBinding/timers.d.ts
@@ -5,4 +5,5 @@ export interface TimersBinding {
   toggleTimerRef(value: boolean): void;
   toggleImmediateRef(value: boolean): void;
   immediateInfo: Uint32Array;
+  timeoutInfo: Int32Array;
 }

From 2987a5965f1f5c6d9f0023406389c57002e63629 Mon Sep 17 00:00:00 2001
From: "Sparsh :)" <76697238+SparshGarg999@users.noreply.github.com>
Date: Tue, 8 Sep 2026 10:23:09 +0530
Subject: [PATCH 160/202] fs: support removing read-only files in rmSync on
 Windows

On Windows, libc++ std::filesystem::remove and remove_all do not
automatically clear the read-only attribute before deleting a file
(unlike MSVC STL). This causes fs.rmSync to fail with EPERM when
trying to remove read-only files in environments where Node.js is
built using clang libc++ (such as Electron).

This commit introduces a Windows-specific helper
ClearReadOnlyAttributeW which clears the FILE_ATTRIBUTE_READONLY
attribute recursively (or for a single file) when
operation_not_permitted is returned, allowing rmSync to
successfully delete read-only files/folders.

Fixes: https://github.com/nodejs/node/issues/64374

Signed-off-by: SparshGarg999 <sparshgarg999@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64453
Fixes: https://github.com/nodejs/node/issues/64374
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
---
 src/node_file.cc            | 54 +++++++++++++++++++++++++++++++++++++
 test/parallel/test-fs-rm.js | 27 +++++++++++++++++++
 2 files changed, 81 insertions(+)

diff --git a/src/node_file.cc b/src/node_file.cc
index b047c5a8e6a7..0179ad12c9d8 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -1763,6 +1763,41 @@ static void RMDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+#ifdef _WIN32
+static void ClearReadOnlyAttributeWHelper(const wchar_t* path) {
+  DWORD attrs = GetFileAttributesW(path);
+  if (attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_READONLY)) {
+    SetFileAttributesW(path, attrs & ~FILE_ATTRIBUTE_READONLY);
+  }
+}
+
+static void ClearReadOnlyAttributeW(const std::filesystem::path& path,
+                                    bool recursive) {
+  std::error_code ec;
+  auto file_status = std::filesystem::symlink_status(path, ec);
+  if (ec) return;
+
+  if (recursive &&
+      file_status.type() == std::filesystem::file_type::directory) {
+    for (const auto& entry : std::filesystem::recursive_directory_iterator(
+             path,
+             std::filesystem::directory_options::skip_permission_denied,
+             ec)) {
+      std::error_code entry_ec;
+      auto entry_status = entry.symlink_status(entry_ec);
+      if (entry_ec) continue;
+      if (entry_status.type() != std::filesystem::file_type::symlink) {
+        ClearReadOnlyAttributeWHelper(entry.path().c_str());
+      }
+    }
+  }
+
+  if (file_status.type() != std::filesystem::file_type::symlink) {
+    ClearReadOnlyAttributeWHelper(path.c_str());
+  }
+}
+#endif
+
 static void RmSync(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
@@ -1810,6 +1845,9 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
   };
 
   int i = 1;
+#ifdef _WIN32
+  bool cleared_readonly = false;
+#endif
 
   while (maxRetries >= 0) {
     if (recursive) {
@@ -1818,6 +1856,22 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
       std::filesystem::remove(file_path, error);
     }
 
+#ifdef _WIN32
+    // On Windows, libc++ does not clear the read-only attribute before
+    // removing a file (unlike MSVC STL which does). Attempt to clear it
+    // manually when we get EPERM (operation_not_permitted) so that read-only
+    // files can be deleted, matching the behavior of official Node.js builds.
+    if (error == std::errc::operation_not_permitted && !cleared_readonly) {
+      cleared_readonly = true;
+      ClearReadOnlyAttributeW(file_path, recursive);
+      if (recursive) {
+        std::filesystem::remove_all(file_path, error);
+      } else {
+        std::filesystem::remove(file_path, error);
+      }
+    }
+#endif  // _WIN32
+
     if (!error || error == std::errc::no_such_file_or_directory) {
       return;
     } else if (!can_omit_error(error)) {
diff --git a/test/parallel/test-fs-rm.js b/test/parallel/test-fs-rm.js
index e92bf8c07971..1d0578e3004d 100644
--- a/test/parallel/test-fs-rm.js
+++ b/test/parallel/test-fs-rm.js
@@ -631,3 +631,30 @@ if (isGitPresent) {
     }
   }
 }
+
+{
+  // Test that rmSync can delete read-only files (and directories containing read-only files recursively)
+  const dirname = nextDirPath();
+  const filePath = path.join(dirname, 'readonly-file.txt');
+  const recursiveDir = path.join(dirname, 'subdir');
+  const recursiveFilePath = path.join(recursiveDir, 'readonly-nested.txt');
+
+  fs.mkdirSync(recursiveDir, { recursive: true });
+  fs.writeFileSync(filePath, 'hello');
+  fs.writeFileSync(recursiveFilePath, 'world');
+
+  // Make files read-only
+  fs.chmodSync(filePath, 0o444);
+  fs.chmodSync(recursiveFilePath, 0o444);
+
+  // rmSync without recursive option on a file
+  fs.rmSync(filePath);
+  assert.strictEqual(fs.existsSync(filePath), false);
+
+  // rmSync with recursive option on a directory containing a read-only file
+  fs.rmSync(recursiveDir, { recursive: true });
+  assert.strictEqual(fs.existsSync(recursiveDir), false);
+
+  // Clean up parent directory
+  fs.rmSync(dirname, { recursive: true, force: true });
+}

From 0a9225dd16035a9837e0880547b6a327ec7f8cf2 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 8 Sep 2026 10:50:21 +0200
Subject: [PATCH 161/202] lib: use Web IDL interface brand checks

Use explicit brand predicates for interface conversion instead of
prototype ancestry. Update CryptoKey and AbortSignal together with the
shared converter contract.

Read internal AbortSignal state during composition. Preserve genuine
signals after prototype changes without invoking shadowed getters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: GitHub Copilot
PR-URL: https://github.com/nodejs/node/pull/65846
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 lib/internal/abort_controller.js              | 31 ++++++------
 lib/internal/crypto/webidl.js                 |  4 +-
 lib/internal/streams/iter/webidl.js           |  7 ++-
 lib/internal/webidl.js                        |  7 ++-
 test/parallel/test-internal-webidl.js         | 48 +++++++++++++++++--
 .../test-webcrypto-cryptokey-brand-check.js   |  5 +-
 test/parallel/test-webcrypto-webidl-brand.js  | 38 +++++++++++++++
 7 files changed, 111 insertions(+), 29 deletions(-)
 create mode 100644 test/parallel/test-webcrypto-webidl-brand.js

diff --git a/lib/internal/abort_controller.js b/lib/internal/abort_controller.js
index 09b160e9fe5a..48dcdaafba2f 100644
--- a/lib/internal/abort_controller.js
+++ b/lib/internal/abort_controller.js
@@ -149,8 +149,8 @@ function refreshCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
   }
@@ -170,8 +170,8 @@ function followCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
 
@@ -217,6 +217,14 @@ function setWeakAbortSignalTimeout(weakRef, delay) {
 }
 
 class AbortSignal extends EventTarget {
+  #brand;
+
+  static {
+    converters.AbortSignal = createInterfaceConverter(
+      'AbortSignal',
+      (value) => typeof value === 'object' && value !== null && #brand in value,
+    );
+  }
 
   /**
    * @param {symbol | undefined} dontThrowSymbol
@@ -337,8 +345,9 @@ class AbortSignal extends EventTarget {
         gcPersistentSignals.add(signal);
       }
 
-      if (signal.aborted) {
-        abortSignal(resultSignal, signal.reason);
+      refreshCompositeSignal(signal);
+      if (signal[kAborted]) {
+        abortSignal(resultSignal, signal[kReason]);
         return resultSignal;
       }
 
@@ -348,11 +357,6 @@ class AbortSignal extends EventTarget {
       } else if (!signal[kSourceSignals]) {
         continue;
       } else {
-        refreshCompositeSignal(signal);
-        if (signal.aborted) {
-          abortSignal(resultSignal, signal.reason);
-          return resultSignal;
-        }
         for (const sourceSignalWeakRef of signal[kSourceSignals]) {
           const sourceSignal = sourceSignalWeakRef.deref();
           if (!sourceSignal) {
@@ -360,8 +364,8 @@ class AbortSignal extends EventTarget {
           }
           assert(!sourceSignal[kComposite]);
 
-          if (sourceSignal.aborted) {
-            abortSignal(resultSignal, sourceSignal.reason);
+          if (sourceSignal[kAborted]) {
+            abortSignal(resultSignal, sourceSignal[kReason]);
             return resultSignal;
           }
 
@@ -466,7 +470,6 @@ class AbortSignal extends EventTarget {
   }
 }
 
-converters.AbortSignal = createInterfaceConverter('AbortSignal', AbortSignal.prototype);
 converters['sequence<AbortSignal>'] = createSequenceConverter(converters.AbortSignal);
 
 function ClonedAbortSignal() {
diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index 7f73d1bd66de..cc24e3342396 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -17,10 +17,10 @@ const {
 const {
   isUint32,
 } = require('internal/validators');
-const { CryptoKey } = require('internal/crypto/webcrypto');
 const {
   getCryptoKeyAlgorithm,
   getCryptoKeyType,
+  isCryptoKey,
 } = require('internal/crypto/keys');
 const {
   bigIntArrayToUnsignedInt,
@@ -618,7 +618,7 @@ converters.AesCtrParams = createDictionaryConverter(
   ]);
 
 converters.CryptoKey = createInterfaceConverter(
-  'CryptoKey', CryptoKey.prototype);
+  'CryptoKey', isCryptoKey);
 
 converters.EcdhKeyDeriveParams = createDictionaryConverter(
   'EcdhKeyDeriveParams', [
diff --git a/lib/internal/streams/iter/webidl.js b/lib/internal/streams/iter/webidl.js
index b971fa95071b..273a52443bf2 100644
--- a/lib/internal/streams/iter/webidl.js
+++ b/lib/internal/streams/iter/webidl.js
@@ -5,10 +5,10 @@ const {
   convertToInt,
   createDictionaryConverter,
   createEnumConverter,
-  createInterfaceConverter,
   createSequenceConverter,
 } = require('internal/webidl');
-const { AbortSignal } = require('internal/abort_controller');
+// Load AbortSignal to register its Web IDL converter in baseConverters.
+require('internal/abort_controller');
 const { isUint8Array } = require('internal/util/types');
 
 const converters = { __proto__: null };
@@ -38,8 +38,7 @@ function allowStreamBufferOptions(options) {
   };
 }
 
-converters.AbortSignal = createInterfaceConverter(
-  'AbortSignal', AbortSignal.prototype);
+converters.AbortSignal = baseConverters.AbortSignal;
 converters.BackpressurePolicy = createEnumConverter('BackpressurePolicy', [
   'strict',
   'unbounded',
diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 71513bbe86f4..2f86117afe9c 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -21,7 +21,6 @@ const {
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
   ObjectPrototypeHasOwnProperty,
-  ObjectPrototypeIsPrototypeOf,
   SafeArrayIterator,
   SafeSet,
   String,
@@ -873,13 +872,13 @@ function createSequenceConverter(converter) {
  * Creates a converter for a Web IDL interface type.
  * @see https://webidl.spec.whatwg.org/#js-interface
  * @param {string} name Interface identifier.
- * @param {object} prototype Interface prototype object.
+ * @param {(value: any) => boolean} brandCheck Interface brand predicate.
  * @returns {Converter}
  */
-function createInterfaceConverter(name, prototype) {
+function createInterfaceConverter(name, brandCheck) {
   return (V, options = kEmptyObject) => {
     // Web IDL interface conversion step 1: return V if it implements I.
-    if (ObjectPrototypeIsPrototypeOf(prototype, V)) {
+    if (brandCheck(V)) {
       return V;
     }
     // Step 2: otherwise throw.
diff --git a/test/parallel/test-internal-webidl.js b/test/parallel/test-internal-webidl.js
index bd08648549be..406a625c26ab 100644
--- a/test/parallel/test-internal-webidl.js
+++ b/test/parallel/test-internal-webidl.js
@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const vm = require('vm');
 const webidl = require('internal/webidl');
@@ -511,10 +511,16 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
 }
 
 {
-  class Example {}
+  class Example {
+    #brand;
+
+    static is(value) {
+      return typeof value === 'object' && value !== null && #brand in value;
+    }
+  }
   const converter = webidl.createInterfaceConverter(
     'Example',
-    Example.prototype);
+    Example.is);
   const example = new Example();
 
   assert.strictEqual(converter(example), example);
@@ -523,6 +529,42 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
     code: 'ERR_INVALID_ARG_TYPE',
     message: 'Prefix: Context is not of type Example.',
   });
+  assertInvalidArgType(() => converter({ __proto__: Example.prototype }));
+  assertInvalidArgType(() => converter(new Proxy(example, {})));
+  Object.setPrototypeOf(example, null);
+  assert.strictEqual(converter(example), example);
+}
+
+{
+  const signal = AbortSignal.abort('reason');
+  for (const value of [
+    Object.create(AbortSignal.prototype, { aborted: { value: false } }),
+    { __proto__: signal },
+    Object.create(AbortSignal.prototype, Object.getOwnPropertyDescriptors(signal)),
+    new Proxy(signal, {}),
+  ]) {
+    assertInvalidArgType(() => converters.AbortSignal(value));
+    assertInvalidArgType(() => AbortSignal.any([value]));
+  }
+
+  Object.setPrototypeOf(signal, null);
+  assert.strictEqual(converters.AbortSignal(signal), signal);
+  const composite = AbortSignal.any([signal]);
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
+}
+
+{
+  const controller = new AbortController();
+  Object.defineProperties(controller.signal, {
+    aborted: { get: common.mustNotCall('Unexpected aborted getter') },
+    reason: { get: common.mustNotCall('Unexpected reason getter') },
+  });
+  const composite = AbortSignal.any([controller.signal]);
+  assert.strictEqual(composite.aborted, false);
+  controller.abort('reason');
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
 }
 
 {
diff --git a/test/parallel/test-webcrypto-cryptokey-brand-check.js b/test/parallel/test-webcrypto-cryptokey-brand-check.js
index 3fe8aaa181a2..9dd115f00721 100644
--- a/test/parallel/test-webcrypto-cryptokey-brand-check.js
+++ b/test/parallel/test-webcrypto-cryptokey-brand-check.js
@@ -54,6 +54,7 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(Object.getPrototypeOf(internalProto), CryptoKey.prototype);
 
   const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+  const invalidArgType = { code: 'ERR_INVALID_ARG_TYPE', name: 'TypeError' };
 
   // Plain object receiver.
   Object.entries(getters).forEach(([, getter]) => {
@@ -94,10 +95,10 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(isCryptoKey(spoofed), false);
   await assert.rejects(
     subtle.sign('HMAC', spoofed, Buffer.from('payload')),
-    invalidThis);
+    invalidArgType);
   await assert.rejects(
     subtle.exportKey('jwk', spoofed),
-    invalidThis);
+    invalidArgType);
 
   // Subvert `instanceof CryptoKey` via Symbol.hasInstance, then
   // invoke the native getters on a forged object. The C++ tag
diff --git a/test/parallel/test-webcrypto-webidl-brand.js b/test/parallel/test-webcrypto-webidl-brand.js
new file mode 100644
index 000000000000..d4d785684906
--- /dev/null
+++ b/test/parallel/test-webcrypto-webidl-brand.js
@@ -0,0 +1,38 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+const { CryptoKey } = require('internal/crypto/keys');
+const { converters } = require('internal/crypto/webidl');
+
+async function main() {
+  const bytes = new Uint8Array(16);
+  const key = await subtle.importKey('raw', bytes, 'AES-GCM', true, ['encrypt']);
+
+  for (const value of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    Object.create(CryptoKey.prototype, Object.getOwnPropertyDescriptors(key)),
+    new Proxy(key, {}),
+  ]) {
+    assert.throws(() => converters.CryptoKey(value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+    await assert.rejects(subtle.exportKey('raw', value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  Object.setPrototypeOf(key, null);
+  assert.strictEqual(converters.CryptoKey(key), key);
+  assert.deepStrictEqual(new Uint8Array(await subtle.exportKey('raw', key)), bytes);
+}
+
+main().then(common.mustCall());

From 70458d593d3107626d438688df209c2c9ef3620e Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 8 Sep 2026 10:50:33 +0200
Subject: [PATCH 162/202] lib: validate sequence iterator objects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reject primitive iterator factory results before accessing next, as
required by GetIteratorFromMethod.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65844
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
---
 lib/internal/webidl.js                |  7 +++++-
 test/parallel/test-internal-webidl.js | 33 +++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 2f86117afe9c..ab13f17f4a0e 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -835,7 +835,12 @@ function createSequenceConverter(converter) {
 
     // Step 4 and create-sequence step 1: get the iterator record.
     const iterator = FunctionPrototypeCall(method, V);
-    const nextMethod = iterator?.next;
+    if (type(iterator) !== 'Object') {
+      throw makeException(
+        'cannot be converted to sequence.',
+        options);
+    }
+    const nextMethod = iterator.next;
     if (typeof nextMethod !== 'function') {
       throw makeException(
         'cannot be converted to sequence.',
diff --git a/test/parallel/test-internal-webidl.js b/test/parallel/test-internal-webidl.js
index 406a625c26ab..f52896d5210f 100644
--- a/test/parallel/test-internal-webidl.js
+++ b/test/parallel/test-internal-webidl.js
@@ -510,6 +510,39 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
   }), []);
 }
 
+for (const [prototype, value] of [
+  [Number.prototype, 1],
+  [String.prototype, 'iterator'],
+  [Boolean.prototype, true],
+  [BigInt.prototype, 1n],
+  [Symbol.prototype, Symbol()],
+]) {
+  let nextReads = 0;
+  Object.defineProperty(prototype, 'next', {
+    configurable: true,
+    get() {
+      nextReads++;
+      return () => ({ done: true });
+    },
+  });
+  try {
+    const iterable = { [Symbol.iterator]: () => value };
+    assertInvalidArgType(() => converters['sequence<DOMString>'](iterable));
+    assertInvalidArgType(() => structuredClone(null, { transfer: iterable }));
+    assert.strictEqual(nextReads, 0);
+  } finally {
+    delete prototype.next;
+  }
+}
+
+{
+  function iterator() {}
+  iterator.next = () => ({ done: true });
+  assert.deepStrictEqual(converters['sequence<DOMString>']({
+    [Symbol.iterator]: () => iterator,
+  }), []);
+}
+
 {
   class Example {
     #brand;

From aea5aadcd6f01bca84e161adb05859b4c32deb62 Mon Sep 17 00:00:00 2001
From: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Date: Tue, 8 Sep 2026 13:24:14 +0200
Subject: [PATCH 163/202] doc: clarify supported Python releases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Exclude Python pre-release versions

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65850
Fixes: https://github.com/nodejs/node/issues/65599
Refs: https://github.com/nodejs/node/pull/65750
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 BUILDING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/BUILDING.md b/BUILDING.md
index e477d46863f4..b46abe291e6d 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -241,7 +241,7 @@ tarball and/or browse the git repository checked out at the relevant tag.
 
 ### Prerequisites
 
-* [A supported version of Python][Python versions] for building and testing.
+* [A supported version of Python][Python versions] (excludes pre-release versions) for building and testing.
 * A Rust toolchain if [building Node.js with Temporal support](#building-nodejs-with-temporal-support).
 * Memory: at least 8GB of RAM is typically required when compiling with 4 parallel jobs (e.g: `make -j4`).
 

From 2d9c861a15b4f7f262ca8d2eeccdc5a927f9f5f5 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pipobscure@users.noreply.github.com>
Date: Tue, 8 Sep 2026 13:35:41 +0200
Subject: [PATCH 164/202] vfs: align virtual file handles with open(2)

A file descriptor obtained on a mounted path answers several `node:fs`
calls differently from one on a real file, in both providers:

* `writeFileSync(path, data, { flag: 'r+' })` replaces the whole file
  instead of overwriting bytes from offset 0 and keeping the tail.
* Numeric open flags are mapped by treating any write-ish bit as "w":
  `O_WRONLY` alone truncates, and `O_RDONLY | O_CREAT` opens the file
  write-only and truncates it.
* A handle opened with "a+" starts its read offset at the end of the
  file, so the first read returns nothing; O_APPEND only affects writes.

The ZipProvider handle additionally:

* throws EISDIR instead of EBADF when reading a write-only handle or
  writing a read-only one;
* leaves stale bytes in place when `ftruncate` grows a file that was
  previously shrunk, where real files read back as zeros;
* rejects a BigInt `position` with a TypeError from mixing number and
  BigInt arithmetic.

This adds a test that runs the same sequence of calls against a memory
mount and a ZIP mount and expects the real-fs result, so every
divergence shows up as its own failing case.

Proposed solution: decode numeric flags bit by bit (O_TRUNC decides
truncation, O_CREAT decides creation, O_WRONLY/O_RDWR decide access)
instead of collapsing them to a flag string; keep the read offset at 0
for append handles and only force writes to the end; make the handle
`writeFile` for non-truncating flags write at offset 0 without
shrinking; in the ZIP handle use EBADF for access-mode violations,
zero-fill on growth in `#doTruncate`, and coerce `position` with
`Number()` as the memory handle does.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65854
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/vfs/file_handle.js               | 107 +++++++++-------
 lib/internal/vfs/providers/memory.js          |  59 ++-------
 lib/internal/vfs/providers/ziparchive.js      | 106 +++++++---------
 test/parallel/test-vfs-handle-semantics.js    | 115 ++++++++++++++++++
 test/parallel/test-vfs-zip-provider-handle.js |  14 ++-
 5 files changed, 240 insertions(+), 161 deletions(-)
 create mode 100644 test/parallel/test-vfs-handle-semantics.js

diff --git a/lib/internal/vfs/file_handle.js b/lib/internal/vfs/file_handle.js
index 7b60c9def2b5..a65fe5f99386 100644
--- a/lib/internal/vfs/file_handle.js
+++ b/lib/internal/vfs/file_handle.js
@@ -27,6 +27,52 @@ const kFlags = Symbol('kFlags');
 const kMode = Symbol('kMode');
 const kPosition = Symbol('kPosition');
 const kClosed = Symbol('kClosed');
+const kAccess = Symbol('kAccess');
+
+const { stringToFlags } = require('internal/fs/utils');
+const {
+  fs: { O_APPEND, O_CREAT, O_EXCL, O_RDONLY, O_RDWR, O_TRUNC, O_WRONLY },
+} = internalBinding('constants');
+
+/**
+ * Decodes open flags into what they ask for. Both the string spellings and
+ * the numeric `fs.constants` values are accepted. The bits decide, because
+ * several numeric combinations (`O_WRONLY` alone, `O_RDONLY | O_CREAT`)
+ * have no string spelling, and collapsing them to the nearest one changes
+ * their meaning: a plain `O_WRONLY` must neither create nor truncate.
+ * @param {string|number} flags
+ * @returns {{ readable: boolean, writable: boolean, create: boolean,
+ *   exclusive: boolean, truncate: boolean, append: boolean }}
+ */
+function decodeOpenFlags(flags) {
+  const bits = typeof flags === 'number' ? flags : stringToFlags(flags);
+  const access = bits & (O_RDONLY | O_WRONLY | O_RDWR);
+  return {
+    __proto__: null,
+    readable: access !== O_WRONLY,
+    writable: access !== O_RDONLY,
+    create: (bits & O_CREAT) !== 0,
+    exclusive: (bits & O_EXCL) !== 0,
+    truncate: (bits & O_TRUNC) !== 0,
+    append: (bits & O_APPEND) !== 0,
+  };
+}
+
+/**
+ * The string spelling closest to numeric flags, for `handle.flags`, which
+ * has always been a string. Behaviour is never derived from it.
+ * @param {string|number} flags
+ * @returns {string}
+ */
+function flagsToString(flags) {
+  if (typeof flags !== 'number') return flags;
+  const { readable, writable, exclusive, truncate, append } = decodeOpenFlags(flags);
+  const plus = readable && writable ? '+' : '';
+  const x = exclusive ? 'x' : '';
+  if (append) return `a${x}${plus}`;
+  if (truncate) return `w${x}${plus}`;
+  return writable ? 'r+' : 'r';
+}
 
 function isCurrentPosition(position) {
   return position === null || position === undefined || position === -1;
@@ -44,7 +90,8 @@ class VirtualFileHandle {
    */
   constructor(path, flags, mode) {
     this[kPath] = path;
-    this[kFlags] = flags;
+    this[kAccess] = decodeOpenFlags(flags);
+    this[kFlags] = flagsToString(flags);
     this[kMode] = mode ?? 0o644;
     this[kPosition] = 0;
     this[kClosed] = false;
@@ -387,19 +434,15 @@ class MemoryFileHandle extends VirtualFileHandle {
     this.#entry = entry;
     this.#getStats = getStats;
 
-    // Handle different open modes
-    if (flags === 'w' || flags === 'w+' ||
-        flags === 'wx' || flags === 'wx+') {
-      // Write mode: truncate
+    // O_TRUNC empties the file at open time. O_APPEND does not move the
+    // read offset: it only forces writes to the end, so the position stays
+    // at 0 and reads start from the beginning as they do on a real file.
+    if (this[kAccess].truncate) {
       this.#content = Buffer.alloc(0);
       this.#size = 0;
       if (entry) {
         entry.content = this.#content;
       }
-    } else if (flags === 'a' || flags === 'a+' ||
-               flags === 'ax' || flags === 'ax+') {
-      // Append mode: position at end
-      this.position = this.#size;
     }
   }
 
@@ -407,7 +450,7 @@ class MemoryFileHandle extends VirtualFileHandle {
    * Throws EBADF if the handle was not opened for writing.
    */
   #checkWritable() {
-    if (this.flags === 'r') {
+    if (!this[kAccess].writable) {
       throw createEBADF('write');
     }
   }
@@ -416,8 +459,7 @@ class MemoryFileHandle extends VirtualFileHandle {
    * Throws EBADF if the handle was not opened for reading.
    */
   #checkReadable() {
-    const f = this.flags;
-    if (f === 'w' || f === 'a' || f === 'wx' || f === 'ax') {
+    if (!this[kAccess].readable) {
       throw createEBADF('read');
     }
   }
@@ -427,8 +469,7 @@ class MemoryFileHandle extends VirtualFileHandle {
    * @returns {boolean}
    */
   #isAppend() {
-    const f = this.flags;
-    return f === 'a' || f === 'a+' || f === 'ax' || f === 'ax+';
+    return this[kAccess].append;
   }
 
   /**
@@ -605,42 +646,16 @@ class MemoryFileHandle extends VirtualFileHandle {
   }
 
   /**
-   * Writes data to the file synchronously.
-   * Replaces content in 'w' mode, appends in 'a' mode.
+   * Writes data to the file synchronously, from the current position (the
+   * end, in append mode), the way `filehandle.writeFile()` does. Whether
+   * earlier content is discarded was decided by the open flags: "w" has
+   * already truncated, "r+" overwrites in place and keeps any tail.
    * @param {Buffer|string} data The data to write
    * @param {object} [options] Options
    */
   writeFileSync(data, options) {
-    this.#checkClosed('write');
-    this.#checkWritable();
-
     const buffer = typeof data === 'string' ? Buffer.from(data, options?.encoding) : data;
-
-    // In append mode, append to existing content
-    if (this.#isAppend()) {
-      const neededSize = this.#size + buffer.length;
-      if (neededSize > this.#content.length) {
-        const newCapacity = MathMax(neededSize, this.#content.length * 2);
-        const newContent = Buffer.alloc(newCapacity);
-        this.#content.copy(newContent, 0, 0, this.#size);
-        this.#content = newContent;
-      }
-      buffer.copy(this.#content, this.#size);
-      this.#size = neededSize;
-    } else {
-      this.#content = Buffer.from(buffer);
-      this.#size = buffer.length;
-    }
-
-    // Update the entry's content, mtime, and ctime
-    if (this.#entry) {
-      const now = DateNow();
-      this.#entry.content = this.#content.subarray(0, this.#size);
-      this.#entry.mtime = now;
-      this.#entry.ctime = now;
-    }
-
-    this.position = this.#size;
+    this.writeSync(buffer, 0, buffer.length, null);
   }
 
   /**
@@ -721,4 +736,6 @@ class MemoryFileHandle extends VirtualFileHandle {
 module.exports = {
   VirtualFileHandle,
   MemoryFileHandle,
+  decodeOpenFlags,
+  kAccess,
 };
diff --git a/lib/internal/vfs/providers/memory.js b/lib/internal/vfs/providers/memory.js
index ce59a0611616..2fd9a7d78cae 100644
--- a/lib/internal/vfs/providers/memory.js
+++ b/lib/internal/vfs/providers/memory.js
@@ -16,7 +16,7 @@ const { Buffer } = require('buffer');
 const { isPromise } = require('util/types');
 const { posix: pathPosix } = require('path');
 const { VirtualProvider } = require('internal/vfs/provider');
-const { MemoryFileHandle } = require('internal/vfs/file_handle');
+const { MemoryFileHandle, decodeOpenFlags } = require('internal/vfs/file_handle');
 const {
   VFSWatcher,
   VFSStatWatcher,
@@ -46,45 +46,12 @@ const { Dirent } = require('internal/fs/utils');
 const { kEmptyObject } = require('internal/util');
 const {
   fs: {
-    O_APPEND,
-    O_CREAT,
-    O_EXCL,
-    O_RDWR,
-    O_TRUNC,
-    O_WRONLY,
     UV_DIRENT_FILE,
     UV_DIRENT_DIR,
     UV_DIRENT_LINK,
   },
 } = internalBinding('constants');
 
-/**
- * Converts numeric flags to a string representation.
- * If already a string, returns as-is.
- * @param {string|number} flags The flags to normalize
- * @returns {string} Normalized string flags
- */
-function normalizeFlags(flags) {
-  if (typeof flags === 'string') return flags;
-  if (typeof flags !== 'number') return 'r';
-
-  const rdwr = (flags & O_RDWR) !== 0;
-  const append = (flags & O_APPEND) !== 0;
-  const excl = (flags & O_EXCL) !== 0;
-  const write = (flags & O_WRONLY) !== 0 ||
-                (flags & O_CREAT) !== 0 ||
-                (flags & O_TRUNC) !== 0;
-
-  if (append) {
-    return 'a' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  }
-  if (write) {
-    return 'w' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  }
-  if (rdwr) return 'r+';
-  return 'r';
-}
-
 /**
  * Converts a time argument (Date, number, or string) to milliseconds.
  * Numbers are treated as seconds (matching Node.js utimes convention).
@@ -496,33 +463,23 @@ class MemoryProvider extends VirtualProvider {
 
   openSync(path, flags, mode) {
     const normalized = this.#normalizePath(path);
+    const access = decodeOpenFlags(flags);
 
-    // Normalize numeric flags to string
-    flags = normalizeFlags(flags);
-
-    // Handle create and exclusive modes
-    const isCreate = flags === 'w' || flags === 'w+' ||
-                     flags === 'a' || flags === 'a+' ||
-                     flags === 'wx' || flags === 'wx+' ||
-                     flags === 'ax' || flags === 'ax+';
-    const isExclusive = flags === 'wx' || flags === 'wx+' ||
-                        flags === 'ax' || flags === 'ax+';
-    const isWritable = flags !== 'r';
-
-    // Check readonly for any writable mode
-    if (this.readonly && isWritable) {
+    // Creating a file is a write even when the handle itself is read-only.
+    if (this.readonly && (access.writable || access.create)) {
       throw createEROFS('open', path);
     }
 
     let entry;
     try {
       entry = this.#getEntry(normalized, 'open');
-      // Exclusive flag: file must not exist
-      if (isExclusive) {
+      // O_EXCL only means anything together with O_CREAT: the file must
+      // not exist yet.
+      if (access.create && access.exclusive) {
         throw createEEXIST('open', path);
       }
     } catch (err) {
-      if (err.code !== 'ENOENT' || !isCreate) throw err;
+      if (err.code !== 'ENOENT' || !access.create) throw err;
       // Create the file
       const parent = this.#ensureParent(normalized, false, 'open');
       const name = pathPosix.basename(normalized);
diff --git a/lib/internal/vfs/providers/ziparchive.js b/lib/internal/vfs/providers/ziparchive.js
index f369cdd22f76..402c92b8b659 100644
--- a/lib/internal/vfs/providers/ziparchive.js
+++ b/lib/internal/vfs/providers/ziparchive.js
@@ -5,6 +5,7 @@ const {
   ArrayPrototypePush,
   MathMax,
   MathMin,
+  Number,
   StringPrototypeIndexOf,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
@@ -20,8 +21,13 @@ const {
   },
 } = require('internal/errors');
 const { VirtualProvider } = require('internal/vfs/provider');
-const { VirtualFileHandle } = require('internal/vfs/file_handle');
 const {
+  VirtualFileHandle,
+  decodeOpenFlags,
+  kAccess,
+} = require('internal/vfs/file_handle');
+const {
+  createEBADF,
   createEEXIST,
   createEISDIR,
   createENOENT,
@@ -33,12 +39,6 @@ const { createFileStats, createDirectoryStats } = require('internal/vfs/stats');
 const { Dirent } = require('internal/fs/utils');
 const {
   fs: {
-    O_APPEND,
-    O_CREAT,
-    O_EXCL,
-    O_RDWR,
-    O_TRUNC,
-    O_WRONLY,
     UV_DIRENT_DIR,
     UV_DIRENT_FILE,
   },
@@ -51,41 +51,30 @@ function normalize(vfsPath) {
   return StringPrototypeStartsWith(vfsPath, '/') ? StringPrototypeSlice(vfsPath, 1) : vfsPath;
 }
 
-// Converts numeric open flags (e.g. `fs.constants.O_RDWR`) to the flag strings
-// the helpers below understand, so a caller passing `node:fs`-style numeric
-// flags through the VFS is handled the same way `fs` would. Strings pass
-// through unchanged; anything else falls back to 'r'.
-function normalizeFlags(flags) {
-  if (typeof flags === 'string') return flags;
-  if (typeof flags !== 'number') return 'r';
-  const rdwr = (flags & O_RDWR) !== 0;
-  const append = (flags & O_APPEND) !== 0;
-  const excl = (flags & O_EXCL) !== 0;
-  const write = (flags & O_WRONLY) !== 0 || (flags & O_CREAT) !== 0 || (flags & O_TRUNC) !== 0;
-  if (append) return 'a' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  if (write) return 'w' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  if (rdwr) return 'r+';
-  return 'r';
-}
-
+// The open flags decide by their bits, not by a string spelling: numeric
+// `fs.constants` combinations such as `O_WRONLY` alone or `O_RDONLY | O_CREAT`
+// have no string form, so `decodeOpenFlags` is the one place that interprets
+// them and these helpers are thin readers over it. They accept both strings
+// and numbers so call sites need not care which they were given.
 function isCurrentPosition(position) {
   return position === null || position === undefined || position === -1;
 }
 
 function isWriteTruncate(flags) {
-  return flags === 'w' || flags === 'w+' || flags === 'wx' || flags === 'wx+';
+  return decodeOpenFlags(flags).truncate;
 }
 
-function isAppend(flags) {
-  return flags === 'a' || flags === 'a+' || flags === 'ax' || flags === 'ax+';
+function isExclusive(flags) {
+  const access = decodeOpenFlags(flags);
+  return access.create && access.exclusive;
 }
 
-function isReadableFlag(flags) {
-  return flags !== 'w' && flags !== 'a' && flags !== 'wx' && flags !== 'ax';
+function mustExist(flags) {
+  return !decodeOpenFlags(flags).create;
 }
 
 function isWritableFlag(flags) {
-  return flags !== 'r';
+  return decodeOpenFlags(flags).writable;
 }
 
 /**
@@ -131,14 +120,15 @@ class ZipFileHandle extends VirtualFileHandle {
     this.#name = name;
     this.#buffer = initial;
     this.#size = initial.length;
-    if (isAppend(flags)) this.position = this.#size;
   }
 
+  // Access-mode violations are EBADF, as for any descriptor opened without
+  // the needed access; EISDIR is for directories only.
   #checkReadable() {
-    if (!isReadableFlag(this.flags)) throw createEISDIR('read', this.path);
+    if (!this[kAccess].readable) throw createEBADF('read');
   }
   #checkWritable() {
-    if (!isWritableFlag(this.flags)) throw createEISDIR('write', this.path);
+    if (!this[kAccess].writable) throw createEBADF('write');
   }
   #ensureCapacity(size) {
     if (size <= this.#buffer.length) return;
@@ -151,7 +141,9 @@ class ZipFileHandle extends VirtualFileHandle {
   #doRead(buffer, offset, length, position) {
     this.#checkReadable();
     const useCurrent = isCurrentPosition(position);
-    const pos = useCurrent ? this.position : position;
+    // `position` may be a BigInt, which fs allows; the arithmetic below is
+    // on numbers.
+    const pos = useCurrent ? this.position : Number(position);
     const available = MathMax(0, this.#size - pos);
     const bytesRead = MathMin(length, available);
     if (bytesRead > 0) this.#buffer.copy(buffer, offset, pos, pos + bytesRead);
@@ -161,14 +153,16 @@ class ZipFileHandle extends VirtualFileHandle {
   async read(buffer, offset, length, position) {
     return this.#doRead(buffer, offset, length, position);
   }
+  // The synchronous form reports the count alone, like `fs.readSync` and the
+  // memory handle; the `{ bytesRead, buffer }` shape belongs to the promise.
   readSync(buffer, offset, length, position) {
-    return this.#doRead(buffer, offset, length, position);
+    return this.#doRead(buffer, offset, length, position).bytesRead;
   }
 
   #doWrite(buffer, offset, length, position) {
     this.#checkWritable();
     const useCurrent = isCurrentPosition(position);
-    const pos = isAppend(this.flags) ? this.#size : (useCurrent ? this.position : position);
+    const pos = this[kAccess].append ? this.#size : (useCurrent ? this.position : Number(position));
     this.#ensureCapacity(pos + length);
     buffer.copy(this.#buffer, pos, offset, offset + length);
     if (pos + length > this.#size) this.#size = pos + length;
@@ -180,7 +174,7 @@ class ZipFileHandle extends VirtualFileHandle {
     return this.#doWrite(buffer, offset, length, position);
   }
   writeSync(buffer, offset, length, position) {
-    return this.#doWrite(buffer, offset, length, position);
+    return this.#doWrite(buffer, offset, length, position).bytesWritten;
   }
 
   #doReadFile(options) {
@@ -196,22 +190,14 @@ class ZipFileHandle extends VirtualFileHandle {
     return this.#doReadFile(options);
   }
 
-  // Replaces content, except in append mode ('a'/'a+'/'ax'/'ax+'), where it
-  // appends to the existing content instead - matching MemoryFileHandle and
-  // what makes `appendFile()`/`appendFileSync()` (built on this, by
-  // VirtualProvider's defaults) actually append.
+  // Writes from the current position (the end, in append mode), the way
+  // `filehandle.writeFile()` does. Whether earlier content is discarded was
+  // decided by the open flags: "w" has already truncated, "r+" overwrites in
+  // place and keeps any tail. This is what makes `appendFile()` (built on
+  // this by VirtualProvider's defaults) actually append.
   #doWriteFile(data, options) {
-    this.#checkWritable();
     const content = typeof data === 'string' ? Buffer.from(data, options?.encoding) : Buffer.from(data);
-    if (isAppend(this.flags)) {
-      this.#ensureCapacity(this.#size + content.length);
-      content.copy(this.#buffer, this.#size);
-      this.#size += content.length;
-    } else {
-      this.#buffer = content;
-      this.#size = content.length;
-    }
-    this.#dirty = true;
+    this.#doWrite(content, 0, content.length, null);
   }
   async writeFile(data, options) {
     this.#doWriteFile(data, options);
@@ -233,6 +219,10 @@ class ZipFileHandle extends VirtualFileHandle {
   #doTruncate(len) {
     this.#checkWritable();
     this.#ensureCapacity(len);
+    // Growing exposes bytes past the old size. A fresh buffer is zeroed, but
+    // one that was shrunk earlier still holds the cut-off content, which a
+    // real file never hands back.
+    if (len > this.#size) this.#buffer.fill(0, this.#size, len);
     this.#size = len;
     this.#dirty = true;
   }
@@ -330,20 +320,19 @@ class ZipProvider extends VirtualProvider {
   }
 
   async open(path, flags, mode) {
-    flags = normalizeFlags(flags);
     const name = normalize(path);
     const fileEntry = await this.#getEntry(name);
     if (fileEntry === null && this.#isDirectory(name)) {
       throw createEISDIR('open', path);
     }
     const exists = fileEntry !== null;
-    if (isWritableFlag(flags) && this.readonly) {
+    if ((isWritableFlag(flags) || !mustExist(flags)) && this.readonly) {
       throw createEROFS('open', path);
     }
-    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+    if (isExclusive(flags) && exists) {
       throw createEEXIST('open', path);
     }
-    if (!exists && (flags === 'r' || flags === 'r+')) {
+    if (!exists && mustExist(flags)) {
       throw createENOENT('open', path);
     }
     let initial = EMPTY_BUFFER;
@@ -353,20 +342,19 @@ class ZipProvider extends VirtualProvider {
     return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
   }
   openSync(path, flags, mode) {
-    flags = normalizeFlags(flags);
     const name = normalize(path);
     const fileEntry = this.#getEntrySync(name);
     if (fileEntry === null && this.#isDirectory(name)) {
       throw createEISDIR('open', path);
     }
     const exists = fileEntry !== null;
-    if (isWritableFlag(flags) && this.readonly) {
+    if ((isWritableFlag(flags) || !mustExist(flags)) && this.readonly) {
       throw createEROFS('open', path);
     }
-    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+    if (isExclusive(flags) && exists) {
       throw createEEXIST('open', path);
     }
-    if (!exists && (flags === 'r' || flags === 'r+')) {
+    if (!exists && mustExist(flags)) {
       throw createENOENT('open', path);
     }
     let initial = EMPTY_BUFFER;
diff --git a/test/parallel/test-vfs-handle-semantics.js b/test/parallel/test-vfs-handle-semantics.js
new file mode 100644
index 000000000000..3cd38fb7f833
--- /dev/null
+++ b/test/parallel/test-vfs-handle-semantics.js
@@ -0,0 +1,115 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// A file handle on a mounted path must answer the same `node:fs` calls the
+// way a descriptor on a real file does. These cases run against both the
+// memory provider and the ZipProvider, and state the real-fs outcome as the
+// expectation. Cases are independent so the runner reports each one.
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+const { test } = require('node:test');
+
+const { O_WRONLY, O_RDONLY, O_CREAT } = fs.constants;
+
+// Each provider is described by a function that mounts a fresh layer holding
+// one file `f` with the given content and returns that file's path.
+const providers = {
+  memory(content) {
+    const layer = vfs.create();
+    layer.writeFileSync('/f', content);
+    return path.join(layer.mount(), 'f');
+  },
+  zip(content) {
+    const entry = zlib.ZipEntry.createSync('f', Buffer.from(content));
+    const chunks = [];
+    for (const chunk of zlib.createZipArchiveSync([entry])) chunks.push(chunk);
+    const provider = new vfs.ZipProvider(new zlib.ZipBuffer(Buffer.concat(chunks)));
+    return path.join(vfs.create(provider).mount(), 'f');
+  },
+};
+
+for (const { 0: name, 1: fileWith } of Object.entries(providers)) {
+  test(`${name}: reading a write-only handle fails with EBADF`, () => {
+    const fd = fs.openSync(fileWith('x'), 'w');
+    try {
+      assert.throws(() => fs.readSync(fd, Buffer.alloc(4), 0, 4, 0), { code: 'EBADF' });
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: writing a read-only handle fails with EBADF`, () => {
+    const fd = fs.openSync(fileWith('x'), 'r');
+    try {
+      assert.throws(() => fs.writeSync(fd, Buffer.from('y')), { code: 'EBADF' });
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: extending a file with ftruncate zero-fills the new region`, () => {
+    const file = fileWith('hello world');
+    const fd = fs.openSync(file, 'r+');
+    fs.ftruncateSync(fd, 5);
+    fs.ftruncateSync(fd, 11);
+    fs.closeSync(fd);
+    // Shrinking then growing must not resurrect the bytes that were cut off.
+    assert.strictEqual(fs.readFileSync(file, 'latin1'), 'hello\0\0\0\0\0\0');
+  });
+
+  test(`${name}: readSync accepts a BigInt position`, () => {
+    const fd = fs.openSync(fileWith('hello'), 'r');
+    try {
+      const buf = Buffer.alloc(4);
+      const n = fs.readSync(fd, buf, 0, 4, 1n);
+      assert.strictEqual(buf.toString('utf8', 0, n), 'ello');
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: numeric O_WRONLY does not truncate`, () => {
+    const file = fileWith('hello');
+    const fd = fs.openSync(file, O_WRONLY);
+    fs.writeSync(fd, Buffer.from('J'), 0, 1, 0);
+    fs.closeSync(fd);
+    // Only O_TRUNC truncates.
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'Jello');
+  });
+
+  test(`${name}: numeric O_RDONLY | O_CREAT opens an existing file readable and intact`, () => {
+    const file = fileWith('hello');
+    const fd = fs.openSync(file, O_RDONLY | O_CREAT);
+    try {
+      const buf = Buffer.alloc(5);
+      const n = fs.readSync(fd, buf, 0, 5, 0);
+      assert.strictEqual(buf.toString('utf8', 0, n), 'hello');
+    } finally {
+      fs.closeSync(fd);
+    }
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'hello');
+  });
+
+  test(`${name}: an "a+" handle reads from the start of the file`, () => {
+    const fd = fs.openSync(fileWith('abc'), 'a+');
+    try {
+      const buf = Buffer.alloc(3);
+      // O_APPEND only moves writes to the end; the read offset starts at 0.
+      const n = fs.readSync(fd, buf, 0, 3, null);
+      assert.strictEqual(buf.toString('utf8', 0, n), 'abc');
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: writeFileSync with flag "r+" overwrites in place without truncating`, () => {
+    const file = fileWith('hello world');
+    fs.writeFileSync(file, 'HEY', { flag: 'r+' });
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'HEYlo world');
+  });
+}
diff --git a/test/parallel/test-vfs-zip-provider-handle.js b/test/parallel/test-vfs-zip-provider-handle.js
index 3c88eacbb8c9..4263864e2410 100644
--- a/test/parallel/test-vfs-zip-provider-handle.js
+++ b/test/parallel/test-vfs-zip-provider-handle.js
@@ -98,7 +98,7 @@ function buildArchiveSync(entries, comment) {
   const handle = provider.openSync('/b.txt', 'r+');
 
   const buf = Buffer.alloc(4);
-  const { bytesRead } = handle.readSync(buf, 0, 4, 2);
+  const bytesRead = handle.readSync(buf, 0, 4, 2);
   assert.strictEqual(bytesRead, 4);
   assert.strictEqual(buf.toString(), '2345');
 
@@ -124,7 +124,8 @@ function buildArchiveSync(entries, comment) {
   const provider = new vfs.ZipProvider(zip);
 
   const handle = await provider.open('/c.txt', 'a');
-  assert.strictEqual(handle.position, 2); // Positioned at EOF on open
+  // O_APPEND only forces writes to the end; the read offset starts at 0.
+  assert.strictEqual(handle.position, 0);
 
   // Even with an explicit (wrong) position, append mode writes at the end.
   await handle.write(Buffer.from('z'), 0, 1, 0);
@@ -259,7 +260,7 @@ function buildArchiveSync(entries, comment) {
   assert.throws(() => provider.rmdirSync('/file.txt'), { code: 'ENOTDIR' });
 })().then(common.mustCall());
 
-// --- open(): EEXIST/ENOENT/EISDIR-on-wrong-direction, called directly on
+// --- open(): EEXIST/ENOENT/EBADF-on-wrong-direction, called directly on
 // the provider so the router can't short-circuit before delegating ---------
 (async () => {
   const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
@@ -271,12 +272,13 @@ function buildArchiveSync(entries, comment) {
   await assert.rejects(provider.open('/missing.txt', 'r'), { code: 'ENOENT' });
   assert.throws(() => provider.openSync('/missing.txt', 'r'), { code: 'ENOENT' });
 
-  // A handle opened write-only can't be read from, and vice versa.
+  // A handle opened write-only can't be read from, and vice versa: EBADF,
+  // as for any descriptor without the needed access.
   const writeOnly = await provider.open('/w.txt', 'w');
-  await assert.rejects(writeOnly.read(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await assert.rejects(writeOnly.read(Buffer.alloc(1), 0, 1, 0), { code: 'EBADF' });
   await writeOnly.close();
   const readOnly = await provider.open('/a.txt', 'r');
-  await assert.rejects(readOnly.write(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await assert.rejects(readOnly.write(Buffer.alloc(1), 0, 1, 0), { code: 'EBADF' });
   await readOnly.close();
 })().then(common.mustCall());
 

From 51c992f99bc0ec6dc1cafdc9f00defa28eead3ea Mon Sep 17 00:00:00 2001
From: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Date: Tue, 8 Sep 2026 14:04:56 +0200
Subject: [PATCH 165/202] doc: expand revert commit collaborator instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Advise to add dont-land labels to commit and revert commit pairs
to prevent redundant backporting.

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65848
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
---
 doc/contributing/collaborator-guide.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/contributing/collaborator-guide.md b/doc/contributing/collaborator-guide.md
index e9dc344dcd38..2966f4dfeec0 100644
--- a/doc/contributing/collaborator-guide.md
+++ b/doc/contributing/collaborator-guide.md
@@ -490,6 +490,10 @@ generated commit message will not have a subsystem and might violate line length
 rules. That is OK. Append the reason for the revert and any `Refs` or `Fixes`
 metadata. Raise a pull request like any other change.
 
+Apply `dont-land-on-v?.x` labels to the revert pull request and to its
+corresponding original pull request,
+unless the original pull request has already been backported.
+
 ### Introducing new modules
 
 Treat commits that introduce new core modules with extra care.

From 271833006c5f766aeb01d2425d28c21a22cf68e5 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 1 Sep 2026 14:07:50 +0200
Subject: [PATCH 166/202] crypto: use primordials in HKDF info validation

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65704
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
---
 lib/internal/crypto/hkdf.js       | 49 ++++++++++++++++++-------------
 test/parallel/test-crypto-hkdf.js | 17 +++++++++++
 2 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
index fcff7070164f..8673f9b46817 100644
--- a/lib/internal/crypto/hkdf.js
+++ b/lib/internal/crypto/hkdf.js
@@ -4,6 +4,8 @@ const {
   ArrayBuffer,
   FunctionPrototypeCall,
   PromiseResolve,
+  TypedArrayPrototypeGetByteLength,
+  Uint8Array,
 } = primordials;
 
 const {
@@ -22,6 +24,7 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
+  getBufferSourceByteLength,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -41,6 +44,7 @@ const {
 const {
   isAnyArrayBuffer,
   isArrayBufferView,
+  isSharedArrayBuffer,
 } = require('internal/util/types');
 
 const {
@@ -51,6 +55,13 @@ const {
   hideStackFrames,
 } = require('internal/errors');
 
+function getByteSourceByteLength(source) {
+  if (isSharedArrayBuffer(source)) {
+    return TypedArrayPrototypeGetByteLength(new Uint8Array(source));
+  }
+  return getBufferSourceByteLength(source);
+}
+
 const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   validateString.withoutStackTrace(hash, 'digest');
   key = prepareKey(key);
@@ -61,11 +72,12 @@ const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   // Coerce -0 to +0.
   length += 0;
 
-  if (info.byteLength > 1024) {
+  const infoByteLength = getByteSourceByteLength(info);
+  if (infoByteLength > 1024) {
     throw new ERR_OUT_OF_RANGE.HideStackFramesError(
       'info',
       'must not contain more than 1024 bytes',
-      info.byteLength);
+      infoByteLength);
   }
 
   return {
@@ -103,18 +115,20 @@ function prepareKey(key) {
   return key;
 }
 
-function hkdf(hash, key, salt, info, length, callback) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
+function createHkdfJob(mode, params) {
+  return new HKDFJob(
+    mode,
+    params.hash,
+    params.key,
+    params.salt,
+    params.info,
+    params.length);
+}
 
+function hkdf(hash, key, salt, info, length, callback) {
+  const params = validateParameters(hash, key, salt, info, length);
   validateFunction(callback, 'callback');
-
-  const job = new HKDFJob(kCryptoJobAsync, hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobAsync, params);
 
   job.ondone = (error, bits) => {
     if (error) return FunctionPrototypeCall(callback, job, error);
@@ -125,15 +139,8 @@ function hkdf(hash, key, salt, info, length, callback) {
 }
 
 function hkdfSync(hash, key, salt, info, length) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
-
-  const job = new HKDFJob(kCryptoJobSync, hash, key, salt, info, length);
+  const params = validateParameters(hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobSync, params);
   const { 0: err, 1: bits } = job.run();
   if (err !== undefined)
     throw err;
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index 80a0a5dea4af..7051c2fae07c 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -108,6 +108,23 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
     code: 'ERR_OUT_OF_RANGE'
   });
 
+  {
+    const info = new Uint8Array(2048);
+    Object.defineProperty(info, 'byteLength', {
+      __proto__: null,
+      get() {
+        return 1;
+      },
+    });
+
+    const calls = [
+      () => hkdf('sha256', 'a', '', info, 10, common.mustNotCall()),
+      () => hkdfSync('sha256', 'a', '', info, 10),
+    ];
+    for (const call of calls)
+      assert.throws(call, { code: 'ERR_OUT_OF_RANGE' });
+  }
+
   assert.throws(
     () => hkdf('sha512', 'a', '', '', 64 * 255 + 1, common.mustNotCall()), {
       code: 'ERR_CRYPTO_INVALID_KEYLEN'

From 51cb9f46a5308a26aad70dc8af117da34a14eba4 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 1 Sep 2026 14:08:14 +0200
Subject: [PATCH 167/202] crypto: validate the limit of PBKDF2 iterations

Reject iteration counts outside of OpenSSL supported range

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65704
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
---
 lib/internal/crypto/webidl.js                |  6 ++++++
 test/fixtures/webcrypto/supports-level-2.mjs |  4 ++++
 test/parallel/test-webcrypto-derivebits.js   | 22 ++++++++++++++++++++
 3 files changed, 32 insertions(+)

diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index cc24e3342396..5ea062dcaf7f 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -15,6 +15,7 @@ const {
   lazyDOMException,
 } = require('internal/util');
 const {
+  isInt32,
   isUint32,
 } = require('internal/validators');
 const {
@@ -489,6 +490,11 @@ converters.Pbkdf2Params = createDictionaryConverter(
         validator: (V, dict) => {
           if (V === 0)
             throw lazyDOMException('iterations cannot be zero', 'OperationError');
+          if (!isInt32(V)) {
+            throw lazyDOMException(
+              'iterations exceeds the implementation limit',
+              'NotSupportedError');
+          }
         },
         required: true,
       },
diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs
index 61633ae95a12..b07ce9097bb7 100644
--- a/test/fixtures/webcrypto/supports-level-2.mjs
+++ b/test/fixtures/webcrypto/supports-level-2.mjs
@@ -122,6 +122,9 @@ export const vectors = {
     [true,
      { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 },
      { name: 'HMAC', hash: 'SHA-256' }],
+    [false,
+     { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 2 ** 31 },
+     { name: 'AES-CBC', length: 128 }],
     [false,
      { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 },
      'HKDF'],
@@ -181,6 +184,7 @@ export const vectors = {
     [true, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 8],
     [true, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 0],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 0 }, 8],
+    [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 2 ** 31 }, 8],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, null],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 7],
     [false, { name: 'PBKDF2', hash: 'Invalid', salt: Buffer.alloc(0), iterations: 1 }, 8],
diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
index 184f997377d0..e7deee0eeae3 100644
--- a/test/parallel/test-webcrypto-derivebits.js
+++ b/test/parallel/test-webcrypto-derivebits.js
@@ -120,6 +120,28 @@ const rejectsXCurves = hasFIPS(3, 5);
   }
 }
 
+// Test PBKDF2 rejects iteration counts beyond the native signed int range
+{
+  async function test() {
+    const key = await subtle.importKey(
+      'raw',
+      new Uint8Array([1]),
+      'PBKDF2',
+      false,
+      ['deriveBits']);
+    await assert.rejects(
+      subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        salt: new Uint8Array([2]),
+        iterations: 2 ** 31,
+      }, key, 8),
+      { name: 'NotSupportedError' });
+  }
+
+  test().then(common.mustCall());
+}
+
 // Test X25519 and X448 bit derivation
 {
   async function test(name) {

From f955c20dd15d9af27b157f73cf02185407369a22 Mon Sep 17 00:00:00 2001
From: Guy Bedford <guybedford@gmail.com>
Date: Mon, 27 Jul 2026 12:39:30 -0700
Subject: [PATCH 168/202] net: support sending net.BoundSocket to threads and
 child processes

This adds support for transferring net.BoundSocket instances to other
threads via the worker_threads postMessage() transfer list, and for
sending them to child processes as the sendHandle argument of
subprocess.send(), following on from the BoundSocket introduction.

A BoundSocket reserves a port synchronously at construction time.
Making it transferable means a port can be reserved on one thread or
process and the bound (but not yet listening or connected) TCP handle
handed off to another to listen or connect on, without racing on the
bind.

For threads, BoundSocket implements kTransfer/kTransferList/
kDeserialize, moving the underlying TCP handle with the same mechanism
used for net.Socket and net.Server transfer. For child processes, the
handleConversion entry reuses the same transfer protocol on the
sending side and the same _TransferredBoundSocket deserialization path
on the receiving side; the underlying transport is that of cluster's
shared-handle scheduling: SCM_RIGHTS on Unix and WSADuplicateSocket on
Windows, both of which carry bind state.

In both cases the source instance is left in the adopted state:
address(), fd() and close() throw ERR_SOCKET_HANDLE_ADOPTED. Transfer
requires an un-adopted, open TCP handle, otherwise
ERR_WORKER_HANDLE_NOT_TRANSFERABLE is thrown; pipe (path) binds are
not transferable and throw ERR_INVALID_HANDLE_TYPE when sent over IPC.
On the receiving side the local address is re-derived from the handle
rather than trusted from serialized state.

Signed-off-by: Guy Bedford <guybedford@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64725
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/child_process.md                      | 16 +++-
 doc/api/errors.md                             | 12 +--
 doc/api/net.md                                | 15 ++++
 doc/api/worker_threads.md                     |  4 +-
 lib/internal/child_process.js                 | 65 +++++++++++----
 lib/net.js                                    | 65 ++++++++++++++-
 .../test-child-process-send-boundsocket.js    | 79 +++++++++++++++++++
 .../test-net-boundsocket-transfer-worker.js   | 64 +++++++++++++++
 test/parallel/test-net-transfer-guards.js     | 39 ++++++++-
 9 files changed, 329 insertions(+), 30 deletions(-)
 create mode 100644 test/parallel/test-child-process-send-boundsocket.js
 create mode 100644 test/parallel/test-net-boundsocket-transfer-worker.js

diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index 138fb52f8612..bdf7d1f98b40 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -1581,7 +1581,7 @@ added: v0.5.9
 
 * `message` {Object} A parsed JSON object or primitive value.
 * `sendHandle` {Handle|undefined} `undefined` or a [`net.Socket`][],
-  [`net.Server`][], or [`dgram.Socket`][] object.
+  [`net.Server`][], [`net.BoundSocket`][], or [`dgram.Socket`][] object.
 
 The `'message'` event is triggered when a child process uses
 [`process.send()`][] to send messages.
@@ -1891,6 +1891,9 @@ subprocess.ref();
 <!-- YAML
 added: v0.5.9
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64725
+    description: '`net.BoundSocket` instances can now be sent.'
   - version: v5.8.0
     pr-url: https://github.com/nodejs/node/pull/5283
     description: The `options` parameter, and the `keepOpen` option
@@ -1905,7 +1908,7 @@ changes:
 
 * `message` {Object}
 * `sendHandle` {Handle|undefined} `undefined`, or a [`net.Socket`][],
-  [`net.Server`][], or [`dgram.Socket`][] object.
+  [`net.Server`][], [`net.BoundSocket`][], or [`dgram.Socket`][] object.
 * `options` {Object} The `options` argument, if present, is an object used to
   parameterize the sending of certain types of handles. `options` supports
   the following properties:
@@ -1972,12 +1975,18 @@ Applications should avoid using such messages or listening for
 `'internalMessage'` events as it is subject to change without notice.
 
 The optional `sendHandle` argument that may be passed to `subprocess.send()` is
-for passing a TCP server or socket object to the child process. The child process will
+for passing a TCP server, socket or [`net.BoundSocket`][] object to the child
+process. The child process will
 receive the object as the second argument passed to the callback function
 registered on the [`'message'`][] event. Any data that is received
 and buffered in the socket will not be sent to the child. Sending IPC sockets is
 not supported on Windows.
 
+Sending a `net.BoundSocket` moves its underlying TCP handle to the child
+process, leaving the source instance in the adopted state as if it had been
+adopted by a server or socket. The bound socket must not have been adopted or
+closed, and pipe (`path`) binds cannot be sent.
+
 The optional `callback` is a function that is invoked after the message is
 sent but before the child process may have received it. The function is called with a
 single argument: `null` on success, or an [`Error`][] object on failure.
@@ -2405,6 +2414,7 @@ or [`child_process.fork()`][].
 [`child_process.spawnSync()`]: #child_processspawnsynccommand-args-options
 [`dgram.Socket`]: dgram.md#class-dgramsocket
 [`maxBuffer` and Unicode]: #maxbuffer-and-unicode
+[`net.BoundSocket`]: net.md#class-netboundsocket
 [`net.Server`]: net.md#class-netserver
 [`net.Socket`]: net.md#class-netsocket
 [`options.detached`]: #optionsdetached
diff --git a/doc/api/errors.md b/doc/api/errors.md
index fa73cb12036b..c425fe262537 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -3057,8 +3057,9 @@ A call was made and the UDP subsystem was not running.
 ### `ERR_SOCKET_HANDLE_ADOPTED`
 
 An operation was attempted on a [`BoundSocket`][] that had already been adopted
-by a [`net.Server`][] or [`net.Socket`][]. Once a bound socket is adopted, its
-`address()` and `close()` methods can no longer be used.
+by a [`net.Server`][] or [`net.Socket`][], or transferred to another thread.
+Once a bound socket is adopted or transferred, its `address()` and `close()`
+methods can no longer be used.
 
 <a id="ERR_SOURCE_MAP_CORRUPT"></a>
 
@@ -3626,9 +3627,10 @@ The `Response` that has been passed to `WebAssembly.compileStreaming` or to
 
 ### `ERR_WORKER_HANDLE_NOT_TRANSFERABLE`
 
-An attempt was made to transfer a `net.Socket` or `net.Server` to another thread
-via a `worker_threads` `postMessage()` call while it was not in a transferable
-state, for example because it had already started reading or had buffered data.
+An attempt was made to transfer a `net.Socket`, `net.Server` or
+`net.BoundSocket` to another thread via a `worker_threads` `postMessage()` call
+while it was not in a transferable state, for example because it had already
+started reading, had buffered data, or had already been adopted.
 
 <a id="ERR_WORKER_INIT_FAILED"></a>
 
diff --git a/doc/api/net.md b/doc/api/net.md
index d0b0e34c6504..de13e601b69b 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -986,6 +986,13 @@ server.listen(8000);
 A listening [`net.Server`][] can be transferred the same way, which moves the
 listening socket itself (and its pending accept queue) to the receiving thread.
 
+An un-adopted TCP [`BoundSocket`][] can also be transferred, which moves the
+bound (but not yet listening or connected) socket. This allows a port to be
+reserved synchronously on one thread and adopted by a server or outgoing
+connection on another. Pipe binds are not transferable. After the transfer, the
+source `BoundSocket` behaves as if it had been adopted: `address()`, `fd()` and
+`close()` throw [`ERR_SOCKET_HANDLE_ADOPTED`][].
+
 ### `new net.Socket([options])`
 
 <!-- YAML
@@ -1921,6 +1928,13 @@ file system entry; abstract and TCP binds have none to remove.
 When a pipe `BoundSocket` bound to a source `path` is adopted as a client, that
 path is reported as the socket's `localAddress` once it connects.
 
+An un-adopted TCP `BoundSocket` can be moved to another thread by listing it in
+the `transferList` of a [`worker_threads`][] `postMessage()` call, see
+[Transferring TCP handles to other threads][]. It can likewise be sent to a
+child process as the `sendHandle` argument of [`subprocess.send()`][]. In both
+cases the source is left in the adopted state. Pipe binds cannot be moved
+either way.
+
 When an adopted `BoundSocket` connects to a numeric IP literal, `connect(2)` is
 issued synchronously, so [`socket.localAddress`][] is resolved once
 [`socket.connect()`][] returns. Connection failures are still reported via a
@@ -2644,6 +2658,7 @@ console.log('listening on', server.address().port);
 [`socket.setTimeout()`]: #socketsettimeouttimeout-callback
 [`socket.setTimeout(timeout)`]: #socketsettimeouttimeout-callback
 [`stream.getDefaultHighWaterMark()`]: stream.md#streamgetdefaulthighwatermarkobjectmode
+[`subprocess.send()`]: child_process.md#subprocesssendmessage-sendhandle-options-callback
 [`worker_threads`]: worker_threads.md
 [`writable.destroy()`]: stream.md#writabledestroyerror
 [`writable.destroyed`]: stream.md#writabledestroyed
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index e7b6b19b355c..d39365d965e4 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -1238,7 +1238,7 @@ port2.postMessage(circularData);
 ```
 
 `transferList` may be a list of {ArrayBuffer}, [`MessagePort`][],
-[`FileHandle`][], {net.Server}, and {net.Socket} objects.
+[`FileHandle`][], {net.Server}, {net.Socket}, and {net.BoundSocket} objects.
 After transferring, they are not usable on the sending side of the channel
 anymore (even if they are not contained in `value`).
 
@@ -1249,6 +1249,8 @@ freshly accepted or created TCP connection that has not yet started reading and
 has no buffered data, otherwise `postMessage()` throws
 `ERR_WORKER_HANDLE_NOT_TRANSFERABLE`. This makes it possible to accept
 connections on one thread and distribute them across a pool of worker threads.
+Transferring a {net.BoundSocket} moves an un-adopted pre-bound socket, so a
+port can be reserved synchronously on one thread and adopted on another.
 Only TCP handles are supported.
 
 If `value` contains {SharedArrayBuffer} instances, those are accessible
diff --git a/lib/internal/child_process.js b/lib/internal/child_process.js
index a12b2954db81..06daf2183db3 100644
--- a/lib/internal/child_process.js
+++ b/lib/internal/child_process.js
@@ -54,6 +54,10 @@ const { TCP } = internalBinding('tcp_wrap');
 const { TTY } = internalBinding('tty_wrap');
 const { UDP } = internalBinding('udp_wrap');
 const SocketList = require('internal/socket_list');
+const {
+  kDeserialize,
+  kTransfer,
+} = require('internal/worker/js_transferable');
 const { owner_symbol } = require('internal/async_hooks').symbols;
 const { convertToValidSignal } = require('internal/util');
 const { isArrayBufferView } = require('internal/util/types');
@@ -86,6 +90,24 @@ const kChannelHandle = Symbol('kChannelHandle');
 const kIsUsedAsStdio = Symbol('kIsUsedAsStdio');
 const kPendingMessages = Symbol('kPendingMessages');
 
+// Store the handle after successfully sending it, so it can be closed when
+// the NODE_HANDLE_ACK is received. If the handle could not be sent, just
+// close it.
+function closeHandleAfterAck(message, handle, options, callback, target) {
+  if (handle && !options.keepOpen) {
+    if (target) {
+      // There can only be one _pendingMessage as passing handles are
+      // processed one at a time: handles are stored in _handleQueue while
+      // waiting for the NODE_HANDLE_ACK of the current passing handle.
+      assert(!target._pendingMessage);
+      target._pendingMessage =
+          { callback, message, handle, options, retransmissions: 0 };
+    } else {
+      handle.close();
+    }
+  }
+}
+
 // This object contain function to convert TCP objects to native handle objects
 // and back again.
 const handleConversion = {
@@ -116,6 +138,29 @@ const handleConversion = {
     },
   },
 
+  'net.BoundSocket': {
+    simultaneousAccepts: true,
+
+    send(message, boundSocket, options) {
+      // Pipe (path) binds cannot be sent over the IPC channel.
+      if (boundSocket.isPipe)
+        throw new ERR_INVALID_HANDLE_TYPE();
+
+      // Reuse the worker_threads transfer protocol: detaches the handle,
+      // leaving the source in the adopted state, and throws if the bound
+      // socket is not in a transferable state.
+      return boundSocket[kTransfer]().data.handle;
+    },
+
+    postSend: closeHandleAfterAck,
+
+    got(message, handle, emit) {
+      const boundSocket = new net._TransferredBoundSocket();
+      boundSocket[kDeserialize]({ handle });
+      emit(boundSocket);
+    },
+  },
+
   'net.Socket': {
     send(message, socket, options) {
       if (!socket._handle)
@@ -165,23 +210,7 @@ const handleConversion = {
       return handle;
     },
 
-    postSend(message, handle, options, callback, target) {
-      // Store the handle after successfully sending it, so it can be closed
-      // when the NODE_HANDLE_ACK is received. If the handle could not be sent,
-      // just close it.
-      if (handle && !options.keepOpen) {
-        if (target) {
-          // There can only be one _pendingMessage as passing handles are
-          // processed one at a time: handles are stored in _handleQueue while
-          // waiting for the NODE_HANDLE_ACK of the current passing handle.
-          assert(!target._pendingMessage);
-          target._pendingMessage =
-              { callback, message, handle, options, retransmissions: 0 };
-        } else {
-          handle.close();
-        }
-      }
-    },
+    postSend: closeHandleAfterAck,
 
     got(message, handle, emit) {
       const socket = new net.Socket({
@@ -822,6 +851,8 @@ function setupChannel(target, channel, serializationMode) {
         message.type = 'net.Socket';
       } else if (handle instanceof net.Server) {
         message.type = 'net.Server';
+      } else if (handle instanceof net.BoundSocket) {
+        message.type = 'net.BoundSocket';
       } else if (handle instanceof TCP || handle instanceof Pipe) {
         message.type = 'net.Native';
       } else if (handle instanceof dgram.Socket) {
diff --git a/lib/net.js b/lib/net.js
index d2b510c64bbb..d9a99bc16758 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -392,6 +392,10 @@ const kBoundPath = Symbol('kBoundPath');
 
 const isLinux = process.platform === 'linux';
 
+// Internal: construct an empty BoundSocket shell during postMessage()
+// deserialization; the transferred handle is installed by [kDeserialize].
+const kBoundSocketDeserialize = Symbol('kBoundSocketDeserialize');
+
 // A role-neutral wrapper over a synchronously bound libuv handle: bound to a
 // local address (a numeric IP literal for TCP, or a filesystem/abstract path
 // for a unix-domain socket via { path }) but neither listening nor connecting
@@ -400,11 +404,20 @@ const isLinux = process.platform === 'linux';
 // handle must be closed by the caller. bind(2) is non-blocking, so binding
 // happens inline and errors throw synchronously. No DNS is performed.
 class BoundSocket {
-  #handle;
+  #handle = null;
   #address = {};
   #path;
 
   constructor(options = kEmptyObject) {
+    // An un-adopted BoundSocket can be moved to another thread by listing it
+    // in the transferList of a worker_threads postMessage() call. See
+    // [kTransfer]().
+    markTransferMode(this, false, true);
+
+    if (options === kBoundSocketDeserialize) {
+      return;
+    }
+
     validateObject(options, 'options');
 
     if (options.path !== undefined) {
@@ -548,7 +561,56 @@ class BoundSocket {
   get isPipe() {
     return this.#path !== undefined;
   }
+
+  // A BoundSocket can be transferred only while it still owns its handle,
+  // i.e. before it has been adopted, closed or already transferred. Only TCP
+  // binds are transferable; pipe handles cannot move between event loops.
+  #assertTransferable() {
+    if (this.#handle === null || !(this.#handle instanceof TCP)) {
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+  }
+
+  [kTransferList]() {
+    this.#assertTransferable();
+    return [this.#handle];
+  }
+
+  [kTransfer]() {
+    this.#assertTransferable();
+    const handle = this.#handle;
+    // Detach the handle; the messaging layer takes ownership of it via
+    // TCPWrap::TransferForMessaging(). Further use on the sending side throws
+    // ERR_SOCKET_HANDLE_ADOPTED, as after adoption.
+    this.#handle = null;
+    return {
+      data: { handle },
+      deserializeInfo: 'net:_TransferredBoundSocket',
+    };
+  }
+
+  [kDeserialize](data) {
+    const handle = data?.handle;
+    if (handle == null || !(handle instanceof TCP)) {
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+    // Re-derive the bound address from the transferred handle rather than
+    // trusting serialized state.
+    const err = handle.getsockname(this.#address);
+    if (err) {
+      handle.close();
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+    this.#handle = handle;
+  }
+}
+
+// Deserialization target for a transferred BoundSocket: constructs an empty
+// shell without binding a new socket. Internal, not part of the public API.
+function _TransferredBoundSocket() {
+  return new BoundSocket(kBoundSocketDeserialize);
 }
+_TransferredBoundSocket.prototype = BoundSocket.prototype;
 
 function Socket(options) {
   if (!(this instanceof Socket)) return new Socket(options);
@@ -2967,6 +3029,7 @@ Server.prototype.unref = function() {
 module.exports = {
   _createServerHandle: createServerHandle,
   _normalizeArgs: normalizeArgs,
+  _TransferredBoundSocket,
   get BlockList() {
     BlockList ??= require('internal/blocklist').BlockList;
     return BlockList;
diff --git a/test/parallel/test-child-process-send-boundsocket.js b/test/parallel/test-child-process-send-boundsocket.js
new file mode 100644
index 000000000000..fff38a108ec9
--- /dev/null
+++ b/test/parallel/test-child-process-send-boundsocket.js
@@ -0,0 +1,79 @@
+'use strict';
+
+// This test verifies that an un-adopted TCP net.BoundSocket can be sent to a
+// child process as the sendHandle argument of subprocess.send(). The parent
+// binds synchronously to reserve the port, then hands the bound socket off;
+// the child adopts it via server.listen() and accepts connections.
+
+const common = require('../common');
+
+const assert = require('assert');
+const net = require('net');
+const { fork } = require('child_process');
+
+if (process.argv[2] === 'child') {
+  process.on('message', common.mustCall((msg, bound) => {
+    assert.ok(bound instanceof net.BoundSocket);
+    // The bound address survives the send.
+    assert.strictEqual(bound.address().port, msg.port);
+
+    const server = net.createServer(common.mustCall((socket) => {
+      socket.end('from-child');
+      server.close();
+    }));
+    server.listen(bound, common.mustCall(() => {
+      assert.strictEqual(server.address().port, msg.port);
+      // Adoption consumed the bound socket.
+      assert.throws(() => bound.address(), {
+        code: 'ERR_SOCKET_HANDLE_ADOPTED',
+      });
+      process.send('listening');
+    }));
+  }));
+  return;
+}
+
+const tmpdir = require('../common/tmpdir');
+tmpdir.refresh();
+
+const child = fork(__filename, ['child']);
+
+// Guards throw synchronously while no handle send is in flight (queued sends
+// defer conversion).
+const pipeBound = new net.BoundSocket({ path: common.PIPE });
+assert.throws(() => child.send('x', pipeBound), {
+  code: 'ERR_INVALID_HANDLE_TYPE',
+});
+pipeBound.close();
+
+const closedBound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+closedBound.close();
+assert.throws(() => child.send('x', closedBound), {
+  code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+});
+
+const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+const { port } = bound.address();
+
+child.send({ port }, bound, common.mustSucceed());
+
+// The source is left in the adopted state; further use throws.
+assert.throws(() => bound.address(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.fd(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.close(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+
+child.on('message', common.mustCall((msg) => {
+  assert.strictEqual(msg, 'listening');
+  const client = net.connect(port, '127.0.0.1');
+  client.setEncoding('utf8');
+  let response = '';
+  client.on('data', (chunk) => { response += chunk; });
+  client.on('end', common.mustCall(() => {
+    assert.strictEqual(response, 'from-child');
+    child.disconnect();
+  }));
+}));
+
+child.on('exit', common.mustCall((code) => {
+  assert.strictEqual(code, 0);
+}));
diff --git a/test/parallel/test-net-boundsocket-transfer-worker.js b/test/parallel/test-net-boundsocket-transfer-worker.js
new file mode 100644
index 000000000000..054be55d7343
--- /dev/null
+++ b/test/parallel/test-net-boundsocket-transfer-worker.js
@@ -0,0 +1,64 @@
+'use strict';
+
+// This test verifies that an un-adopted net.BoundSocket can be transferred to
+// a worker thread via worker_threads postMessage()'s transferList. The parent
+// thread binds synchronously to reserve the port, then hands the bound socket
+// off; the worker adopts it via server.listen() and accepts connections.
+
+const common = require('../common');
+
+const assert = require('assert');
+const net = require('net');
+const {
+  Worker,
+  parentPort,
+  threadId,
+  workerData,
+} = require('worker_threads');
+
+if (workerData?.role === 'server') {
+  parentPort.on('message', common.mustCall(({ bound, port }) => {
+    assert.ok(bound instanceof net.BoundSocket);
+    // The bound address survives the transfer.
+    assert.strictEqual(bound.address().port, port);
+
+    const server = net.createServer((socket) => {
+      socket.end(`served-by:${threadId}`);
+    });
+    server.listen(bound, common.mustCall(() => {
+      assert.strictEqual(server.address().port, port);
+      // Adoption consumed the bound socket.
+      assert.throws(() => bound.address(), {
+        code: 'ERR_SOCKET_HANDLE_ADOPTED',
+      });
+      parentPort.postMessage('listening');
+    }));
+  }));
+  return;
+}
+
+const worker = new Worker(__filename, { workerData: { role: 'server' } });
+
+const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+const { port } = bound.address();
+
+// Move the bound socket to the worker thread.
+worker.postMessage({ bound, port }, [bound]);
+
+// The source is left in the adopted state; further use throws.
+assert.throws(() => bound.address(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.fd(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.close(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+
+worker.on('message', common.mustCall((msg) => {
+  assert.strictEqual(msg, 'listening');
+  const client = net.connect(port, '127.0.0.1');
+  client.setEncoding('utf8');
+  let response = '';
+  client.on('data', (chunk) => { response += chunk; });
+  client.on('end', common.mustCall(() => {
+    assert.match(response, /^served-by:\d+$/);
+    assert.notStrictEqual(response, `served-by:${threadId}`);
+    worker.terminate();
+  }));
+}));
diff --git a/test/parallel/test-net-transfer-guards.js b/test/parallel/test-net-transfer-guards.js
index 0879ec9da81a..d9b836deafbd 100644
--- a/test/parallel/test-net-transfer-guards.js
+++ b/test/parallel/test-net-transfer-guards.js
@@ -1,17 +1,31 @@
 'use strict';
 
-// This test verifies the guards that reject transferring a net.Socket or
-// net.Server that is not in a clean, movable state. Serialization is triggered
-// with a MessageChannel, so no worker thread is required.
+// This test verifies the guards that reject transferring a net.Socket,
+// net.Server or net.BoundSocket that is not in a clean, movable state.
+// Serialization is triggered with a MessageChannel, so no worker thread is
+// required.
 
 const common = require('../common');
 
 const assert = require('assert');
 const net = require('net');
 const { MessageChannel } = require('worker_threads');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
 
 const { port1 } = new MessageChannel();
 
+// A pipe BoundSocket is not transferable; only TCP binds can move between
+// event loops.
+{
+  const bound = new net.BoundSocket({ path: common.PIPE });
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+  bound.close();
+}
+
 // A Server that is not listening (no handle) cannot be transferred.
 {
   const server = net.createServer();
@@ -20,6 +34,25 @@ const { port1 } = new MessageChannel();
   });
 }
 
+// A closed BoundSocket no longer owns a handle and cannot be transferred.
+{
+  const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+  bound.close();
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+}
+
+// An adopted BoundSocket no longer owns a handle and cannot be transferred.
+{
+  const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+  const socket = new net.Socket({ handle: bound });
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+  socket.destroy();
+}
+
 // A Socket that has already consumed data cannot be transferred, because that
 // buffered data would be lost on the sending side.
 {

From 286bc85053b298d6674e7717fdf3aaacd7a8f8f9 Mon Sep 17 00:00:00 2001
From: Seongeun Lee <selee3196@gmail.com>
Date: Tue, 8 Sep 2026 23:39:39 +0900
Subject: [PATCH 169/202] typings: add task_queue internal binding types

Add a TaskQueueBinding declaration for internalBinding('task_queue')
and wire it into InternalBindingMap.

Signed-off-by: leah-1ee <selee3196@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65662
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
---
 typings/globals.d.ts                    |  2 ++
 typings/internalBinding/task_queue.d.ts | 13 +++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 typings/internalBinding/task_queue.d.ts

diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index d8270a6a7fea..7363e7088ee9 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -36,6 +36,7 @@ import { SignalWrapBinding } from './internalBinding/signal_wrap';
 import { StreamPipeBinding } from './internalBinding/stream_pipe';
 import { StringDecoderBinding } from './internalBinding/string_decoder';
 import { SymbolsBinding } from './internalBinding/symbols';
+import { TaskQueueBinding } from './internalBinding/task_queue';
 import { TimersBinding } from './internalBinding/timers';
 import { TypesBinding } from './internalBinding/types';
 import { URLBinding } from './internalBinding/url';
@@ -86,6 +87,7 @@ interface InternalBindingMap {
   stream_pipe: StreamPipeBinding;
   string_decoder: StringDecoderBinding;
   symbols: SymbolsBinding;
+  task_queue: TaskQueueBinding;
   timers: TimersBinding;
   types: TypesBinding;
   url: URLBinding;
diff --git a/typings/internalBinding/task_queue.d.ts b/typings/internalBinding/task_queue.d.ts
new file mode 100644
index 000000000000..5690317f3bfd
--- /dev/null
+++ b/typings/internalBinding/task_queue.d.ts
@@ -0,0 +1,13 @@
+export interface TaskQueueBinding {
+  enqueueMicrotask(callback: () => void): void;
+  setTickCallback(callback: () => void): void;
+  runMicrotasks(): void;
+  tickInfo: Uint8Array;
+  promiseRejectEvents: {
+    kPromiseRejectWithNoHandler: 0;
+    kPromiseHandlerAddedAfterReject: 1;
+  };
+  setPromiseRejectCallback(
+    callback: (type: 0 | 1, promise: Promise<unknown>, value: unknown) => void,
+  ): void;
+}
\ No newline at end of file

From 39ba3b5ae6c13b0afcbb97ad931a882c3cd8bf4b Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 8 Sep 2026 17:20:15 +0200
Subject: [PATCH 170/202] lib: optimize internal Web IDL dictionaries

Flatten dictionary members at construction while preserving inheritance
order. Skip member scans for nullish inputs without defaults or required
members, and define own descriptor properties to avoid inherited
setters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65857
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 lib/internal/webidl.js                        | 85 +++++++++----------
 .../test-internal-webidl-dictionary.js        | 67 +++++++++++++++
 2 files changed, 108 insertions(+), 44 deletions(-)
 create mode 100644 test/parallel/test-internal-webidl-dictionary.js

diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index ab13f17f4a0e..128db9b16c74 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -709,7 +709,7 @@ function createDictionaryConverter(
   };
 
   const dictionaries = ArrayIsArray(members[0]) ? members : [members];
-  const sortedDictionaries = [];
+  const sortedMembers = [];
 
   function ownMember(member, key) {
     return ObjectPrototypeHasOwnProperty(member, key) ? member[key] : undefined;
@@ -723,7 +723,7 @@ function createDictionaryConverter(
   // from least-derived to most-derived and sort only within each dictionary.
   // Callers with inheritance pass one member array per dictionary level.
   for (let i = 0; i < dictionaries.length; i++) {
-    const sortedMembers = ArrayPrototypeToSorted(
+    const sortedDictionary = ArrayPrototypeToSorted(
       dictionaries[i],
       compareMembers,
     );
@@ -732,22 +732,21 @@ function createDictionaryConverter(
     // Re-materialize each descriptor once with every key present, copied from
     // own properties only. The ordinary prototype is deliberate: nothing
     // consults it now, and detaching it measurably slows these reads down.
-    for (let j = 0; j < sortedMembers.length; j++) {
-      const member = sortedMembers[j];
+    for (let j = 0; j < sortedDictionary.length; j++) {
+      const member = sortedDictionary[j];
       const defaultValue = ownMember(member, 'defaultValue');
       const required = ownMember(member, 'required');
       if (typeof defaultValue === 'function' || required) {
         anyMissingMemberHandling = true;
       }
-      sortedMembers[j] = {
+      setOwnProperty(sortedMembers, sortedMembers.length, {
         key: ownMember(member, 'key'),
         converter: ownMember(member, 'converter'),
         defaultValue,
         required,
         validator: ownMember(member, 'validator'),
-      };
+      });
     }
-    ArrayPrototypePush(sortedDictionaries, sortedMembers);
   }
 
   const hasMissingMemberHandling = anyMissingMemberHandling;
@@ -763,43 +762,41 @@ function createDictionaryConverter(
 
     // Step 2: create the IDL dictionary value.
     const idlDict = { __proto__: null };
-
-    // Steps 3-4: iterate each dictionary level, then its sorted members.
-    for (let i = 0; i < sortedDictionaries.length; i++) {
-      const sortedMembers = sortedDictionaries[i];
-      for (let j = 0; j < sortedMembers.length; j++) {
-        const member = sortedMembers[j];
-        // Step 4.1.1: get the dictionary member identifier.
-        const key = member.key;
-        // Steps 4.1.2-4.1.3: read the JavaScript member value.
-        const jsMemberValue = jsDict == null ? undefined : jsDict[key];
-
-        // Step 4.1.4: convert and store present member values.
-        if (jsMemberValue !== undefined) {
-          const converter = member.converter;
-          // Step 4.1.4.1: convert the JavaScript value to IDL.
-          const idlMemberValue = converter(
-            jsMemberValue,
-            makeOptions(options, dictionaryMemberContext(key, options)),
-          );
-          // Validators are a Node.js extension after conversion. They let
-          // consumers reject known unsupported values while dictionary
-          // conversion still has precise member context. Web Crypto uses this
-          // so SubtleCrypto.supports() can make accurate decisions from
-          // normalized dictionaries instead of probing by running operations.
-          member.validator?.(idlMemberValue, jsDict);
-          // Step 4.1.4.2: set idlDict[key] to the IDL value.
-          idlDict[key] = idlMemberValue;
-        } else if (hasMissingMemberHandling) {
-          if (typeof member.defaultValue === 'function') {
-            // Step 4.1.5: store the member default value.
-            idlDict[key] = member.defaultValue();
-          } else if (member.required) {
-            // Step 4.1.6: required missing members throw.
-            throw makeException(
-              missingDictionaryMemberMessage(dictionaryName, key),
-              makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
-          }
+    if (jsDict == null && !hasMissingMemberHandling) return idlDict;
+
+    // Steps 3-4: members retain their per-dictionary order from construction.
+    for (let i = 0; i < sortedMembers.length; i++) {
+      const member = sortedMembers[i];
+      // Step 4.1.1: get the dictionary member identifier.
+      const key = member.key;
+      // Steps 4.1.2-4.1.3: read the JavaScript member value.
+      const jsMemberValue = jsDict == null ? undefined : jsDict[key];
+
+      // Step 4.1.4: convert and store present member values.
+      if (jsMemberValue !== undefined) {
+        const converter = member.converter;
+        // Step 4.1.4.1: convert the JavaScript value to IDL.
+        const idlMemberValue = converter(
+          jsMemberValue,
+          makeOptions(options, dictionaryMemberContext(key, options)),
+        );
+        // Validators are a Node.js extension after conversion. They let
+        // consumers reject known unsupported values while dictionary
+        // conversion still has precise member context. Web Crypto uses this
+        // so SubtleCrypto.supports() can make accurate decisions from
+        // normalized dictionaries instead of probing by running operations.
+        member.validator?.(idlMemberValue, jsDict);
+        // Step 4.1.4.2: set idlDict[key] to the IDL value.
+        idlDict[key] = idlMemberValue;
+      } else if (hasMissingMemberHandling) {
+        if (typeof member.defaultValue === 'function') {
+          // Step 4.1.5: store the member default value.
+          idlDict[key] = member.defaultValue();
+        } else if (member.required) {
+          // Step 4.1.6: required missing members throw.
+          throw makeException(
+            missingDictionaryMemberMessage(dictionaryName, key),
+            makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
         }
       }
     }
diff --git a/test/parallel/test-internal-webidl-dictionary.js b/test/parallel/test-internal-webidl-dictionary.js
new file mode 100644
index 000000000000..fcc6f3e28127
--- /dev/null
+++ b/test/parallel/test-internal-webidl-dictionary.js
@@ -0,0 +1,67 @@
+'use strict';
+
+// Flags: --expose-internals
+
+const common = require('../common');
+const assert = require('node:assert/strict');
+const { createDictionaryConverter } = require('internal/webidl');
+
+const groups = [
+  [{ key: 'z', converter: String }, { key: 'b', converter: String }],
+  [{ key: 'c', converter: String }, { key: 'a', converter: String }],
+];
+let convert;
+Object.defineProperty(Array.prototype, 2, {
+  configurable: true,
+  get: common.mustNotCall(),
+  set: common.mustNotCall(),
+});
+try {
+  convert = createDictionaryConverter('Derived', groups);
+} finally {
+  delete Array.prototype[2];
+}
+
+const first = convert(null);
+const second = convert(undefined, new Proxy({}, { get: common.mustNotCall() }));
+assert.deepStrictEqual(first, { __proto__: null });
+assert.deepStrictEqual(second, first);
+assert.notStrictEqual(first, second);
+
+const trace = [];
+const input = {
+  __proto__: { c: 'inherited' },
+  b: {
+    toString: common.mustCall(() => {
+      trace.push('convert b');
+      input.z = 'changed';
+      return 'b';
+    }),
+  },
+  z: 'original',
+  a: 'a',
+};
+const result = convert(new Proxy(input, {
+  get(target, key) { trace.push(key); return target[key]; },
+}));
+assert.deepStrictEqual(trace, ['b', 'convert b', 'z', 'a', 'c']);
+assert.deepStrictEqual(result, { __proto__: null, b: 'b', z: 'changed', a: 'a', c: 'inherited' });
+
+trace.length = 0;
+convert(new Proxy({}, { get(target, key) { trace.push(key); } }));
+assert.deepStrictEqual(trace, ['b', 'z', 'a', 'c']);
+
+const defaults = createDictionaryConverter('Defaults', [[{
+  key: 'z', converter: common.mustNotCall(), defaultValue: common.mustCall(() => [], 2),
+}]]);
+assert.notStrictEqual(defaults(null).z, defaults(undefined).z);
+
+const required = createDictionaryConverter('Required', [[{
+  key: 'z', converter: common.mustNotCall(), defaultValue: common.mustCall(() => 'default', 2),
+}], [
+  { key: 'a', converter: common.mustNotCall(), required: true },
+  { key: 'b', converter: common.mustNotCall(), defaultValue: common.mustNotCall() },
+]]);
+for (const value of [null, undefined]) {
+  assert.throws(() => required(value), { code: 'ERR_MISSING_OPTION' });
+}

From 345074e360319f4d1115cce5153328bab07a0237 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 8 Sep 2026 17:20:27 +0200
Subject: [PATCH 171/202] meta: add web-standards as webidl owners

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65856
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
---
 .github/CODEOWNERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 4f0c1f58bd2b..2e8dac324f75 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -189,6 +189,7 @@
 # Web Standards
 /lib/internal/bootstrap/web/* @nodejs/web-standards
 /lib/internal/navigator.js @nodejs/web-standards
+/lib/internal/webidl.js @nodejs/web-standards
 /test/fixtures/wpt/ @nodejs/web-standards
 /test/wpt/ @nodejs/web-standards
 

From 41cb09f8a5aee87c2f7121fed474fd126f4f008e Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Tue, 8 Sep 2026 11:50:32 -0400
Subject: [PATCH 172/202] sqlite: bind undefined to NULL

Omitting a named parameter binds NULL, but passing `undefined` for that
same parameter threw ERR_INVALID_ARG_TYPE. Bind `undefined` to NULL so
the two forms agree. This matches the conversion already applied to a
user-defined function's `undefined` return value, as well as SQLite's
own WASM oo1 API.

Fixes: https://github.com/nodejs/node/issues/61824
Refs: https://github.com/nodejs/node/pull/61472
Refs: https://github.com/nodejs/node/pull/62008
Co-authored-by: mike-git374 <217764531+mike-git374@users.noreply.github.com>
Assisted-by: claude:opus-5
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65709
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/sqlite.md                       | 59 ++++++++++++++++++----
 src/node_sqlite.cc                      |  5 +-
 test/parallel/test-sqlite-data-types.js | 65 ++++++++++++++++++++++++-
 3 files changed, 117 insertions(+), 12 deletions(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 7d021381fc94..8a3480060173 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -101,7 +101,7 @@ exception.
 
 | Storage class | JavaScript to SQLite                                            | SQLite to JavaScript                  |
 | ------------- | --------------------------------------------------------------- | ------------------------------------- |
-| `NULL`        | {null}                                                          | {null}                                |
+| `NULL`        | {null} or {undefined}                                           | {null}                                |
 | `INTEGER`     | {number}, {bigint}, or {boolean}                                | {number} or {bigint} _(configurable)_ |
 | `REAL`        | {number}                                                        | {number}                              |
 | `TEXT`        | {string}                                                        | {string}                              |
@@ -113,6 +113,10 @@ values (`1n` and `0n`) when reading BigInts is enabled. Writing a {bigint} that
 does not fit in a signed 64-bit integer throws an `ERR_INVALID_ARG_VALUE`
 error.
 
+`undefined` is written as `NULL`, so passing it explicitly is equivalent to
+omitting a named parameter. `NULL` always reads back as {null}, never
+`undefined`.
+
 APIs that read values from SQLite have a configuration option that determines
 whether `INTEGER` values are converted to `number` or `bigint` in JavaScript,
 such as the `readBigInts` option for statements and the `useBigIntArguments`
@@ -1091,6 +1095,11 @@ Binding a key that does not name a parameter of the statement throws an
 `ERR_INVALID_STATE` error unless unknown named parameters are ignored. See
 [`statement.setAllowUnknownNamedParameters()`][].
 
+Parameters that are never bound are `NULL`, and binding `undefined` has the same
+effect, so `{ $a: undefined }` and `{}` are equivalent. Because `undefined` is
+not an object, passing it in place of `namedParameters` binds it as an anonymous
+parameter instead.
+
 See [Type conversion between JavaScript and SQLite][] for the values that can be
 bound. Binding any other value throws an `ERR_INVALID_ARG_TYPE` error.
 
@@ -1099,6 +1108,9 @@ bound. Binding any other value throws an `ERR_INVALID_ARG_TYPE` error.
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1114,7 +1126,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Array} An array of objects. Each object corresponds to a row
   returned by executing the prepared statement. The keys and values of each
@@ -1187,6 +1200,9 @@ execution of this prepared statement. This property is a wrapper around
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1202,7 +1218,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Object|undefined} An object corresponding to the first row returned
   by executing the prepared statement. The keys and values of the object
@@ -1222,6 +1239,9 @@ added:
   - v23.4.0
   - v22.13.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1237,7 +1257,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Iterator} An iterable iterator of objects. Each object corresponds to a row
   returned by executing the prepared statement. The keys and values of each
@@ -1266,6 +1287,9 @@ executions of the same prepared statement.
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1281,7 +1305,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Object}
   * `changes` {number|bigint} The number of rows modified, inserted, or deleted
@@ -1450,6 +1475,9 @@ class execute synchronously.
 <!-- YAML
 added: v24.9.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1460,7 +1488,8 @@ changes:
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Array} An array of objects representing the rows returned by the query.
 
@@ -1475,6 +1504,9 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1485,7 +1517,8 @@ changes:
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Object | undefined} An object representing the first row returned by
   the query, or `undefined` if no rows are returned.
@@ -1500,6 +1533,9 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1510,7 +1546,8 @@ changes:
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Iterator} An iterator that yields objects representing the rows returned by the query.
 
@@ -1524,6 +1561,9 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
@@ -1534,7 +1574,8 @@ changes:
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Object} An object containing information about the execution, including `changes` and `lastInsertRowid`.
 
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index f52f7e4f9b9c..ed66ef9f0e3b 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -3158,7 +3158,8 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
   // Dates could be supported by converting them to numbers. However, there
   // would not be a good way to read the values back from SQLite with the
   // original type. JS Boolean binds to 1 and 0 because SQLite maps true and
-  // false keywords to 1 and 0.
+  // false keywords to 1 and 0. JS undefined binds to NULL so that passing it
+  // explicitly matches omitting the parameter altogether.
   Isolate* isolate = env()->isolate();
   int r;
   if (value->IsNumber()) {
@@ -3182,7 +3183,7 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
                               SQLITE_TRANSIENT,
                               SQLITE_UTF8);
     }
-  } else if (value->IsNull()) {
+  } else if (value->IsNullOrUndefined()) {
     r = sqlite3_bind_null(statement_.get(), index);
   } else if (value->IsArrayBufferView() || value->IsArrayBuffer() ||
              value->IsSharedArrayBuffer()) {
diff --git a/test/parallel/test-sqlite-data-types.js b/test/parallel/test-sqlite-data-types.js
index bac5a6283135..516233fcb0e8 100644
--- a/test/parallel/test-sqlite-data-types.js
+++ b/test/parallel/test-sqlite-data-types.js
@@ -80,6 +80,70 @@ suite('data binding and mapping', () => {
       query.get(5),
       { __proto__: null, key: 5, int: 1, double: 0, text: '1', buf: null }
     );
+
+    t.assert.deepStrictEqual(
+      stmt.run(6, undefined, undefined, undefined, undefined),
+      { changes: 1, lastInsertRowid: 6 }
+    );
+    t.assert.deepStrictEqual(
+      query.get(6),
+      { __proto__: null, key: 6, int: null, double: null, text: null, buf: null }
+    );
+  });
+
+  test('undefined is bound as NULL', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.after(() => { db.close(); });
+    const setup = db.exec(
+      'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
+    );
+    t.assert.strictEqual(setup, undefined);
+    const stmt = db.prepare('INSERT INTO types (key, val) VALUES ($k, $v)');
+    const query = db.prepare('SELECT * FROM types WHERE key = ?');
+
+    // An explicit `undefined` and an omitted named parameter are equivalent.
+    t.assert.deepStrictEqual(
+      stmt.run({ k: 1, v: undefined }),
+      { changes: 1, lastInsertRowid: 1 }
+    );
+    t.assert.deepStrictEqual(
+      stmt.run({ k: 2 }),
+      { changes: 1, lastInsertRowid: 2 }
+    );
+    t.assert.deepStrictEqual(
+      query.get(1),
+      { __proto__: null, key: 1, val: null }
+    );
+    t.assert.deepStrictEqual(
+      query.get(2),
+      { __proto__: null, key: 2, val: null }
+    );
+
+    t.assert.deepStrictEqual(
+      db.prepare('SELECT ? AS a').get(undefined),
+      { __proto__: null, a: null }
+    );
+  });
+
+  test('undefined is not treated as the named parameters argument', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.after(() => { db.close(); });
+
+    // `undefined` is not an object, so it is bound as an anonymous parameter
+    // rather than being treated as the named parameters argument.
+    t.assert.throws(() => {
+      db.prepare('SELECT $k AS a').get(undefined);
+    }, {
+      code: 'ERR_SQLITE_ERROR',
+      message: /column index out of range/,
+    });
+
+    t.assert.throws(() => {
+      db.prepare('SELECT ? AS a').get(1, undefined);
+    }, {
+      code: 'ERR_SQLITE_ERROR',
+      message: /column index out of range/,
+    });
   });
 
   test('large strings are bound correctly', (t) => {
@@ -126,7 +190,6 @@ suite('data binding and mapping', () => {
     t.assert.strictEqual(setup, undefined);
 
     [
-      undefined,
       () => {},
       Symbol(),
       /foo/,

From d2e49c83a5e6dd3edea75f7b31451a7fe8f4dae7 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 8 Sep 2026 17:58:10 +0200
Subject: [PATCH 173/202] tools: apply feedback to and simplify contributor
 guidance workflow

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65785
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
---
 .github/workflows/contributor-guidance.yml | 78 ++++++++++------------
 1 file changed, 36 insertions(+), 42 deletions(-)

diff --git a/.github/workflows/contributor-guidance.yml b/.github/workflows/contributor-guidance.yml
index e9a99bcb6277..4035ea932077 100644
--- a/.github/workflows/contributor-guidance.yml
+++ b/.github/workflows/contributor-guidance.yml
@@ -1,3 +1,8 @@
+# This action requires the following secrets to be set on the repository:
+#   GH_USER_TOKEN: GitHub user token, used because FIRST_TIMER and
+#                  FIRST_TIME_CONTRIBUTOR associations are only returned for
+#                  privileged API calls
+
 name: Contributor guidance
 
 on:
@@ -9,8 +14,7 @@ permissions: {}
 jobs:
   contributor:
     name: Resolve contributor status
-    # Use the event only to exclude trusted associations, mannequins, and bots.
-    # Resolve every potentially external contributor with a privileged API request.
+    # Avoid allocating a runner unless a welcome or scan is a plausible outcome.
     if: >-
       github.run_attempt == 1 &&
       github.repository == 'nodejs/node' &&
@@ -22,52 +26,40 @@ jobs:
     runs-on: ubuntu-slim
     outputs:
       is_first_time: ${{ steps.resolve.outputs.is_first_time }}
+      # The event association may not expose private organization membership,
+      # so gate the guidance job on the privileged API result.
       should_scan: ${{ steps.resolve.outputs.should_scan }}
     steps:
       - name: Check author association
         id: resolve
         env:
+          EVENT_ASSOCIATION: ${{ github.event.pull_request.author_association }}
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          started_at=$SECONDS
-          # TODO: Remove the retries once privileged API requests are confirmed
-          # to return the association immediately.
-          for delay in 0 15 30 60; do
-            sleep "$delay"
-            association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
-              --jq '.author_association')
-            elapsed=$((SECONDS - started_at))
-            echo "Author association after ${elapsed}s: $association"
-
-            case "$association" in
-              FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
-                echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
-                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
-                exit 0
-                ;;
-              CONTRIBUTOR)
-                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
-                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
-                exit 0
-                ;;
-              NONE)
-                ;;
-              COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
-                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
-                echo 'should_scan=false' >> "$GITHUB_OUTPUT"
-                exit 0
-                ;;
-              *)
-                echo "Unexpected author association: $association" >&2
-                exit 1
-                ;;
-            esac
-          done
+          api_association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
+            --jq '.author_association')
+          echo "API author association: $api_association"
+          echo "Event author association: $EVENT_ASSOCIATION"
 
-          # NONE is unresolved, not trusted. Scan without posting the welcome.
-          echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
-          echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+          case "$api_association" in
+            FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
+              echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+              ;;
+            CONTRIBUTOR|NONE)
+              echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+              ;;
+            COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
+              echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=false' >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "Unexpected author association: $api_association" >&2
+              exit 1
+              ;;
+          esac
 
   guidance:
     name: Apply contributor guidance
@@ -90,8 +82,12 @@ jobs:
           scan-issues: false
           auto-close: false
           honeypot: false
+          # The privileged association check skips trusted authors before this job,
+          # so `trusted-author-associations` would be redundant here.
+          # trusted-author-associations: collaborator,member,owner
 
       - name: Comment with contributor guidance
+        if: env.IS_FIRST_TIME == 'true' || env.ADD_CAUTION == 'true'
         env:
           ADD_CAUTION: >-
             ${{
@@ -137,10 +133,8 @@ jobs:
             body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE"
           elif [[ "$IS_FIRST_TIME" == "true" ]]; then
             body="$WELCOME_MESSAGE"
-          elif [[ "$ADD_CAUTION" == "true" ]]; then
-            body="$CAUTION_MESSAGE"
           else
-            exit 0
+            body="$CAUTION_MESSAGE"
           fi
 
           printf '%s\n' "$body" |

From 7c5115d0015eaa40329f2c70af453b5deb06de8a Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Tue, 8 Sep 2026 18:13:56 +0200
Subject: [PATCH 174/202] tools: improve benchmark build cache reuse

Match Linux x64 benchmark builds to the Perfetto-enabled V8
configuration already cached by shared-library CI.

Enable the GHA sccache backend in read-only mode for base builds.
Retain the compiler wrapper for incremental PR builds, but stop the
remote-backed server and use a read-only local cache for PR code.

Assisted-by: GitHub Copilot
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65859
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
---
 .github/workflows/benchmark.yml | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index b512153621d8..924feb42725e 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -69,13 +69,14 @@ jobs:
         include:
           - runner: ubuntu-24.04
             system: x86_64-linux
+            perfetto: true
           - runner: ubuntu-24.04-arm
             system: aarch64-linux
           - runner: macos-15-intel
             system: x86_64-darwin
           - runner: macos-latest
             system: aarch64-darwin
-    name: '${{ matrix.system }}: with shared libraries'
+    name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}'
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -105,7 +106,8 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
-            core.exportVariable('SCCACHE_GHA_VERSION', 'on');
+            core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
+            core.exportVariable('SCCACHE_GHA_RW_MODE', 'READ_ONLY');
             core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
             core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
@@ -115,14 +117,16 @@ jobs:
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
             --pure --keep TAR_DIR --keep FLAKY_TESTS \
-            --keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
+            --keep SCCACHE_GHA_ENABLED --keep SCCACHE_GHA_RW_MODE \
+            --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
             --arg useSeparateDerivationForV8 true \
+            --arg withPerfetto ${{ matrix.perfetto || false }} \
             --arg loadJSBuiltinsDynamically false \
-            --arg ccache "${NIX_SCCACHE:-null}" \
+            --arg ccache '(import <nixpkgs> {}).sccache' \
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
-                make build-ci -j4 V=1
+              make build-ci -j4 V=1 && sccache --stop-server
             '
           mv out/Release/node base_node
 
@@ -130,19 +134,22 @@ jobs:
         run: git reset FETCH_HEAD --hard
 
       - name: Re-build Node.js on the merge commit
-        # ccache is disabled here to avoid polluting the cache. Local build outputs should make this build relatively quick anyway.
+        # Keep the compiler command unchanged for incremental builds, but never cache PR build outputs.
         run: |
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
-            --pure \
+            --pure --keep SCCACHE_LOCAL_RW_MODE \
             --arg useSeparateDerivationForV8 true \
+            --arg withPerfetto ${{ matrix.perfetto || false }} \
             --arg loadJSBuiltinsDynamically false \
-            --arg ccache 'null' \
+            --arg ccache '(import <nixpkgs> {}).sccache' \
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
                 make build-ci -j4 V=1
             '
+        env:
+          SCCACHE_LOCAL_RW_MODE: READ_ONLY
 
       - name: Run benchmark
         run: |

From 244f86c5567b43bb834a21365272d834689851ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCrg=C3=BCn=20Day=C4=B1o=C4=9Flu?= <hey@gurgun.day>
Date: Tue, 8 Sep 2026 19:33:28 +0200
Subject: [PATCH 175/202] stream: amortize writable buffer compaction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/65847
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 benchmark/streams/writable-buffered-drain.js | 25 ++++++++++++++++++++
 lib/internal/streams/writable.js             |  2 +-
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 benchmark/streams/writable-buffered-drain.js

diff --git a/benchmark/streams/writable-buffered-drain.js b/benchmark/streams/writable-buffered-drain.js
new file mode 100644
index 000000000000..5ebed16624ea
--- /dev/null
+++ b/benchmark/streams/writable-buffered-drain.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common');
+const { Writable } = require('stream');
+
+const bench = common.createBenchmark(main, {
+  count: [1024, 16384, 65536],
+  n: [100],
+});
+
+function main({ count, n }) {
+  const chunk = {};
+  let callback;
+  const stream = new Writable({
+    objectMode: true,
+    write(chunk, encoding, cb) { callback = cb; },
+  });
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    for (let j = 0; j < count; j++) stream.write(chunk);
+    for (let j = 0; j < count; j++) callback();
+  }
+  bench.end(n);
+}
diff --git a/lib/internal/streams/writable.js b/lib/internal/streams/writable.js
index 47e003ea3a8a..09d713f8a1fe 100644
--- a/lib/internal/streams/writable.js
+++ b/lib/internal/streams/writable.js
@@ -787,7 +787,7 @@ function clearBuffer(stream, state) {
 
     if (i === buffered.length) {
       resetBuffer(state);
-    } else if (i > 256) {
+    } else if (i > 256 && i * 2 >= buffered.length) {
       buffered.splice(0, i);
       state.bufferedIndex = 0;
     } else {

From 523ac2c43d18ee527ccac696c0976e95e6812610 Mon Sep 17 00:00:00 2001
From: Trevor Burnham <trevorburnham@gmail.com>
Date: Tue, 8 Sep 2026 13:33:51 -0400
Subject: [PATCH 176/202] test: move sqlite length validation out of the
 reentry test

The "non-integer callback length" suite in
test-sqlite-options-getter-reentry.js checks that function() and
aggregate() reject a callback whose length property is not an integer.
That is plain argument validation: no property getter runs, and nothing
changes mid-call, so the tests do not belong in a file about option
getters re-entering the database.

Move them into the "input validation" suites that already cover the
other argument type checks for each method. Drop "a normal function
length is still accepted", which duplicates "uses function.length when
false" in test-sqlite-custom-functions.js.

The two tests that put the getter on length itself stay where they are,
since closing the database from that getter is what they exercise.

Refs: https://github.com/nodejs/node/pull/65595
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65769
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 .../test-sqlite-aggregate-function.mjs        | 44 ++++++++++++++
 test/parallel/test-sqlite-custom-functions.js | 22 +++++++
 .../test-sqlite-options-getter-reentry.js     | 59 -------------------
 3 files changed, 66 insertions(+), 59 deletions(-)

diff --git a/test/parallel/test-sqlite-aggregate-function.mjs b/test/parallel/test-sqlite-aggregate-function.mjs
index 5d12eeb24b6f..6c921b866cbe 100644
--- a/test/parallel/test-sqlite-aggregate-function.mjs
+++ b/test/parallel/test-sqlite-aggregate-function.mjs
@@ -7,6 +7,19 @@ describe('DatabaseSync.prototype.aggregate()', () => {
   describe('input validation', () => {
     const db = new DatabaseSync(':memory:');
 
+    // The length property is configurable, so any type can reach the
+    // conversion that derives the aggregate's arity from it.
+    const lengths = ['abc', {}, [], null, undefined, NaN, 1.5,
+                     Symbol.iterator, 10n, true, 2 ** 40];
+
+    function withLength(fn, length) {
+      Object.defineProperty(fn, 'length', {
+        configurable: true,
+        value: length,
+      });
+      return fn;
+    }
+
     test('throws if options.start is not provided', (t) => {
       t.assert.throws(() => {
         db.aggregate('sum', {
@@ -81,6 +94,37 @@ describe('DatabaseSync.prototype.aggregate()', () => {
         message: /The "options\.inverse" argument must be a function/,
       });
     });
+
+    test('throws if options.step.length is not an integer', (t) => {
+      for (const length of lengths) {
+        t.assert.throws(() => {
+          db.aggregate('sum', {
+            start: 0,
+            step: withLength((acc, value) => acc + value, length),
+            result: (total) => total
+          });
+        }, {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "options\.step\.length" property must be an integer/,
+        }, `length=${String(length)}`);
+      }
+    });
+
+    test('throws if options.inverse.length is not an integer', (t) => {
+      for (const length of lengths) {
+        t.assert.throws(() => {
+          db.aggregate('sum', {
+            start: 0,
+            step: (acc, value) => acc + value,
+            inverse: withLength((acc, value) => acc - value, length),
+            result: (total) => total
+          });
+        }, {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "options\.inverse\.length" property must be an integer/,
+        }, `length=${String(length)}`);
+      }
+    });
   });
 });
 
diff --git a/test/parallel/test-sqlite-custom-functions.js b/test/parallel/test-sqlite-custom-functions.js
index 6b5f974ede89..0b783ce9bcf6 100644
--- a/test/parallel/test-sqlite-custom-functions.js
+++ b/test/parallel/test-sqlite-custom-functions.js
@@ -71,6 +71,28 @@ suite('DatabaseSync.prototype.function()', () => {
         message: /The "options\.directOnly" argument must be a boolean/,
       });
     });
+
+    test('throws if function.length is not an integer', () => {
+      // The length property is configurable, so any type can reach the
+      // conversion that derives the function's arity from it.
+      const lengths = ['abc', {}, [], null, undefined, NaN, 1.5,
+                       Symbol.iterator, 10n, true, 2 ** 40];
+
+      for (const length of lengths) {
+        const fn = () => 1;
+        Object.defineProperty(fn, 'length', {
+          configurable: true,
+          value: length,
+        });
+
+        assert.throws(() => {
+          db.function('foo', fn);
+        }, {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "function\.length" property must be an integer/,
+        }, `length=${String(length)}`);
+      }
+    });
   });
 
   suite('useBigIntArguments', () => {
diff --git a/test/parallel/test-sqlite-options-getter-reentry.js b/test/parallel/test-sqlite-options-getter-reentry.js
index 495b85db92fb..1aaf4c4fbb79 100644
--- a/test/parallel/test-sqlite-options-getter-reentry.js
+++ b/test/parallel/test-sqlite-options-getter-reentry.js
@@ -242,62 +242,3 @@ suite('resizing a deserialize() buffer from an options getter', () => {
     });
   });
 });
-
-// fn.length is configurable, so it must be validated rather than cast blindly.
-suite('non-integer callback length', () => {
-  const badLengths = ['abc', {}, [], null, undefined, NaN, 1.5, Symbol.iterator,
-                      10n, true, 2 ** 40];
-
-  test('function() rejects a non-integer length', (t) => {
-    const db = new DatabaseSync(':memory:');
-    for (const value of badLengths) {
-      const fn = () => 1;
-      Object.defineProperty(fn, 'length', { configurable: true, value });
-      t.assert.throws(() => {
-        db.function('fn', fn);
-      }, {
-        code: 'ERR_INVALID_ARG_TYPE',
-        message: /The "function\.length" property must be an integer/,
-      }, `length=${String(value)}`);
-    }
-  });
-
-  test('aggregate() rejects a non-integer step length', (t) => {
-    const db = new DatabaseSync(':memory:');
-    for (const value of badLengths) {
-      const step = (acc, next) => acc;
-      Object.defineProperty(step, 'length', { configurable: true, value });
-      t.assert.throws(() => {
-        db.aggregate('agg', { start: 0, step, result: (acc) => acc });
-      }, {
-        code: 'ERR_INVALID_ARG_TYPE',
-        message: /The "options\.step\.length" property must be an integer/,
-      }, `length=${String(value)}`);
-    }
-  });
-
-  test('aggregate() rejects a non-integer inverse length', (t) => {
-    const db = new DatabaseSync(':memory:');
-    for (const value of badLengths) {
-      const inverse = (acc, next) => acc;
-      Object.defineProperty(inverse, 'length', { configurable: true, value });
-      t.assert.throws(() => {
-        db.aggregate('agg', {
-          start: 0,
-          step: (acc, next) => acc,
-          inverse,
-          result: (acc) => acc,
-        });
-      }, {
-        code: 'ERR_INVALID_ARG_TYPE',
-        message: /The "options\.inverse\.length" property must be an integer/,
-      }, `length=${String(value)}`);
-    }
-  });
-
-  test('a normal function length is still accepted', (t) => {
-    const db = new DatabaseSync(':memory:');
-    db.function('plus', (a, b) => a + b);
-    t.assert.strictEqual(db.prepare('SELECT plus(1, 2) AS v').get().v, 3);
-  });
-});

From e4186d69424c1bbe01203e93ddd43c7222ba5060 Mon Sep 17 00:00:00 2001
From: Avocado <150404953+zeexzeex@users.noreply.github.com>
Date: Wed, 9 Sep 2026 02:34:05 +0900
Subject: [PATCH 177/202] doc: add DOMException section to errors API reference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document DOMException on the Errors page (with a Globals cross-link)
and clarify AbortError vs DOMException for AbortSignal users.
Builds on #64236 review feedback. Fixes #40789.

Signed-off-by: Avocado <ujubongbong@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65206
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/errors.md | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/doc/api/errors.md b/doc/api/errors.md
index c425fe262537..f54ba1d9058c 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -397,6 +397,32 @@ error object, such as a {Proxy}.
 Indicates the failure of an assertion. For details, see
 [`Class: assert.AssertionError`][].
 
+## Class: `DOMException`
+
+<!-- YAML
+added: v17.0.0
+-->
+
+* Extends: {errors.Error}
+
+The Web IDL {DOMException} class. These errors are thrown by web-platform APIs
+in Node.js such as [`fetch()`][], {AbortController}, {AbortSignal}, and Web
+Streams. For details, see also [`Class: DOMException`][] on the Globals page.
+
+The [`domException.name`][] property identifies the type of the exception (for
+example, `'AbortError'`). Unlike most errors in Node.js, the
+[`domException.code`][] property is a number that corresponds to a
+[legacy error code name][Web IDL error names] (for example, `20` for
+`ABORT_ERR`).
+
+Node.js-specific APIs that support {AbortSignal} (such as
+[`events.once()`][]) throw a Node.js `AbortError` (a native {errors.Error} with
+`name` of `'AbortError'` and `code` of [`'ABORT_ERR'`][ABORT_ERR]) rather than a
+{DOMException}. To identify abort errors in either case, checking
+`err?.name === 'AbortError'` is sufficient.
+
+See also [`ABORT_ERR`][].
+
 ## Class: `RangeError`
 
 * Extends: {errors.Error}
@@ -4682,6 +4708,7 @@ The public key in the certificate SubjectPublicKeyInfo could not be read.
 
 An error occurred trying to allocate memory. This should never happen.
 
+[ABORT_ERR]: #abort_err
 [ES Module]: esm.md
 [ICU]: intl.md#internationalization-support
 [JSON Web Key Elliptic Curve Registry]: https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve
@@ -4695,6 +4722,7 @@ An error occurred trying to allocate memory. This should never happen.
 [V8's stack trace API]: https://v8.dev/docs/stack-trace-api
 [WHATWG Supported Encodings]: util.md#whatwg-supported-encodings
 [WHATWG URL API]: url.md#the-whatwg-url-api
+[Web IDL error names]: https://webidl.spec.whatwg.org/#dfn-error-names-table
 [`"exports"`]: packages.md#exports
 [`"imports"`]: packages.md#imports
 [`'uncaughtException'`]: process.md#event-uncaughtexception
@@ -4702,7 +4730,9 @@ An error occurred trying to allocate memory. This should never happen.
 [`--force-fips`]: cli.md#--force-fips
 [`--no-addons`]: cli.md#--no-addons
 [`--unhandled-rejections`]: cli.md#--unhandled-rejectionsmode
+[`ABORT_ERR`]: #abort_err
 [`BoundSocket`]: net.md#class-netboundsocket
+[`Class: DOMException`]: globals.md#class-domexception
 [`Class: assert.AssertionError`]: assert.md#class-assertassertionerror
 [`ERR_INCOMPATIBLE_OPTION_PAIR`]: #err_incompatible_option_pair
 [`ERR_INVALID_ARG_TYPE`]: #err_invalid_arg_type
@@ -4731,10 +4761,13 @@ An error occurred trying to allocate memory. This should never happen.
 [`dgram.createSocket()`]: dgram.md#dgramcreatesocketoptions-callback
 [`dgram.disconnect()`]: dgram.md#socketdisconnect
 [`dgram.remoteAddress()`]: dgram.md#socketremoteaddress
+[`domException.code`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException/code
 [`domException.name`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException/name
 [`errno`(3) man page]: https://man7.org/linux/man-pages/man3/errno.3.html
 [`error.code`]: #errorcode
 [`error.message`]: #errormessage
+[`events.once()`]: events.md#eventsonceemitter-name-options
+[`fetch()`]: globals.md#fetch
 [`fs.Dir`]: fs.md#class-fsdir
 [`fs.cp()`]: fs.md#fscpsrc-dest-options-callback
 [`fs.readFileSync`]: fs.md#fsreadfilesyncpath-options

From ee354929da65110b4cba09578764d92b06dfcc46 Mon Sep 17 00:00:00 2001
From: Marten Richter <marten.richter@tu-berlin.de>
Date: Tue, 8 Sep 2026 19:43:27 +0200
Subject: [PATCH 178/202] quic: fix crash in onStreamClose

onStreamClose could crash, if this[kOwner]
was not set.

Signed-off-by: Marten Richter <marten.richter@freenet.de>
PR-URL: https://github.com/nodejs/node/pull/65861
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
---
 lib/internal/quic/quic.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 8ecd5fc776a3..04e99ecc3232 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -962,9 +962,10 @@ setCallbacks({
     // Called when the stream C++ handle has been closed. The error is
     // either undefined (clean close) or a raw array [type, code, reason]
     // from QuicError::ToV8Value. Convert to a proper Node.js Error.
+    if (!this[kOwner]) return;
     if (error !== undefined) {
       error = convertQuicError(error);
-    } else if (this[kOwner] && !this[kOwner].destroyed) {
+    } else if (!this[kOwner].destroyed) {
       // The stream is closing cleanly, but it may have been reset by the
       // peer (ReceiveStreamReset) or locally (resetStream). The C++ side
       // records the reset code in state.resetCode. If set, surface the

From 450450c15a996c2c6bb1e3b100710ae004668b09 Mon Sep 17 00:00:00 2001
From: James M Snell <jsnell@cloudflare.com>
Date: Sun, 6 Sep 2026 10:46:57 -0700
Subject: [PATCH 179/202] quic: split headers out from src/quic/stream.{h/cc}

As part of the effort to get better separation between
the generalized QUIC streams and HTTP/3 streams, separate
out header handling from the C++ class.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65863
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 lib/internal/quic/quic.js                     |  54 +++-
 lib/internal/quic/state.js                    |  40 ---
 src/quic/application.cc                       |   2 +-
 src/quic/application.h                        |  30 +-
 src/quic/bindingdata.cc                       |  50 +++
 src/quic/bindingdata.h                        |   2 +
 src/quic/defs.h                               |  11 -
 src/quic/http3.cc                             | 294 ++++++++++++------
 src/quic/streams.cc                           | 181 +----------
 src/quic/streams.h                            |  87 ++----
 .../parallel/test-quic-h3-header-interest.mjs |  76 +++++
 11 files changed, 440 insertions(+), 387 deletions(-)
 create mode 100644 test/parallel/test-quic-h3-header-interest.mjs

diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 04e99ecc3232..b6bb31aa97b4 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -50,7 +50,9 @@ let debug = require('internal/util/debuglog').debuglog('quic', (fn) => {
 
 const {
   Endpoint: Endpoint_,
+  sendHeaders,
   setCallbacks,
+  setHeadersInterest,
 
   // The constants to be exposed to end users for various options.
   CC_ALGO_RENO_STR: CC_ALGO_RENO,
@@ -1304,6 +1306,17 @@ function parseHeaderPairs(pairs) {
   return block;
 }
 
+function updateHeaderInterest(handle, inner) {
+  if (handle === undefined) return;
+  setHeadersInterest(
+    handle,
+    inner.onheaders !== undefined ||
+      inner.ontrailers !== undefined ||
+      inner.oninfo !== undefined,
+    inner.onwanttrailers !== undefined || inner.pendingTrailers !== undefined,
+  );
+}
+
 /**
  * Applies session and stream callbacks from an options object to a session.
  * @param {QuicSession} session
@@ -1828,13 +1841,12 @@ class QuicStream {
     const inner = this.#inner;
     if (fn === undefined) {
       inner.onheaders = undefined;
-      inner.state.wantsHeaders = false;
     } else {
       validateFunction(fn, 'onheaders');
       assertHeadersSupported(inner.session);
       inner.onheaders = FunctionPrototypeBind(fn, this);
-      inner.state.wantsHeaders = true;
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /** @type {Function|undefined} */
@@ -1853,6 +1865,7 @@ class QuicStream {
       assertHeadersSupported(inner.session);
       inner.oninfo = FunctionPrototypeBind(fn, this);
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /** @type {Function|undefined} */
@@ -1871,6 +1884,7 @@ class QuicStream {
       assertHeadersSupported(inner.session);
       inner.ontrailers = FunctionPrototypeBind(fn, this);
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /** @type {Function|undefined} */
@@ -1884,13 +1898,12 @@ class QuicStream {
     const inner = this.#inner;
     if (fn === undefined) {
       inner.onwanttrailers = undefined;
-      inner.state.wantsTrailers = false;
     } else {
       validateFunction(fn, 'onwanttrailers');
       assertHeadersSupported(inner.session);
       inner.onwanttrailers = FunctionPrototypeBind(fn, this);
-      inner.state.wantsTrailers = true;
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /**
@@ -1919,10 +1932,12 @@ class QuicStream {
     assertHeadersSupported(inner.session);
     if (headers === undefined) {
       inner.pendingTrailers = undefined;
+      updateHeaderInterest(this.#handle, inner);
       return;
     }
     validateObject(headers, 'headers');
     inner.pendingTrailers = headers;
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /**
@@ -2105,7 +2120,8 @@ class QuicStream {
     const headerString = buildNgHeaderString(
       headers, assertValidPseudoHeader, true /* strictSingleValueFields */);
     const flags = terminal ? kHeadersFlagsTerminal : kHeadersFlagsNone;
-    return this.#handle.sendHeaders(kHeadersKindInitial, headerString, flags);
+    return sendHeaders(
+      this.#handle, kHeadersKindInitial, headerString, flags);
   }
 
   /**
@@ -2124,8 +2140,8 @@ class QuicStream {
     validateObject(headers, 'headers');
     const headerString = buildNgHeaderString(
       headers, assertValidPseudoHeader, true);
-    return this.#handle.sendHeaders(
-      kHeadersKindHints, headerString, kHeadersFlagsNone);
+    return sendHeaders(
+      this.#handle, kHeadersKindHints, headerString, kHeadersFlagsNone);
   }
 
   /**
@@ -2144,8 +2160,8 @@ class QuicStream {
     }
     validateObject(headers, 'headers');
     const headerString = buildNgHeaderString(headers);
-    return this.#handle.sendHeaders(
-      kHeadersKindTrailing, headerString, kHeadersFlagsNone);
+    return sendHeaders(
+      this.#handle, kHeadersKindTrailing, headerString, kHeadersFlagsNone);
   }
 
   /**
@@ -2563,7 +2579,7 @@ class QuicStream {
       assertValidPseudoHeader,
       true, // This could become an option in future
     );
-    return this.#handle.sendHeaders(kind, headerString, flags);
+    return sendHeaders(this.#handle, kind, headerString, flags);
   }
 
   [kFinishClose](error) {
@@ -2671,7 +2687,6 @@ class QuicStream {
 
     switch (kindName) {
       case 'initial':
-        assert(inner.onheaders, 'Unexpected stream headers event');
         inner.headers ??= block;
         if (onStreamHeadersChannel.hasSubscribers) {
           onStreamHeadersChannel.publish({
@@ -2681,7 +2696,8 @@ class QuicStream {
             headers: block,
           });
         }
-        safeCallbackInvoke(inner.onheaders, this, block);
+        if (inner.onheaders)
+          safeCallbackInvoke(inner.onheaders, this, block);
         break;
       case 'trailing':
         if (onStreamTrailersChannel.hasSubscribers) {
@@ -2717,8 +2733,20 @@ class QuicStream {
     // nghttp3 is asking us to provide trailers to send.
     // Check for pre-set pendingTrailers first, then the callback.
     if (inner.pendingTrailers) {
-      this.sendTrailers(inner.pendingTrailers);
+      let sent;
+      try {
+        sent = this.sendTrailers(inner.pendingTrailers);
+      } catch (error) {
+        this.destroy(error);
+        return;
+      }
+      if (!sent) {
+        this.destroy(new ERR_QUIC_STREAM_ABORTED(
+          'Failed to submit trailing headers'));
+        return;
+      }
       inner.pendingTrailers = undefined;
+      updateHeaderInterest(this.#handle, inner);
     } else if (typeof inner.onwanttrailers === 'function') {
       safeCallbackInvoke(inner.onwanttrailers, this);
     }
diff --git a/lib/internal/quic/state.js b/lib/internal/quic/state.js
index 769fee687498..21db0f0e3d59 100644
--- a/lib/internal/quic/state.js
+++ b/lib/internal/quic/state.js
@@ -101,10 +101,8 @@ const {
   IDX_STATE_STREAM_HAS_OUTBOUND,
   IDX_STATE_STREAM_HAS_READER,
   IDX_STATE_STREAM_WANTS_BLOCK,
-  IDX_STATE_STREAM_WANTS_HEADERS,
   IDX_STATE_STREAM_WANTS_RESET,
   IDX_STATE_STREAM_WANTS_STOP_SENDING,
-  IDX_STATE_STREAM_WANTS_TRAILERS,
   IDX_STATE_STREAM_RECEIVED_EARLY_DATA,
   IDX_STATE_STREAM_WRITE_DESIRED_SIZE,
   IDX_STATE_STREAM_BUDGET,
@@ -145,10 +143,8 @@ assert(IDX_STATE_STREAM_RESET !== undefined);
 assert(IDX_STATE_STREAM_HAS_OUTBOUND !== undefined);
 assert(IDX_STATE_STREAM_HAS_READER !== undefined);
 assert(IDX_STATE_STREAM_WANTS_BLOCK !== undefined);
-assert(IDX_STATE_STREAM_WANTS_HEADERS !== undefined);
 assert(IDX_STATE_STREAM_WANTS_RESET !== undefined);
 assert(IDX_STATE_STREAM_WANTS_STOP_SENDING !== undefined);
-assert(IDX_STATE_STREAM_WANTS_TRAILERS !== undefined);
 assert(IDX_STATE_STREAM_WRITE_DESIRED_SIZE !== undefined);
 assert(IDX_STATE_STREAM_RESET_CODE !== undefined);
 
@@ -824,20 +820,6 @@ class QuicStreamState {
     DataViewPrototypeSetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_BLOCK, val ? 1 : 0);
   }
 
-  /** @type {boolean} */
-  get wantsHeaders() {
-    const handle = this.#handle;
-    if (handle === undefined) return undefined;
-    return DataViewPrototypeGetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_HEADERS) !== 0;
-  }
-
-  /** @type {boolean} */
-  set wantsHeaders(val) {
-    const handle = this.#handle;
-    if (handle === undefined) return;
-    DataViewPrototypeSetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_HEADERS, val ? 1 : 0);
-  }
-
   /** @type {boolean} */
   get wantsReset() {
     const handle = this.#handle;
@@ -870,20 +852,6 @@ class QuicStreamState {
       val ? 1 : 0);
   }
 
-  /** @type {boolean} */
-  get wantsTrailers() {
-    const handle = this.#handle;
-    if (handle === undefined) return undefined;
-    return DataViewPrototypeGetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_TRAILERS) !== 0;
-  }
-
-  /** @type {boolean} */
-  set wantsTrailers(val) {
-    const handle = this.#handle;
-    if (handle === undefined) return;
-    DataViewPrototypeSetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_TRAILERS, val ? 1 : 0);
-  }
-
   /** @type {boolean} */
   get early() {
     const handle = this.#handle;
@@ -948,8 +916,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode,
       writeDesiredSize,
@@ -969,8 +935,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode: `${resetCode}`,
       writeDesiredSize,
@@ -1007,8 +971,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode,
       writeDesiredSize,
@@ -1028,8 +990,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode,
       writeDesiredSize,
diff --git a/src/quic/application.cc b/src/quic/application.cc
index f83b64bad49e..1e78b7931ce1 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -117,7 +117,7 @@ Maybe<Session::Application_Options> Session::Application_Options::From(
 
   // Ensure the advertised max_field_section_size in SETTINGS is at least
   // as large as max_header_length. Otherwise the peer would be told to
-  // restrict headers to a smaller size than what CanAddHeader accepts.
+  // restrict headers to a smaller size than what the HTTP/3 stream accepts.
   if (options.max_field_section_size < options.max_header_length) {
     options.max_field_section_size = options.max_header_length;
   }
diff --git a/src/quic/application.h b/src/quic/application.h
index df472e0a9fd7..0ae4ab53ab7e 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -11,6 +11,17 @@
 
 namespace node::quic {
 
+enum class HeadersKind : uint8_t {
+  HINTS,
+  INITIAL,
+  TRAILING,
+};
+
+enum class HeadersFlags : uint8_t {
+  NONE,
+  TERMINAL,
+};
+
 // An Application implements the ALPN-protocol specific semantics on behalf
 // of a QUIC Session.
 class Session::Application : public MemoryRetainer {
@@ -95,13 +106,10 @@ class Session::Application : public MemoryRetainer {
   // Application.
   virtual bool AcknowledgeStreamData(stream_id id, size_t datalen);
 
-  // Called to determine if a Header can be added to this application.
-  // Applications that do not support headers will always return false.
-  virtual bool CanAddHeader(size_t current_count,
-                            size_t current_headers_length,
-                            size_t this_header_length) {
-    return false;
-  }
+  // Called when a pending transport stream receives its stream ID. Protocols
+  // can use this to flush operations that require an opened stream. Returns
+  // false if deferred application data could not be submitted.
+  virtual bool StreamOpened(Stream& stream) { return true; }
 
   // Called when ngtcp2 reports NGTCP2_ERR_STREAM_SHUT_WR for a stream.
   // Applications that manage their own framing (e.g., HTTP/3) must inform
@@ -173,13 +181,19 @@ class Session::Application : public MemoryRetainer {
   // Submits an outbound block of headers for the given stream. Not all
   // Application types will support headers, in which case this function
   // should return false.
-  virtual bool SendHeaders(const Stream& stream,
+  virtual bool SendHeaders(Stream& stream,
                            HeadersKind kind,
                            const v8::Local<v8::Array>& headers,
                            HeadersFlags flags = HeadersFlags::NONE) {
     return false;
   }
 
+  // Updates JavaScript callback interest for an application's stream header
+  // events. Applications without header semantics ignore this.
+  virtual void SetHeadersInterest(Stream& stream,
+                                  bool wants_headers,
+                                  bool wants_trailers) {}
+
   // Returns true if the application protocol supports sending and
   // receiving headers on streams (e.g. HTTP/3). Applications that
   // do not support headers should return false (the default).
diff --git a/src/quic/bindingdata.cc b/src/quic/bindingdata.cc
index 31467a8477a7..d5711d88cb92 100644
--- a/src/quic/bindingdata.cc
+++ b/src/quic/bindingdata.cc
@@ -1,6 +1,7 @@
 #if HAVE_OPENSSL && HAVE_QUIC
 #include "guard.h"
 #ifndef OPENSSL_NO_QUIC
+#include <async_wrap-inl.h>
 #include <base_object-inl.h>
 #include <env-inl.h>
 #include <memory_tracker-inl.h>
@@ -13,13 +14,16 @@
 #include <node_realm-inl.h>
 #include <node_sockaddr-inl.h>
 #include <v8.h>
+#include "application.h"
 #include "bindingdata.h"
 #include "session.h"
 #include "session_manager.h"
+#include "streams.h"
 
 namespace node {
 
 using mem::kReserveSizeAndAlign;
+using v8::Array;
 using v8::DictionaryTemplate;
 using v8::Function;
 using v8::FunctionTemplate;
@@ -288,6 +292,26 @@ void nghttp3_debug_log(const char* fmt, va_list args) {
 void BindingData::InitPerContext(Realm* realm, Local<Object> target) {
   nghttp3_set_debug_vprintf_callback(nghttp3_debug_log);
   SetMethod(realm->context(), target, "setCallbacks", SetCallbacks);
+  SetMethod(realm->context(), target, "sendHeaders", SendHeaders);
+  SetMethod(realm->context(), target, "setHeadersInterest", SetHeadersInterest);
+
+  constexpr int QUIC_STREAM_HEADERS_KIND_HINTS =
+      static_cast<uint8_t>(HeadersKind::HINTS);
+  constexpr int QUIC_STREAM_HEADERS_KIND_INITIAL =
+      static_cast<uint8_t>(HeadersKind::INITIAL);
+  constexpr int QUIC_STREAM_HEADERS_KIND_TRAILING =
+      static_cast<uint8_t>(HeadersKind::TRAILING);
+  constexpr int QUIC_STREAM_HEADERS_FLAGS_NONE =
+      static_cast<uint8_t>(HeadersFlags::NONE);
+  constexpr int QUIC_STREAM_HEADERS_FLAGS_TERMINAL =
+      static_cast<uint8_t>(HeadersFlags::TERMINAL);
+
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_HINTS);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_INITIAL);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_TRAILING);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_NONE);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_TERMINAL);
+
   Realm::GetCurrent(realm->context())->AddBindingData<BindingData>(target);
 }
 
@@ -295,6 +319,32 @@ void BindingData::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(IllegalConstructor);
   registry->Register(SetCallbacks);
+  registry->Register(SendHeaders);
+  registry->Register(SetHeadersInterest);
+}
+
+JS_METHOD_IMPL(BindingData::SendHeaders) {
+  Stream* stream;
+  ASSIGN_OR_RETURN_UNWRAP(&stream, args[0]);
+  CHECK(args[1]->IsUint32());  // Kind
+  CHECK(args[2]->IsArray());   // Headers
+  CHECK(args[3]->IsUint32());  // Flags
+
+  HeadersKind kind = FromV8Value<HeadersKind>(args[1]);
+  Local<Array> headers = args[2].As<Array>();
+  HeadersFlags flags = FromV8Value<HeadersFlags>(args[3]);
+
+  args.GetReturnValue().Set(stream->session().application().SendHeaders(
+      *stream, kind, headers, flags));
+}
+
+JS_METHOD_IMPL(BindingData::SetHeadersInterest) {
+  Stream* stream;
+  ASSIGN_OR_RETURN_UNWRAP(&stream, args[0]);
+  CHECK(args[1]->IsBoolean());
+  CHECK(args[2]->IsBoolean());
+  stream->session().application().SetHeadersInterest(
+      *stream, args[1]->IsTrue(), args[2]->IsTrue());
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
diff --git a/src/quic/bindingdata.h b/src/quic/bindingdata.h
index e4763b5b0d3e..e56c861261ad 100644
--- a/src/quic/bindingdata.h
+++ b/src/quic/bindingdata.h
@@ -294,6 +294,8 @@ class BindingData final
   // Installs the set of JavaScript callback functions that are used to
   // bridge out to the JS API.
   JS_METHOD(SetCallbacks);
+  JS_METHOD(SendHeaders);
+  JS_METHOD(SetHeadersInterest);
 
   // Lazily-created per-Realm SessionManager. Centralizes CID -> Session
   // routing so that any endpoint can route packets to any session.
diff --git a/src/quic/defs.h b/src/quic/defs.h
index 5184288475b1..32b3a10d7b80 100644
--- a/src/quic/defs.h
+++ b/src/quic/defs.h
@@ -300,17 +300,6 @@ enum class Direction : uint8_t {
   UNIDIRECTIONAL,
 };
 
-enum class HeadersKind : uint8_t {
-  HINTS,
-  INITIAL,
-  TRAILING,
-};
-
-enum class HeadersFlags : uint8_t {
-  NONE,
-  TERMINAL,
-};
-
 enum class StreamPriority : uint8_t {
   DEFAULT = NGHTTP3_DEFAULT_URGENCY,
   LOW = NGHTTP3_URGENCY_LOW,
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index 6e1d0c44a048..43ead1b8164e 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -22,7 +22,11 @@
 namespace node {
 
 using v8::Array;
+using v8::Global;
+using v8::Integer;
 using v8::Local;
+using v8::LocalVector;
+using v8::Value;
 
 namespace quic {
 
@@ -138,6 +142,25 @@ struct Http3HeaderTraits {
 
 using Http3Header = NgHeader<Http3HeaderTraits>;
 
+struct Http3StreamState final : public StreamApplicationState {
+  struct PendingHeaders final {
+    HeadersKind kind;
+    Global<Array> headers;
+    HeadersFlags flags;
+
+    PendingHeaders(HeadersKind kind, Global<Array> headers, HeadersFlags flags)
+        : kind(kind), headers(std::move(headers)), flags(flags) {}
+    DISALLOW_COPY_AND_MOVE(PendingHeaders)
+  };
+
+  std::vector<std::unique_ptr<PendingHeaders>> pending_headers;
+  std::vector<std::unique_ptr<Http3Header>> headers;
+  HeadersKind headers_kind = HeadersKind::INITIAL;
+  size_t headers_length = 0;
+  bool wants_headers = false;
+  bool wants_trailers = false;
+};
+
 // Implements the low-level HTTP/3 Application semantics.
 class Http3ApplicationImpl final : public Session::Application {
  public:
@@ -334,17 +357,6 @@ class Http3ApplicationImpl final : public Session::Application {
     return nghttp3_conn_add_ack_offset(*this, id, datalen) == 0;
   }
 
-  bool CanAddHeader(size_t current_count,
-                    size_t current_headers_length,
-                    size_t this_header_length) override {
-    // We cannot add the header if we've either reached
-    // * the max number of header pairs or
-    // * the max number of header bytes (name + value combined)
-    return (current_count < options_.max_header_pairs) &&
-           (current_headers_length + this_header_length) <=
-               options_.max_header_length;
-  }
-
   bool stream_fin_managed_by_application() const override { return true; }
 
   void StreamWriteShut(stream_id id) override {
@@ -537,75 +549,49 @@ class Http3ApplicationImpl final : public Session::Application {
     Application::ReceiveStreamStopSending(stream, std::move(error));
   }
 
-  bool SendHeaders(const Stream& stream,
-                   HeadersKind kind,
-                   const Local<Array>& headers,
-                   HeadersFlags flags = HeadersFlags::NONE) override {
-    Session::SendPendingDataScope send_scope(&session());
-    Http3Headers nva(env(), headers);
+  bool StreamOpened(Stream& stream) override {
+    auto* state = GetStreamState(stream);
+    if (state == nullptr || state->pending_headers.empty()) return true;
 
-    switch (kind) {
-      case HeadersKind::HINTS: {
-        if (!session().is_server()) {
-          // Client side cannot send hints
-          return false;
-        }
-        Debug(&session(),
-              "Submitting %" PRIu64 " early hints for stream %" PRIu64,
-              stream.id());
-        return nghttp3_conn_submit_info(
-                   *this, stream.id(), nva.data(), nva.length()) == 0;
-        break;
+    decltype(state->pending_headers) pending;
+    state->pending_headers.swap(pending);
+    Session::SendPendingDataScope send_scope(&session());
+    for (auto& headers : pending) {
+      if (!SubmitHeaders(stream,
+                         headers->kind,
+                         headers->headers.Get(env()->isolate()),
+                         headers->flags)) {
+        return false;
       }
-      case HeadersKind::INITIAL: {
-        static constexpr nghttp3_data_reader reader = {on_read_data_callback};
-        const nghttp3_data_reader* reader_ptr = nullptr;
-
-        // If the terminal flag is set, that means that we know we're only
-        // sending headers and no body and the stream writable side should be
-        // closed immediately because there is no nghttp3_data_reader provided.
-        if (flags != HeadersFlags::TERMINAL) {
-          reader_ptr = &reader;
-        }
+    }
+    return true;
+  }
 
-        if (session().is_server()) {
-          // If this is a server, we're submitting a response...
-          Debug(&session(),
-                "Submitting %" PRIu64 " response headers for stream %" PRIu64,
-                nva.length(),
-                stream.id());
-          return nghttp3_conn_submit_response(*this,
-                                              stream.id(),
-                                              nva.data(),
-                                              nva.length(),
-                                              reader_ptr) == 0;
-        } else {
-          // Otherwise we're submitting a request...
-          Debug(&session(),
-                "Submitting %" PRIu64 " request headers for stream %" PRIu64,
-                nva.length(),
-                stream.id());
-          return nghttp3_conn_submit_request(*this,
-                                             stream.id(),
-                                             nva.data(),
-                                             nva.length(),
-                                             reader_ptr,
-                                             const_cast<Stream*>(&stream)) == 0;
-        }
-        break;
-      }
-      case HeadersKind::TRAILING: {
-        Debug(&session(),
-              "Submitting %" PRIu64 " trailing headers for stream %" PRIu64,
-              nva.length(),
-              stream.id());
-        return nghttp3_conn_submit_trailers(
-                   *this, stream.id(), nva.data(), nva.length()) == 0;
-        break;
-      }
+  bool SendHeaders(Stream& stream,
+                   HeadersKind kind,
+                   const Local<Array>& headers,
+                   HeadersFlags flags = HeadersFlags::NONE) override {
+    if (kind == HeadersKind::HINTS && !session().is_server()) return false;
+
+    if (stream.is_pending()) {
+      Debug(&session(), "Enqueuing headers for pending HTTP/3 stream");
+      auto& state = GetOrCreateStreamState(stream);
+      state.pending_headers.push_back(
+          std::make_unique<Http3StreamState::PendingHeaders>(
+              kind, Global<Array>(env()->isolate(), headers), flags));
+      return true;
     }
 
-    return false;
+    Session::SendPendingDataScope send_scope(&session());
+    return SubmitHeaders(stream, kind, headers, flags);
+  }
+
+  void SetHeadersInterest(Stream& stream,
+                          bool wants_headers,
+                          bool wants_trailers) override {
+    auto& state = GetOrCreateStreamState(stream);
+    state.wants_headers = wants_headers;
+    state.wants_trailers = wants_trailers;
   }
 
   void SetStreamPriority(const Stream& stream,
@@ -642,8 +628,7 @@ class Http3ApplicationImpl final : public Session::Application {
     // PRIORITY_UPDATE frames). Client-side priority is tracked by the
     // Stream itself and returned directly from GetPriority in streams.cc.
     if (!session().is_server()) {
-      auto& stored = stream.stored_priority();
-      return {stored.priority, stored.flags};
+      return {stream.priority(), stream.priority_flags()};
     }
     nghttp3_pri pri;
     if (nghttp3_conn_get_stream_priority(*this, &pri, stream.id()) == 0) {
@@ -730,7 +715,7 @@ class Http3ApplicationImpl final : public Session::Application {
     // for the next writev_stream in the send loop.
     if (pending_trailers_stream_ == data->id) {
       pending_trailers_stream_ = -1;
-      if (data->stream) data->stream->EmitWantTrailers();
+      if (data->stream) EmitWantTrailers(*data->stream);
     }
     return true;
   }
@@ -750,6 +735,137 @@ class Http3ApplicationImpl final : public Session::Application {
            id == qpack_enc_stream_id_;
   }
 
+  bool SubmitHeaders(Stream& stream,
+                     HeadersKind kind,
+                     const Local<Array>& headers,
+                     HeadersFlags flags) {
+    Http3Headers nva(env(), headers);
+
+    switch (kind) {
+      case HeadersKind::HINTS: {
+        if (!session().is_server()) return false;
+        Debug(&session(),
+              "Submitting %" PRIu64 " early hints for stream %" PRIu64,
+              stream.id());
+        return nghttp3_conn_submit_info(
+                   *this, stream.id(), nva.data(), nva.length()) == 0;
+      }
+      case HeadersKind::INITIAL: {
+        static constexpr nghttp3_data_reader reader = {on_read_data_callback};
+        const nghttp3_data_reader* reader_ptr = nullptr;
+        if (flags != HeadersFlags::TERMINAL) reader_ptr = &reader;
+
+        if (session().is_server()) {
+          Debug(&session(),
+                "Submitting %" PRIu64 " response headers for stream %" PRIu64,
+                nva.length(),
+                stream.id());
+          return nghttp3_conn_submit_response(*this,
+                                              stream.id(),
+                                              nva.data(),
+                                              nva.length(),
+                                              reader_ptr) == 0;
+        }
+
+        Debug(&session(),
+              "Submitting %" PRIu64 " request headers for stream %" PRIu64,
+              nva.length(),
+              stream.id());
+        return nghttp3_conn_submit_request(*this,
+                                           stream.id(),
+                                           nva.data(),
+                                           nva.length(),
+                                           reader_ptr,
+                                           &stream) == 0;
+      }
+      case HeadersKind::TRAILING: {
+        Debug(&session(),
+              "Submitting %" PRIu64 " trailing headers for stream %" PRIu64,
+              nva.length(),
+              stream.id());
+        return nghttp3_conn_submit_trailers(
+                   *this, stream.id(), nva.data(), nva.length()) == 0;
+      }
+    }
+
+    return false;
+  }
+
+  Http3StreamState* GetStreamState(Stream& stream) const {
+    return static_cast<Http3StreamState*>(stream.application_state());
+  }
+
+  Http3StreamState& GetOrCreateStreamState(Stream& stream) {
+    if (stream.application_state() == nullptr) {
+      stream.set_application_state(std::make_unique<Http3StreamState>());
+    }
+    return *GetStreamState(stream);
+  }
+
+  void BeginHeaders(Stream& stream, HeadersKind kind) {
+    auto& state = GetOrCreateStreamState(stream);
+    state.headers_length = 0;
+    state.headers.clear();
+    state.headers_kind = kind;
+  }
+
+  bool AddHeader(Stream& stream, std::unique_ptr<Http3Header> header) {
+    auto& state = GetOrCreateStreamState(stream);
+    size_t length = header->length();
+    if (state.headers.size() >= options_.max_header_pairs ||
+        state.headers_length + length > options_.max_header_length) {
+      return false;
+    }
+    state.headers_length += length;
+    state.headers.push_back(std::move(header));
+    return true;
+  }
+
+  void EmitHeaders(Stream& stream) {
+    auto& state = GetOrCreateStreamState(stream);
+    stream.RecordReceivedActivity();
+    if (!env()->can_call_into_js() || !state.wants_headers) {
+      state.headers.clear();
+      return;
+    }
+
+    CallbackScope<Stream> cb_scope(&stream);
+    auto& binding = BindingData::Get(env());
+    size_t count = state.headers.size() * 2;
+    LocalVector<Value> values(env()->isolate(), count);
+
+    for (size_t i = 0; i < state.headers.size(); i++) {
+      Local<Value> name;
+      Local<Value> value;
+      if (!state.headers[i]->GetName(&binding).ToLocal(&name) ||
+          !state.headers[i]->GetValue(&binding).ToLocal(&value)) [[unlikely]] {
+        state.headers.clear();
+        return;
+      }
+      values[i * 2] = name;
+      values[i * 2 + 1] = value;
+    }
+
+    state.headers.clear();
+    Local<Value> argv[] = {
+        Array::New(env()->isolate(), values.data(), count),
+        Integer::NewFromUnsigned(env()->isolate(),
+                                 static_cast<uint32_t>(state.headers_kind))};
+    stream.MakeCallback(
+        binding.stream_headers_callback(), arraysize(argv), argv);
+  }
+
+  void EmitWantTrailers(Stream& stream) {
+    auto* state = GetStreamState(stream);
+    if (!env()->can_call_into_js() || state == nullptr ||
+        !state->wants_trailers) {
+      return;
+    }
+    CallbackScope<Stream> cb_scope(&stream);
+    stream.MakeCallback(
+        BindingData::Get(env()).stream_trailers_callback(), 0, nullptr);
+  }
+
   void BuildOriginPayload() {
     // Build the serialized ORIGIN frame payload from the SNI configuration.
     // Each origin entry is: 2-byte BE length + origin string.
@@ -831,7 +947,7 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application beginning initial block of headers for stream "
           "%" PRIi64,
           id);
-    stream->BeginHeaders(HeadersKind::INITIAL);
+    BeginHeaders(*stream, HeadersKind::INITIAL);
   }
 
   void OnReceiveHeader(stream_id id, std::unique_ptr<Http3Header> header) {
@@ -843,7 +959,7 @@ class Http3ApplicationImpl final : public Session::Application {
       Debug(&session(),
             "HTTP/3 application switching to hints headers for stream %" PRIi64,
             stream->id());
-      stream->set_headers_kind(HeadersKind::HINTS);
+      GetOrCreateStreamState(*stream).headers_kind = HeadersKind::HINTS;
     }
     IF_QUIC_DEBUG(env()) {
       Debug(&session(),
@@ -851,7 +967,7 @@ class Http3ApplicationImpl final : public Session::Application {
             header->name(),
             header->value());
     }
-    stream->AddHeader(std::move(header));
+    AddHeader(*stream, std::move(header));
   }
 
   void OnEndHeaders(stream_id id, int fin) {
@@ -861,8 +977,8 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application received end of headers for stream %" PRIi64,
           id);
-    stream->EmitHeaders();
-    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    EmitHeaders(*stream);
+    // EmitHeaders calls into JavaScript, which can synchronously destroy the
     // stream. Its arena-backed state is released by Destroy(), so do not touch
     // the stream again if that happened.
     if (stream->is_destroyed()) return;
@@ -884,7 +1000,7 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application beginning block of trailers for stream %" PRIi64,
           id);
-    stream->BeginHeaders(HeadersKind::TRAILING);
+    BeginHeaders(*stream, HeadersKind::TRAILING);
   }
 
   void OnReceiveTrailer(stream_id id, std::unique_ptr<Http3Header> header) {
@@ -897,7 +1013,7 @@ class Http3ApplicationImpl final : public Session::Application {
             header->name(),
             header->value());
     }
-    stream->AddHeader(std::move(header));
+    AddHeader(*stream, std::move(header));
   }
 
   void OnEndTrailers(stream_id id, int fin) {
@@ -907,8 +1023,8 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application received end of trailers for stream %" PRIi64,
           id);
-    stream->EmitHeaders();
-    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    EmitHeaders(*stream);
+    // EmitHeaders calls into JavaScript, which can synchronously destroy the
     // stream. Its arena-backed state is released by Destroy(), so do not touch
     // the stream again if that happened.
     if (stream->is_destroyed()) return;
@@ -1112,7 +1228,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
     if (stream->is_eos()) {
       *pflags |= NGHTTP3_DATA_FLAG_EOF;
-      if (stream->wants_trailers()) {
+      if (app.GetOrCreateStreamState(*stream).wants_trailers) {
         *pflags |= NGHTTP3_DATA_FLAG_NO_END_STREAM;
         app.pending_trailers_stream_ = id;
       }
@@ -1131,7 +1247,7 @@ class Http3ApplicationImpl final : public Session::Application {
               return;
             case bob::Status::STATUS_EOS:
               *pflags |= NGHTTP3_DATA_FLAG_EOF;
-              if (stream->wants_trailers()) {
+              if (app.GetOrCreateStreamState(*stream).wants_trailers) {
                 *pflags |= NGHTTP3_DATA_FLAG_NO_END_STREAM;
                 app.pending_trailers_stream_ = id;
               }
diff --git a/src/quic/streams.cc b/src/quic/streams.cc
index 1f8761c75049..9a11bb4d591e 100644
--- a/src/quic/streams.cc
+++ b/src/quic/streams.cc
@@ -26,12 +26,10 @@ using v8::BackingStore;
 using v8::BackingStoreInitializationMode;
 using v8::BigInt;
 using v8::FunctionCallbackInfo;
-using v8::Global;
 using v8::HandleScope;
 using v8::Integer;
 using v8::Just;
 using v8::Local;
-using v8::LocalVector;
 using v8::Maybe;
 using v8::Nothing;
 using v8::Object;
@@ -57,14 +55,10 @@ namespace quic {
   V(HAS_READER, has_reader, uint8_t)                                           \
   /* Set when the stream has a block event handler */                          \
   V(WANTS_BLOCK, wants_block, uint8_t)                                         \
-  /* Set when the stream has a headers event handler */                        \
-  V(WANTS_HEADERS, wants_headers, uint8_t)                                     \
   /* Set when the stream has a reset event handler */                          \
   V(WANTS_RESET, wants_reset, uint8_t)                                         \
   /* Set when the stream has a stop sending event handler */                   \
   V(WANTS_STOP_SENDING, wants_stop_sending, uint8_t)                           \
-  /* Set when the stream has a trailers event handler */                       \
-  V(WANTS_TRAILERS, wants_trailers, uint8_t)                                   \
   /* True when 0-RTT early data was received */                                \
   V(RECEIVED_EARLY_DATA, received_early_data, uint8_t)                         \
   V(WRITE_DESIRED_SIZE, write_desired_size, uint32_t)                          \
@@ -98,7 +92,6 @@ namespace quic {
 #define STREAM_JS_METHODS(V)                                                   \
   V(AttachSource, attachSource, false)                                         \
   V(Destroy, destroy, false)                                                   \
-  V(SendHeaders, sendHeaders, false)                                           \
   V(StopSending, stopSending, false)                                           \
   V(ResetStream, resetStream, false)                                           \
   V(SetPriority, setPriority, false)                                           \
@@ -227,17 +220,6 @@ void PendingStream::reject(QuicError error) {
   stream_->Destroy(error);
 }
 
-struct Stream::PendingHeaders {
-  HeadersKind kind;
-  Global<Array> headers;
-  HeadersFlags flags;
-  PendingHeaders(HeadersKind kind_, Global<Array> headers_, HeadersFlags flags_)
-      : kind(kind_), headers(std::move(headers_)), flags(flags_) {}
-  DISALLOW_COPY_AND_MOVE(PendingHeaders)
-};
-
-// ============================================================================
-
 struct Stream::State {
 #define V(_, name, type) type name;
   STREAM_STATE(V)
@@ -445,37 +427,6 @@ struct Stream::Impl {
     }
   }
 
-  // Sends a block of headers to the peer. If the stream is not yet open,
-  // the headers will be queued and sent immediately when the stream is
-  // opened. Returns false if the application does not support headers.
-  JS_METHOD(SendHeaders) {
-    Stream* stream;
-    ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
-    CHECK(args[0]->IsUint32());  // Kind
-    CHECK(args[1]->IsArray());   // Headers
-    CHECK(args[2]->IsUint32());  // Flags
-
-    HeadersKind kind = FromV8Value<HeadersKind>(args[0]);
-    Local<Array> headers = args[1].As<Array>();
-    HeadersFlags flags = FromV8Value<HeadersFlags>(args[2]);
-
-    // If the stream is pending, the headers will be queued until the
-    // stream is opened, at which time the queued header block will be
-    // immediately sent when the stream is opened. If we already know
-    // that the application does not support headers, return false
-    // immediately so the JS side can throw an appropriate error.
-    if (stream->is_pending()) {
-      if (!stream->session().application().SupportsHeaders()) {
-        return args.GetReturnValue().Set(false);
-      }
-      stream->EnqueuePendingHeaders(kind, headers, flags);
-      return args.GetReturnValue().Set(true);
-    }
-
-    args.GetReturnValue().Set(stream->session().application().SendHeaders(
-        *stream, kind, headers, flags));
-  }
-
   // Tells the peer to stop sending data for this stream. This has the effect
   // of shutting down the readable side of the stream for this peer. Any data
   // that has already been received is still readable.
@@ -1057,25 +1008,6 @@ void Stream::InitPerContext(Realm* realm, Local<Object> target) {
 #undef V
 
   NODE_DEFINE_CONSTANT(target, IDX_STATS_STREAM_COUNT);
-
-  constexpr int QUIC_STREAM_HEADERS_KIND_HINTS =
-      static_cast<uint8_t>(HeadersKind::HINTS);
-  constexpr int QUIC_STREAM_HEADERS_KIND_INITIAL =
-      static_cast<uint8_t>(HeadersKind::INITIAL);
-  constexpr int QUIC_STREAM_HEADERS_KIND_TRAILING =
-      static_cast<uint8_t>(HeadersKind::TRAILING);
-
-  constexpr int QUIC_STREAM_HEADERS_FLAGS_NONE =
-      static_cast<uint8_t>(HeadersFlags::NONE);
-  constexpr int QUIC_STREAM_HEADERS_FLAGS_TERMINAL =
-      static_cast<uint8_t>(HeadersFlags::TERMINAL);
-
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_HINTS);
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_INITIAL);
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_TRAILING);
-
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_NONE);
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_TERMINAL);
 }
 
 Stream* Stream::From(void* stream_user_data) {
@@ -1243,25 +1175,6 @@ void Stream::NotifyStreamOpened(stream_id id) {
         *this, priority_.priority, priority_.flags);
     priority_.pending = false;
   }
-  if (!pending_headers_queue_.empty()) {
-    if (!session().application().SupportsHeaders()) {
-      // Headers were enqueued while the application was not yet known
-      // (headers_supported == 0), and the negotiated application does
-      // not support headers. This is a fatal mismatch.
-      Destroy(QuicError::ForApplication(
-          session().application().GetInternalErrorCode()));
-      return;
-    }
-    decltype(pending_headers_queue_) queue;
-    pending_headers_queue_.swap(queue);
-    for (auto& headers : queue) {
-      session().application().SendHeaders(
-          *this,
-          headers->kind,
-          headers->headers.Get(env()->isolate()),
-          headers->flags);
-    }
-  }
   // If the stream is not a local unidirectional stream and is_readable is
   // false, then we should shutdown the streams readable side now.
   if (!is_local_unidirectional() && !is_readable()) {
@@ -1277,6 +1190,15 @@ void Stream::NotifyStreamOpened(stream_id id) {
   // since the stream likely hasn't had any opporunity to get blocked
   // yet, but just for completeness, let's make sure.
   if (outbound_) session().ResumeStream(id);
+
+  // This may make application data sendable, so keep it as the final action:
+  // sending can eventually call into JavaScript and destroy the stream.
+  BaseObjectPtr<Stream> self(this);
+  auto& application = session().application();
+  error_code internal_error = application.GetInternalErrorCode();
+  if (!application.StreamOpened(*this) && !is_destroyed()) {
+    Destroy(QuicError::ForApplication(internal_error));
+  }
 }
 
 void Stream::NotifyReadableEnded(error_code code) {
@@ -1291,14 +1213,6 @@ void Stream::NotifyWritableEnded(error_code code) {
   ngtcp2_conn_shutdown_stream_write(session(), 0, id(), code);
 }
 
-void Stream::EnqueuePendingHeaders(HeadersKind kind,
-                                   Local<Array> headers,
-                                   HeadersFlags flags) {
-  Debug(this, "Enqueuing headers for pending stream");
-  pending_headers_queue_.push_back(std::make_unique<PendingHeaders>(
-      kind, Global<Array>(env()->isolate(), headers), flags));
-}
-
 bool Stream::is_pending() const {
   return state()->pending;
 }
@@ -1336,6 +1250,10 @@ uint64_t Stream::last_activity_timestamp() const {
   return ts != 0 ? ts : stats()->created_at;
 }
 
+void Stream::RecordReceivedActivity() {
+  STAT_RECORD_TIMESTAMP(Stats, received_at);
+}
+
 bool Stream::is_local_unidirectional() const {
   return direction() == Direction::UNIDIRECTIONAL &&
          ngtcp2_conn_is_local_stream(*session_, id());
@@ -1350,10 +1268,6 @@ bool Stream::is_eos() const {
   return state()->fin_sent;
 }
 
-bool Stream::wants_trailers() const {
-  return state()->wants_trailers;
-}
-
 void Stream::set_early() {
   state()->received_early_data = 1;
 }
@@ -1587,28 +1501,6 @@ int Stream::DoPull(bob::Next<ngtcp2_vec> next,
   return outbound_->Pull(std::move(next), options, data, count, max_count_hint);
 }
 
-void Stream::BeginHeaders(HeadersKind kind) {
-  headers_length_ = 0;
-  headers_.clear();
-  set_headers_kind(kind);
-}
-
-void Stream::set_headers_kind(HeadersKind kind) {
-  headers_kind_ = kind;
-}
-
-bool Stream::AddHeader(std::unique_ptr<Header> header) {
-  size_t len = header->length();
-  if (!session_->application().CanAddHeader(
-          headers_.size(), headers_length_, len)) {
-    return false;
-  }
-
-  headers_length_ += len;
-  headers_.push_back(std::move(header));
-  return true;
-}
-
 void Stream::Acknowledge(size_t datalen) {
   if (outbound_ == nullptr) return;
 
@@ -1680,6 +1572,7 @@ void Stream::Destroy(QuicError error) {
 
   // We are going to release our reference to the outbound_ queue here.
   outbound_.reset();
+  application_state_.reset();
 
   // EndReadable() above already flushed accumulated data. Just release
   // the ring buffer memory.
@@ -1959,42 +1852,6 @@ void Stream::EmitClose(const QuicError& error) {
   MakeCallback(BindingData::Get(env()).stream_close_callback(), 1, &err);
 }
 
-void Stream::EmitHeaders() {
-  STAT_RECORD_TIMESTAMP(Stats, received_at);
-  // state()->wants_headers will be set from the javascript side if the
-  // stream object has a handler for the headers event.
-  if (!env()->can_call_into_js() || !state()->wants_headers) {
-    headers_.clear();
-    return;
-  }
-  CallbackScope<Stream> cb_scope(this);
-
-  auto& binding = BindingData::Get(env());
-  size_t count = headers_.size() * 2;
-  LocalVector<Value> values(env()->isolate(), count);
-
-  for (size_t i = 0; i < headers_.size(); i++) {
-    Local<Value> name;
-    Local<Value> value;
-    if (!headers_[i]->GetName(&binding).ToLocal(&name) ||
-        !headers_[i]->GetValue(&binding).ToLocal(&value)) [[unlikely]] {
-      headers_.clear();
-      return;
-    }
-    values[i * 2] = name;
-    values[i * 2 + 1] = value;
-  }
-
-  headers_.clear();
-
-  Local<Value> argv[] = {
-      Array::New(env()->isolate(), values.data(), count),
-      Integer::NewFromUnsigned(env()->isolate(),
-                               static_cast<uint32_t>(headers_kind_))};
-
-  MakeCallback(binding.stream_headers_callback(), arraysize(argv), argv);
-}
-
 void Stream::EmitReset(const QuicError& error) {
   // state()->wants_reset will be set from the javascript side if the
   // stream object has a handler for the reset event.
@@ -2019,16 +1876,6 @@ void Stream::EmitStopSending(const QuicError& error) {
   MakeCallback(BindingData::Get(env()).stream_stop_sending_callback(), 1, &err);
 }
 
-void Stream::EmitWantTrailers() {
-  // state()->wants_trailers will be set from the javascript side if the
-  // stream object has a handler for the trailers event.
-  if (!env()->can_call_into_js() || !state()->wants_trailers) {
-    return;
-  }
-  CallbackScope<Stream> cb_scope(this);
-  MakeCallback(BindingData::Get(env()).stream_trailers_callback(), 0, nullptr);
-}
-
 // ============================================================================
 
 void Stream::Schedule(Queue* queue) {
diff --git a/src/quic/streams.h b/src/quic/streams.h
index cd4849aae277..1ea85f216524 100644
--- a/src/quic/streams.h
+++ b/src/quic/streams.h
@@ -10,7 +10,6 @@
 #include <memory_tracker.h>
 #include <node_blob.h>
 #include <node_bob.h>
-#include <node_http_common.h>
 #include <util.h>
 #include "bindingdata.h"
 #include "data.h"
@@ -22,6 +21,14 @@ namespace node::quic {
 class Session;
 class Stream;
 
+// Optional per-stream state owned by the negotiated application protocol.
+// Stream deliberately treats this as opaque so protocol semantics do not
+// become part of the transport stream abstraction.
+class StreamApplicationState {
+ public:
+  virtual ~StreamApplicationState() = default;
+};
+
 // An elastic ring buffer used by Stream to coalesce received data before
 // flushing it into the DataQueue. This avoids creating many small V8
 // BackingStore allocations from per-QUIC-frame ngtcp2 callbacks. Data is
@@ -179,11 +186,6 @@ class PendingStream final {
 // that the stream is gone. Any data that has already been received and is in
 // the inbound queue is preserved and may be read by the application.
 //
-// QUIC streams in general do not have headers. Some QUIC applications, however,
-// may associate headers with the stream (HTTP/3 for instance). As a
-// convenience, the Stream class will hold onto these headers for the
-// application.
-//
 // Streams may be created in a pending state. This means that while the Stream
 // object is created, it has not yet been opened in ngtcp2 and therefore has
 // no official status yet. Certain operations can still be performed on the
@@ -202,8 +204,6 @@ class Stream final : public AsyncWrap,
                      public Ngtcp2Source,
                      public DataQueue::BackpressureListener {
  public:
-  using Header = NgHeaderBase<BindingData>;
-
   // Acquire a DataQueue from the given value if it is valid. The return
   // follows the typical V8 rules for Maybe types. If an error occurs,
   // the Maybe will be empty and an exception will be set on the isolate.
@@ -263,6 +263,10 @@ class Stream final : public AsyncWrap,
   // otherwise falls back to created_at. Returns 0 if neither is set.
   uint64_t last_activity_timestamp() const;
 
+  // Records protocol-level receive activity that does not pass through
+  // ReceiveData(), such as application framing metadata.
+  void RecordReceivedActivity();
+
   // True if this stream was created in a pending state and is still waiting
   // to be created.
   bool is_pending() const;
@@ -276,9 +280,6 @@ class Stream final : public AsyncWrap,
   // data to be acknowledged by the remote peer.
   bool is_eos() const;
 
-  // True if the stream wants to send trailing headers after the body.
-  bool wants_trailers() const;
-
   // Marks this stream as having received 0-RTT early data.
   void set_early();
 
@@ -297,6 +298,17 @@ class Stream final : public AsyncWrap,
   // Returns the Blob::Reader for the inbound data, or nullptr.
   Blob::Reader* reader() const;
 
+  StreamApplicationState* application_state() const {
+    return application_state_.get();
+  }
+  void set_application_state(
+      std::unique_ptr<StreamApplicationState> application_state) {
+    application_state_ = std::move(application_state);
+  }
+
+  StreamPriority priority() const { return priority_.priority; }
+  StreamPriorityFlags priority_flags() const { return priority_.flags; }
+
   // Called by the session/application to indicate that the specified number
   // of bytes have been acknowledged by the peer.
   void Acknowledge(size_t datalen);
@@ -308,6 +320,10 @@ class Stream final : public AsyncWrap,
   // acknowledged to have been received by the peer.
   void Commit(size_t datalen, bool fin = false);
 
+  // Updates the write_desired_size state field based on current flow control
+  // and outbound buffer state. Emits drain if transitioning from 0 to > 0.
+  void UpdateWriteDesiredSize();
+
   void EndWritable();
   void EndReadable(std::optional<uint64_t> maybe_final_size = std::nullopt);
   void EntryRead(size_t amount) override;
@@ -355,18 +371,8 @@ class Stream final : public AsyncWrap,
   // that has already been received is still readable.
   void SendStopSending(error_code code);
 
-  // Currently, only HTTP/3 streams support headers. These methods are here
-  // to support that. They are not used when using any other QUIC application.
-
-  void BeginHeaders(HeadersKind kind);
-  void set_headers_kind(HeadersKind kind);
-  // Returns false if the header cannot be added. This will typically happen
-  // if the application does not support headers, a maximum number of headers
-  // have already been added, or the maximum total header length is reached.
-  bool AddHeader(std::unique_ptr<Header> header);
-
   // TODO(@jasnell): Implement MemoryInfo to track outbound_, inbound_,
-  // reader_, headers_, and pending_headers_queue_.
+  // reader_, and application_state_.
   SET_NO_MEMORY_INFO()
   SET_MEMORY_INFO_NAME(Stream)
   SET_SELF_SIZE(Stream)
@@ -387,7 +393,6 @@ class Stream final : public AsyncWrap,
 
  private:
   struct Impl;
-  struct PendingHeaders;
 
   class Outbound;
 
@@ -437,11 +442,6 @@ class Stream final : public AsyncWrap,
   // Notifies the JavaScript side that the peer asked it to stop sending.
   void EmitStopSending(const QuicError& error);
 
-  // Notifies the JavaScript side that the application is ready to receive
-  // trailing headers. Any trailing headers must be sent immediately, and
-  // synchronously when this callback is triggered.
-  void EmitWantTrailers();
-
   // Notifies the JavaScript side that sending data on the stream has been
   // blocked because of flow control restriction.
   void EmitBlocked();
@@ -450,23 +450,12 @@ class Stream final : public AsyncWrap,
   // for more data. Fires when write_desired_size transitions from 0 to > 0.
   void EmitDrain();
 
-  // Updates the write_desired_size state field based on current flow control
-  // and outbound buffer state. Emits drain if transitioning from 0 to > 0.
-  void UpdateWriteDesiredSize();
-
-  // Delivers the set of inbound headers that have been collected.
-  void EmitHeaders();
-
   void NotifyReadableEnded(error_code code);
   void NotifyWritableEnded(error_code code);
 
   // When a pending stream is finally opened, the NotifyStreamOpened method
   // will be called and the id will be assigned.
   void NotifyStreamOpened(stream_id id);
-  void EnqueuePendingHeaders(HeadersKind kind,
-                             v8::Local<v8::Array> headers,
-                             HeadersFlags flags);
-
   ArenaSlotBase stats_slot_;
   ArenaSlotBase state_slot_;
   BaseObjectWeakPtr<Session> session_;
@@ -474,6 +463,7 @@ class Stream final : public AsyncWrap,
   std::shared_ptr<DataQueue> inbound_;
   BaseObjectWeakPtr<Blob::Reader> reader_;
   std::unique_ptr<RecvAccumulator> recv_accumulator_;
+  std::unique_ptr<StreamApplicationState> application_state_;
 
   // Bytes delivered to ReceiveData() that still hold inbound flow control
   // credit. Returned incrementally as the consumer reads them, and in bulk
@@ -488,7 +478,6 @@ class Stream final : public AsyncWrap,
   // and the stream id will be assigned.
   std::optional<std::unique_ptr<PendingStream>> maybe_pending_stream_ =
       std::nullopt;
-  std::vector<std::unique_ptr<PendingHeaders>> pending_headers_queue_;
   error_code pending_close_read_code_ = 0;
   error_code pending_close_write_code_ = 0;
 
@@ -499,26 +488,8 @@ class Stream final : public AsyncWrap,
   };
   StoredPriority priority_;
 
-  const StoredPriority& stored_priority() const { return priority_; }
-
-  // The headers_ field holds a block of headers that have been received and
-  // are being buffered for delivery to the JavaScript side. Headers are
-  // stored as C++ objects during collection (AddHeader) and converted to
-  // V8 strings only when emitted (EmitHeaders), avoiding StrongRootAllocator
-  // mutex contention on the per-header hot path.
-  std::vector<std::unique_ptr<Header>> headers_;
-
-  // The headers_kind_ field indicates the kind of headers that are being
-  // buffered.
-  HeadersKind headers_kind_ = HeadersKind::INITIAL;
-
-  // The headers_length_ field holds the total length of the headers that have
-  // been buffered.
-  size_t headers_length_ = 0;
-
   friend struct Impl;
   friend class PendingStream;
-  friend class Http3ApplicationImpl;
   friend class DefaultApplication;
 
  public:
diff --git a/test/parallel/test-quic-h3-header-interest.mjs b/test/parallel/test-quic-h3-header-interest.mjs
new file mode 100644
index 000000000000..4fe05b6f6d3e
--- /dev/null
+++ b/test/parallel/test-quic-h3-header-interest.mjs
@@ -0,0 +1,76 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Verify HTTP/3 header interest is tracked independently of onheaders and
+// that pre-set trailing headers keep the response open until they are sent.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { createPrivateKey } = await import('node:crypto');
+const { listen, connect } = await import('node:quic');
+const { bytes } = await import('stream/iter');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall(async (serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  onheaders: mustCall(function() {
+    this.sendInformationalHeaders({
+      ':status': '103',
+      'link': '</style.css>; rel=preload',
+    });
+    this.sendHeaders({ ':status': '200' });
+    this.pendingTrailers = { 'x-checksum': 'abc123' };
+    const writer = this.writer;
+    writer.writeSync(encoder.encode('body'));
+    writer.endSync();
+  }),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+await clientSession.opened;
+
+const infoReceived = Promise.withResolvers();
+const trailersReceived = Promise.withResolvers();
+const stream = await clientSession.createBidirectionalStream({
+  headers: {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  },
+  oninfo: mustCall((headers) => {
+    assert.strictEqual(headers[':status'], 103);
+    infoReceived.resolve();
+  }),
+  ontrailers: mustCall((headers) => {
+    assert.strictEqual(headers['x-checksum'], 'abc123');
+    trailersReceived.resolve();
+  }),
+});
+
+assert.strictEqual(decoder.decode(await bytes(stream)), 'body');
+await Promise.all([infoReceived.promise, trailersReceived.promise]);
+assert.strictEqual(stream.headers[':status'], 200);
+
+await Promise.all([stream.closed, serverDone.promise]);
+await clientSession.close();
+await serverEndpoint.close();

From 407a9ec743962fa539840ab26798d82449b7f947 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Sun, 6 Sep 2026 11:34:15 +0200
Subject: [PATCH 180/202] vfs: apply open(2) effects to ZipProvider handles

A ZipProvider handle keeps its content in memory and adds the entry to
the archive when it is closed, and only if something was written. The
effects a real `open(2)` has at open time are therefore lost, and so is
the metadata the entry already carried:

* `open(path, 'w')` followed by `close()` neither truncates an existing
  entry nor creates a missing one; the same holds for "a" on a missing
  file. Tools that touch or truncate by open-then-close do nothing.
* Rewriting an entry (append, or an in-place write through "r+") re-adds
  it with the `mode` argument `open()` received (fs's default 0o666),
  not the mode the entry had, so a 0o755 script silently loses its
  executable bit.
* `fstat` on a handle reports that same `open()` mode and the current
  time instead of the entry's mode and modification time.
* Renaming a file onto an existing directory succeeds and leaves a name
  that is both a file and a directory; real file systems refuse with
  EISDIR.

This adds a test for each of these against a mounted ZipBuffer, stating
the real-fs outcome as the expectation.

Proposed solution: mark the handle dirty at open time when the flags
imply creation or truncation, so close always commits; carry the
existing entry's mode and modification time on the handle, use them
for `fstat` and for the re-added entry, and only fall back to the
`open()` mode for a newly created entry; and reject `rename` onto an
existing directory with EISDIR before touching the archive.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65853
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 test/parallel/test-vfs-zip-provider-commit.js | 102 ++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 test/parallel/test-vfs-zip-provider-commit.js

diff --git a/test/parallel/test-vfs-zip-provider-commit.js b/test/parallel/test-vfs-zip-provider-commit.js
new file mode 100644
index 000000000000..6a2874be4ee0
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider-commit.js
@@ -0,0 +1,102 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// A ZipProvider handle commits its content to the archive when it is closed.
+// The effects `open(2)` has at open time, and the metadata an entry already
+// carries, must survive that model: opening with "w" creates or truncates
+// even without a write, rewriting an entry keeps its mode, fstat reports the
+// entry's mode, and a file cannot be renamed onto a directory. Each case
+// states the real-fs outcome as the expectation. Cases are independent so
+// the runner reports each one.
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+const { test } = require('node:test');
+
+// Builds a writable in-memory archive from [name, content, options] triples
+// and mounts it, returning the mount point.
+function mountZip(entries) {
+  const list = entries.map(({ 0: name, 1: content, 2: options }) =>
+    zlib.ZipEntry.createSync(name, Buffer.from(content), options));
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync(list)) chunks.push(chunk);
+  const provider = new vfs.ZipProvider(new zlib.ZipBuffer(Buffer.concat(chunks)));
+  return vfs.create(provider).mount();
+}
+
+test('opening an existing file with "w" truncates it even without a write', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'f.txt');
+  fs.closeSync(fs.openSync(file, 'w'));
+  assert.strictEqual(fs.readFileSync(file, 'utf8'), '');
+});
+
+test('opening a new file with "w" creates it even without a write', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'new.txt');
+  fs.closeSync(fs.openSync(file, 'w'));
+  assert.strictEqual(fs.existsSync(file), true);
+});
+
+test('opening a new file with "a" creates it even without a write', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'log.txt');
+  fs.closeSync(fs.openSync(file, 'a'));
+  assert.strictEqual(fs.existsSync(file), true);
+});
+
+test('appending keeps the entry mode', () => {
+  const file = path.join(mountZip([['x.sh', 'a', { mode: 0o755 }]]), 'x.sh');
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o755);
+  fs.appendFileSync(file, 'b');
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o755);
+  assert.strictEqual(fs.readFileSync(file, 'utf8'), 'ab');
+});
+
+test('an in-place write keeps the entry mode', () => {
+  const file = path.join(mountZip([['x.sh', 'abc', { mode: 0o755 }]]), 'x.sh');
+  const fd = fs.openSync(file, 'r+');
+  fs.writeSync(fd, Buffer.from('Z'), 0, 1, 0);
+  fs.closeSync(fd);
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o755);
+});
+
+test('a new file gets the mode passed to open', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'new.sh');
+  const fd = fs.openSync(file, 'w', 0o700);
+  fs.writeSync(fd, Buffer.from('#!'));
+  fs.closeSync(fd);
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o700);
+});
+
+test('fstat reports the entry mode, not the open() mode argument', () => {
+  const file = path.join(mountZip([['x.sh', 'a', { mode: 0o755 }]]), 'x.sh');
+  const fd = fs.openSync(file, 'r');
+  try {
+    assert.strictEqual(fs.fstatSync(fd).mode & 0o777, 0o755);
+  } finally {
+    fs.closeSync(fd);
+  }
+});
+
+test('fstat reports the entry modification time', () => {
+  const modified = new Date('2020-01-02T03:04:05Z');
+  const file = path.join(mountZip([['f.txt', 'a', { modified }]]), 'f.txt');
+  const fd = fs.openSync(file, 'r');
+  try {
+    // ZIP timestamps have two-second resolution, so compare at that grain.
+    assert.strictEqual(Math.floor(fs.fstatSync(fd).mtimeMs / 2000),
+                       Math.floor(modified.getTime() / 2000));
+  } finally {
+    fs.closeSync(fd);
+  }
+});
+
+test('renaming a file onto an existing directory fails with EISDIR', () => {
+  const mount = mountZip([['dir/', ''], ['f', 'x']]);
+  assert.throws(() => fs.renameSync(path.join(mount, 'f'), path.join(mount, 'dir')),
+                { code: 'EISDIR' });
+  assert.strictEqual(fs.statSync(path.join(mount, 'dir')).isDirectory(), true);
+  assert.strictEqual(fs.readFileSync(path.join(mount, 'f'), 'utf8'), 'x');
+});

From 36d8fce817f6c0318b1900e8c71e66b0c15640d6 Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Sun, 6 Sep 2026 13:09:41 +0200
Subject: [PATCH 181/202] vfs: commit ZipProvider handles the way open(2) does

A ZipProvider handle adds its entry to the archive when it is closed.
Give that model the effects a real open(2) has up front, and keep the
metadata an entry already carries:

* A handle whose flags create or truncate the file starts out dirty,
  so closing it without a write still creates the missing entry or
  truncates the existing one.
* The handle remembers the entry's own mode and modification time.
  The re-added entry keeps that mode instead of taking the `mode`
  argument `open()` was given (fs's default 0o666), so a 0o755 script
  survives an append or an in-place write; only a newly created file
  takes the mode from `open()`.
* `fstat` reports that mode and, until the handle has changed the
  file, that modification time.
* `rename` refuses to move a file onto an existing directory with
  EISDIR before touching the archive.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65853
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/vfs/providers/ziparchive.js | 32 +++++++++++++++++++-----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/lib/internal/vfs/providers/ziparchive.js b/lib/internal/vfs/providers/ziparchive.js
index 402c92b8b659..e5ecfc7afd78 100644
--- a/lib/internal/vfs/providers/ziparchive.js
+++ b/lib/internal/vfs/providers/ziparchive.js
@@ -104,6 +104,8 @@ class ZipFileHandle extends VirtualFileHandle {
   #buffer;
   #size;
   #dirty = false;
+  #entryMode;
+  #modified;
 
   /**
    * @param {string} path
@@ -114,8 +116,15 @@ class ZipFileHandle extends VirtualFileHandle {
    * @param {Buffer} initial The entry's current decompressed content, or an
    *   empty buffer for a new/truncated file
    */
-  constructor(path, flags, mode, source, name, initial) {
+  constructor(path, flags, mode, source, name, initial, entry = null, dirty = false) {
     super(path, flags, mode);
+    // An existing entry keeps its own mode and modification time across a
+    // rewrite; only a newly created file takes the mode open() was given.
+    this.#entryMode = entry === null ? this.mode : (entry.mode || 0o644);
+    this.#modified = entry === null ? null : entry.modified;
+    // Creation and truncation take effect at open time on a real file, so
+    // such a handle is committed on close even when nothing is written.
+    this.#dirty = dirty;
     this.#source = source;
     this.#name = name;
     this.#buffer = initial;
@@ -206,8 +215,13 @@ class ZipFileHandle extends VirtualFileHandle {
     this.#doWriteFile(data, options);
   }
 
+  // Reports the entry's own mode and, until the handle has changed the file,
+  // its own modification time; once dirty the file is as new as its close.
   #doStat() {
-    return createFileStats(this.#size, { mode: this.mode });
+    return createFileStats(this.#size, {
+      mode: this.#entryMode,
+      mtimeMs: this.#dirty || this.#modified === null ? undefined : this.#modified.getTime(),
+    });
   }
   async stat(options) {
     return this.#doStat();
@@ -235,13 +249,13 @@ class ZipFileHandle extends VirtualFileHandle {
 
   async close() {
     if (this.#dirty && isWritableFlag(this.flags)) {
-      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.#entryMode });
     }
     await super.close();
   }
   closeSync() {
     if (this.#dirty && isWritableFlag(this.flags)) {
-      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.#entryMode });
     }
     super.closeSync();
   }
@@ -339,7 +353,8 @@ class ZipProvider extends VirtualProvider {
     if (exists && !isWriteTruncate(flags)) {
       initial = await fileEntry.content();
     }
-    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial,
+                             fileEntry, !exists || isWriteTruncate(flags));
   }
   openSync(path, flags, mode) {
     const name = normalize(path);
@@ -361,7 +376,8 @@ class ZipProvider extends VirtualProvider {
     if (exists && !isWriteTruncate(flags)) {
       initial = fileEntry.contentSync();
     }
-    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial,
+                             fileEntry, !exists || isWriteTruncate(flags));
   }
 
   async stat(path, options) {
@@ -519,6 +535,9 @@ class ZipProvider extends VirtualProvider {
     const newName = normalize(newPath);
     const entry = await this.#getEntry(oldName);
     if (entry === null) throw createENOENT('rename', oldPath);
+    // A file cannot take a directory's name; the archive would otherwise
+    // hold both under it.
+    if (this.#isDirectory(newName)) throw createEISDIR('rename', newPath);
     const content = await entry.content();
     await this.#source.add(newName, content, {
       mode: entry.mode || undefined,
@@ -533,6 +552,7 @@ class ZipProvider extends VirtualProvider {
     const newName = normalize(newPath);
     const entry = this.#getEntrySync(oldName);
     if (entry === null) throw createENOENT('rename', oldPath);
+    if (this.#isDirectory(newName)) throw createEISDIR('rename', newPath);
     const content = entry.contentSync();
     this.#source.addSync(newName, content, {
       mode: entry.mode || undefined,

From 3202f6376fc87cb5273c088e5ccdea05f7c656ac Mon Sep 17 00:00:00 2001
From: Philipp Dunkel <pip@pipobscure.com>
Date: Sun, 6 Sep 2026 16:32:10 +0200
Subject: [PATCH 182/202] vfs: give ZipProvider option bags a null prototype

The options passed to `createFileStats()` and to the archive's `add()`
and `addSync()` are plain literals, so a property added to
`Object.prototype` would reach those callees as if it had been passed
on purpose. Create them with a null prototype so only the fields set
here are visible.

Refs: https://github.com/nodejs/node/pull/65853
Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/65853
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/internal/vfs/providers/ziparchive.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/internal/vfs/providers/ziparchive.js b/lib/internal/vfs/providers/ziparchive.js
index e5ecfc7afd78..9f4ecceee460 100644
--- a/lib/internal/vfs/providers/ziparchive.js
+++ b/lib/internal/vfs/providers/ziparchive.js
@@ -219,6 +219,7 @@ class ZipFileHandle extends VirtualFileHandle {
   // its own modification time; once dirty the file is as new as its close.
   #doStat() {
     return createFileStats(this.#size, {
+      __proto__: null,
       mode: this.#entryMode,
       mtimeMs: this.#dirty || this.#modified === null ? undefined : this.#modified.getTime(),
     });
@@ -249,13 +250,15 @@ class ZipFileHandle extends VirtualFileHandle {
 
   async close() {
     if (this.#dirty && isWritableFlag(this.flags)) {
-      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.#entryMode });
+      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size),
+                             { __proto__: null, mode: this.#entryMode });
     }
     await super.close();
   }
   closeSync() {
     if (this.#dirty && isWritableFlag(this.flags)) {
-      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.#entryMode });
+      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size),
+                           { __proto__: null, mode: this.#entryMode });
     }
     super.closeSync();
   }

From 23a05a6e981bf4947ad2eeb23fadb972622e5f07 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Mon, 7 Sep 2026 10:45:23 +0200
Subject: [PATCH 183/202] test: fix flaky test-bench-stream

testDeliveryDoesNotConsumeTimeout gave the benchmark a 20ms timeout
while stalling the consumer for 50ms. Only delivery time is credited
back to the deadline, so the 32 samples still had to run within 20ms,
which is about a 10x margin on an idle machine and not enough on a
loaded CI runner.

Scale the timeout and the stall together so the benchmark's own work
gets 500ms of headroom while the consumer still stalls for longer than
the timeout.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65874
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 test/parallel/test-bench-stream.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
index 9a9eff7b2369..115364c7db5e 100644
--- a/test/parallel/test-bench-stream.js
+++ b/test/parallel/test-bench-stream.js
@@ -4,7 +4,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { createRunner } = require('node:bench');
-const { setImmediate, setTimeout } = require('timers/promises');
+const { setImmediate } = require('timers/promises');
 
 function recordSample(b) {
   b.record({
@@ -151,15 +151,21 @@ async function testCancellationCompletesBenchmarks() {
 
 async function testDeliveryDoesNotConsumeTimeout() {
   const runner = createRunner({ yieldBetweenSamples: false });
+  // The timeout only has to cover the benchmark's own work, which is 32 samples
+  // that do nothing but record a fixed value. Keep it generous so that a loaded
+  // machine cannot exhaust it on its own, and keep the consumer stalled for
+  // longer than the timeout so that the benchmark can only complete when the
+  // time spent delivering records is excluded from the timeout.
+  const timeout = common.platformTimeout(500);
   const completion = runner.bench('slow consumer', {
     samples: 32,
-    timeout: common.platformTimeout(20),
+    timeout,
   }, recordSample);
   const stream = runner.run();
   const iterator = stream[Symbol.asyncIterator]();
 
   await iterator.next();
-  await setTimeout(common.platformTimeout(50));
+  await setImmediate();
   for (;;) {
     const next = await iterator.next();
     if (next.done) break;

From 60e363046f6d04b2225c7655ceb6dbd588796199 Mon Sep 17 00:00:00 2001
From: James M Snell <jsnell@cloudflare.com>
Date: Tue, 8 Sep 2026 13:56:03 -0700
Subject: [PATCH 184/202] stream: improve handling of falsy errors in
 stream/iter

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65864
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
---
 doc/api/stream_iter.md                        |  35 ++-
 lib/internal/abort_controller.js              |   1 +
 lib/internal/fs/promises.js                   | 237 +++++++++------
 lib/internal/quic/quic.js                     |  14 +-
 lib/internal/streams/iter/broadcast.js        |  41 +--
 lib/internal/streams/iter/classic.js          | 206 +++++++++----
 lib/internal/streams/iter/pull.js             |  13 +-
 lib/internal/streams/iter/push.js             |  53 ++--
 lib/internal/streams/iter/share.js            |  66 +++--
 lib/internal/streams/iter/transform.js        |   4 +-
 lib/internal/streams/iter/utils.js            |  13 -
 .../test-fs-promises-file-handle-pull.js      |   4 +-
 .../test-fs-promises-file-handle-writer.js    |  55 +++-
 test/parallel/test-quic-stream-writer-api.mjs |  12 +-
 ...test-stream-iter-broadcast-backpressure.js |  17 +-
 .../test-stream-iter-reason-propagation.js    | 271 ++++++++++++++++++
 .../test-stream-iter-share-coverage.js        | 105 ++++++-
 test/parallel/test-stream-iter-to-readable.js | 159 ++++++++--
 .../test-stream-iter-writable-from.js         | 241 +++++++++++-----
 .../test-stream-iter-writable-interop.js      |  65 ++++-
 20 files changed, 1230 insertions(+), 382 deletions(-)
 create mode 100644 test/parallel/test-stream-iter-reason-propagation.js

diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index b5ed8e06f6e1..f2fbba2286e0 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -463,14 +463,15 @@ if (result < 0) {
 }
 ```
 
-#### `writer.fail(reason)`
+#### `writer.fail([reason])`
 
 * `reason` {any}
 
 Put the writer into a terminal error state. If the writer is already closed
 or errored, this is a no-op. Unlike `write()` and `end()`, `fail()` is
 unconditionally synchronous because failing a writer is a pure state
-transition with no async work to perform.
+transition with no async work to perform. The reason is stored and propagated
+without modification. If omitted, the reason is `undefined`.
 
 #### `writer[Symbol.asyncDispose]()`
 
@@ -1337,9 +1338,10 @@ run().catch(console.error);
 
 #### `broadcast.cancel([reason])`
 
-* `reason` {Error}
+* `reason` {any}
 
-Cancel the broadcast. All consumers receive an error.
+Cancel the broadcast. If `reason` is provided, all consumers reject with that
+exact reason. If it is omitted, consumers complete normally.
 
 #### `broadcast.consumerCount`
 
@@ -1447,9 +1449,10 @@ Create a {Share} from an existing source.
 
 #### `share.cancel([reason])`
 
-* `reason` {Error}
+* `reason` {any}
 
-Cancel the share. All consumers receive an error.
+Cancel the share. If `reason` is provided, all consumers reject with that exact
+reason. If it is omitted, consumers complete normally.
 
 #### `share.consumerCount`
 
@@ -1521,9 +1524,10 @@ The number of chunks currently buffered.
 
 #### `share.cancel([reason])`
 
-* `reason` {Error}
+* `reason` {any}
 
-Cancel the share. All consumers receive an error.
+Cancel the share. If `reason` is provided, all consumers throw that exact
+reason. If it is omitted, consumers complete normally.
 
 #### `share.consumerCount`
 
@@ -1647,6 +1651,11 @@ the synchronous Writer methods (`writeSync`, `writevSync`, `endSync`) always
 return `false` or `-1`, deferring to the async path. The per-write
 `options.signal` parameter from the Writer interface is also ignored.
 
+If `writer.fail(reason)` receives a non-Error reason, the classic Writable is
+destroyed with an `ERR_FALSY_VALUE_REJECTION` or `ERR_OPERATION_FAILED` error.
+Its `reason` property contains the original value, which remains the Writer's
+stored failure reason.
+
 The result is cached per instance and backpressure policy -- calling
 `fromWritable()` twice with the same stream and `backpressure` option returns
 the same Writer.
@@ -1705,6 +1714,11 @@ Creates a byte-mode [`stream.Readable`][] from the `source`
 (the native batch format used by the stream/iter API). Each `Uint8Array` in a
 yielded batch is pushed as a separate chunk into the Readable.
 
+Classic streams cannot represent arbitrary values as emitted errors. A
+non-Error reason is wrapped in an `ERR_FALSY_VALUE_REJECTION` or
+`ERR_OPERATION_FAILED` error whose `reason` property contains the original
+value.
+
 ```mjs
 import { createWriteStream } from 'node:fs';
 import { from, pull, toReadable } from 'node:stream/iter';
@@ -1789,6 +1803,11 @@ sync path returns `false`. Similarly, `_final()` tries `endSync()`
 before `end()`. When the sync path succeeds, the callback is deferred via
 `queueMicrotask` to preserve the async resolution contract.
 
+Classic stream callbacks cannot represent arbitrary values as errors. A
+non-Error reason is wrapped in an `ERR_FALSY_VALUE_REJECTION` or
+`ERR_OPERATION_FAILED` error before it is passed to the callback. The error's
+`reason` property contains the original value.
+
 The Writable's `highWaterMark` is set to `Number.MAX_SAFE_INTEGER` to
 effectively disable its internal buffering, allowing the underlying Writer
 to manage backpressure directly.
diff --git a/lib/internal/abort_controller.js b/lib/internal/abort_controller.js
index 48dcdaafba2f..ef30d9619749 100644
--- a/lib/internal/abort_controller.js
+++ b/lib/internal/abort_controller.js
@@ -642,6 +642,7 @@ module.exports = {
   AbortController,
   AbortSignal,
   ClonedAbortSignal,
+  abortSignal,
   aborted,
   transferableAbortSignal,
   transferableAbortController,
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index 0a2172d796c4..bb54d2fc596e 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -15,6 +15,7 @@ const {
   SafeArrayIterator,
   SafePromisePrototypeFinally,
   SafePromiseRace,
+  SafeSet,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
@@ -537,9 +538,7 @@ if (getOptionValue('--experimental-stream-iter')) {
             // Signal-aware path
             while (remaining !== 0) {
               if (signal.aborted) {
-                throw signal.reason ??
-                      lazyDOMException('The operation was aborted',
-                                       'AbortError');
+                throw signal.reason;
               }
               const toRead = remaining > 0 ?
                 MathMin(readSize, remaining) : readSize;
@@ -745,9 +744,13 @@ if (getOptionValue('--experimental-stream-iter')) {
     let totalBytesWritten = 0;
     let closed = false;
     let closing = false;
-    let pendingEndPromise = null;
-    let error = null;
-    let asyncPending = false;
+    let pendingEnd = null;
+    let endingCleanup = false;
+    let errored = false;
+    let error;
+    let asyncPending = 0;
+    let released = false;
+    const pendingWrites = new SafeSet();
 
     validateBoolean(autoClose, 'options.autoClose');
 
@@ -766,85 +769,124 @@ if (getOptionValue('--experimental-stream-iter')) {
 
     // Write a single buffer with EAGAIN retry (up to 5 retries).
     async function writeAll(buf, offset, length, position, signal) {
-      asyncPending = true;
-      try {
-        let retries = 0;
-        while (length > 0) {
-          const bytesWritten = (await PromisePrototypeThen(
-            binding.writeBuffer(fd, buf, offset, length, position,
-                                kUsePromises),
-            undefined,
-            handleErrorFromBinding,
-          )) || 0;
-
-          signal?.throwIfAborted();
-
-          if (bytesWritten === 0) {
-            if (++retries > 5) {
-              throw new ERR_OPERATION_FAILED('write failed after retries');
-            }
-          } else {
-            retries = 0;
-          }
+      let retries = 0;
+      while (length > 0) {
+        const bytesWritten = (await PromisePrototypeThen(
+          binding.writeBuffer(fd, buf, offset, length, position,
+                              kUsePromises),
+          undefined,
+          handleErrorFromBinding,
+        )) || 0;
+
+        signal?.throwIfAborted();
 
-          totalBytesWritten += bytesWritten;
-          offset += bytesWritten;
-          length -= bytesWritten;
-          if (position >= 0) position += bytesWritten;
+        if (bytesWritten === 0) {
+          if (++retries > 5) {
+            throw new ERR_OPERATION_FAILED('write failed after retries');
+          }
+        } else {
+          retries = 0;
         }
-      } finally {
-        asyncPending = false;
+
+        totalBytesWritten += bytesWritten;
+        offset += bytesWritten;
+        length -= bytesWritten;
+        if (position >= 0) position += bytesWritten;
       }
     }
 
     // Writev with EAGAIN retry. On partial write, concatenates remaining
     // buffers and falls back to writeAll (same approach as WriteStream).
     async function writevAll(buffers, position, signal) {
-      asyncPending = true;
-      try {
-        let totalSize = 0;
-        for (let i = 0; i < buffers.length; i++) {
-          totalSize += buffers[i].byteLength;
-        }
+      let totalSize = 0;
+      for (let i = 0; i < buffers.length; i++) {
+        totalSize += buffers[i].byteLength;
+      }
 
-        let retries = 0;
-        while (totalSize > 0) {
-          const bytesWritten = (await PromisePrototypeThen(
-            binding.writeBuffers(fd, buffers, position, kUsePromises),
-            undefined,
-            handleErrorFromBinding,
-          )) || 0;
+      let retries = 0;
+      while (totalSize > 0) {
+        const bytesWritten = (await PromisePrototypeThen(
+          binding.writeBuffers(fd, buffers, position, kUsePromises),
+          undefined,
+          handleErrorFromBinding,
+        )) || 0;
 
-          signal?.throwIfAborted();
+        signal?.throwIfAborted();
 
-          if (bytesWritten === 0) {
-            if (++retries > 5) {
-              throw new ERR_OPERATION_FAILED('writev failed after retries');
-            }
-          } else {
-            retries = 0;
+        if (bytesWritten === 0) {
+          if (++retries > 5) {
+            throw new ERR_OPERATION_FAILED('writev failed after retries');
           }
+        } else {
+          retries = 0;
+        }
 
-          totalBytesWritten += bytesWritten;
-          totalSize -= bytesWritten;
-          if (position >= 0) position += bytesWritten;
-
-          if (totalSize > 0) {
-            // Partial write - concatenate remaining and use writeAll.
-            const remaining = Buffer.concat(buffers);
-            const wrote = bytesWritten;
-            // writeAll is already inside asyncPending = true, but
-            // writeAll sets it again - that's fine (idempotent).
-            await writeAll(remaining, wrote, remaining.length - wrote,
-                           position, signal);
-            return;
-          }
+        totalBytesWritten += bytesWritten;
+        totalSize -= bytesWritten;
+        if (position >= 0) position += bytesWritten;
+
+        if (totalSize > 0) {
+          // Partial write - concatenate remaining and use writeAll.
+          const remaining = Buffer.concat(buffers);
+          const wrote = bytesWritten;
+          await writeAll(remaining, wrote, remaining.length - wrote,
+                         position, signal);
+          return;
         }
-      } finally {
-        asyncPending = false;
       }
     }
 
+    function releaseAfterFailure() {
+      if (!errored || asyncPending !== 0 || released) return;
+      released = true;
+      handle[kLocked] = false;
+      handle[kUnref]();
+      if (autoClose) {
+        handle[kCloseSync]();
+      }
+    }
+
+    function finishEnd() {
+      if (!closing || errored || asyncPending !== 0 || endingCleanup) return;
+      endingCleanup = true;
+      PromisePrototypeThen(cleanup(), () => {
+        endingCleanup = false;
+        if (errored) return;
+        closing = false;
+        closed = true;
+        pendingEnd.resolve(totalBytesWritten);
+        pendingEnd = null;
+      }, (error) => {
+        endingCleanup = false;
+        if (errored) return;
+        closing = false;
+        closed = true;
+        pendingEnd.reject(error);
+        pendingEnd = null;
+      });
+    }
+
+    function trackOperation(operation) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      const pending = { __proto__: null, reject };
+      pendingWrites.add(pending);
+      asyncPending++;
+      PromisePrototypeThen(operation, (value) => {
+        const active = pendingWrites.delete(pending);
+        asyncPending--;
+        releaseAfterFailure();
+        if (active) resolve(value);
+        finishEnd();
+      }, (error) => {
+        const active = pendingWrites.delete(pending);
+        asyncPending--;
+        releaseAfterFailure();
+        if (active) reject(error);
+        finishEnd();
+      });
+      return promise;
+    }
+
     // Synchronous write with EAGAIN retry. Throws on I/O error.
     // Used by writeSync for the full write, and by writevSync for
     // completing a partial writev.
@@ -872,8 +914,8 @@ if (getOptionValue('--experimental-stream-iter')) {
     }
 
     async function cleanup() {
-      if (closed) return;
-      closed = true;
+      if (released) return;
+      released = true;
       handle[kLocked] = false;
       handle[kUnref]();
       if (autoClose) {
@@ -886,13 +928,17 @@ if (getOptionValue('--experimental-stream-iter')) {
       write(chunk, options = kNullPrototo) {
         chunk = newStreamsToWriterUint8Array(chunk);
         const signal = newStreamsGetWriterSignal(options);
-        if (error) {
+        if (errored) {
           return PromiseReject(error);
         }
         if (closed) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
+        if (closing) {
+          return PromiseReject(
+            new ERR_INVALID_STATE.TypeError('The writer is closing'));
+        }
         if (signal?.aborted) {
           return PromiseReject(signal.reason);
         }
@@ -904,19 +950,24 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (bytesRemaining > 0) bytesRemaining -= chunk.byteLength;
         const position = pos;
         if (pos >= 0) pos += chunk.byteLength;
-        return writeAll(chunk, 0, chunk.byteLength, position, signal);
+        return trackOperation(
+          writeAll(chunk, 0, chunk.byteLength, position, signal));
       },
 
       writev(chunks, options = kNullPrototo) {
         chunks = newStreamsConvertChunks(chunks);
         const signal = newStreamsGetWriterSignal(options);
-        if (error) {
+        if (errored) {
           return PromiseReject(error);
         }
         if (closed) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
+        if (closing) {
+          return PromiseReject(
+            new ERR_INVALID_STATE.TypeError('The writer is closing'));
+        }
         if (signal?.aborted) {
           return PromiseReject(signal.reason);
         }
@@ -932,12 +983,12 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (bytesRemaining > 0) bytesRemaining -= totalSize;
         const position = pos;
         if (pos >= 0) pos += totalSize;
-        return writevAll(chunks, position, signal);
+        return trackOperation(writevAll(chunks, position, signal));
       },
 
       writeSync(chunk) {
         chunk = newStreamsToWriterUint8Array(chunk);
-        if (error || closed || asyncPending) return false;
+        if (errored || closed || closing || asyncPending) return false;
         const length = chunk.byteLength;
         if (length > syncWriteThreshold) return false;
         if (length === 0) return true;
@@ -968,7 +1019,7 @@ if (getOptionValue('--experimental-stream-iter')) {
 
       writevSync(chunks) {
         chunks = newStreamsConvertChunks(chunks);
-        if (error || closed || asyncPending) return false;
+        if (errored || closed || closing || asyncPending) return false;
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -1004,29 +1055,31 @@ if (getOptionValue('--experimental-stream-iter')) {
 
       end(options = kNullPrototo) {
         const signal = newStreamsGetWriterSignal(options);
-        if (error) {
+        if (errored) {
           return PromiseReject(error);
         }
         if (closed) {
           return PromiseResolve(totalBytesWritten);
         }
         if (closing) {
-          return pendingEndPromise;
+          return pendingEnd.promise;
         }
         if (signal?.aborted) {
           return PromiseReject(signal.reason);
         }
         closing = true;
-        pendingEndPromise = PromisePrototypeThen(
-          cleanup(), () => totalBytesWritten);
-        return pendingEndPromise;
+        pendingEnd = PromiseWithResolvers();
+        finishEnd();
+        return pendingEnd.promise;
       },
 
       endSync() {
-        if (error) return -1;
+        if (errored) return -1;
         if (closed) return totalBytesWritten;
+        if (closing) return -1;
         if (asyncPending) return -1;
         closed = true;
+        released = true;
         handle[kLocked] = false;
         handle[kUnref]();
         if (autoClose) {
@@ -1036,21 +1089,25 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       fail(reason) {
-        if (closed || error) return;
-        error = reason ?? new ERR_INVALID_STATE('Failed');
+        if (closed || errored) return;
+        errored = true;
+        error = reason;
+        closing = false;
         closed = true;
-        handle[kLocked] = false;
-        handle[kUnref]();
-        if (autoClose) {
-          handle[kCloseSync]();
+        pendingEnd?.reject(reason);
+        pendingEnd = null;
+        for (const pending of pendingWrites) {
+          pending.reject(reason);
         }
+        pendingWrites.clear();
+        releaseAfterFailure();
       },
 
       [SymbolAsyncDispose]() {
         if (closing) {
-          return pendingEndPromise ?? PromiseResolve();
+          return pendingEnd?.promise ?? PromiseResolve();
         }
-        if (!closed && !error) {
+        if (!closed && !errored) {
           this.fail();
         }
         return PromiseResolve();
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index b6bb31aa97b4..95288775d42a 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -2250,11 +2250,11 @@ class QuicStream {
     }
 
     async function writeAsync(chunk, signal) {
-      signal?.throwIfAborted();
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
       }
+      signal?.throwIfAborted();
       // If a drain is already pending, another operation is waiting
       // for capacity. Under strict policy, reject immediately.
       // Later, if we add support for other backpressure policies,
@@ -2293,12 +2293,11 @@ class QuicStream {
     }
 
     async function writevAsync(chunks, signal) {
-      signal?.throwIfAborted();
-
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
       }
+      signal?.throwIfAborted();
 
       // If a drain is already pending, another operation is waiting
       // for capacity. Under strict policy, reject immediately.
@@ -2339,6 +2338,8 @@ class QuicStream {
     }
 
     async function endAsync(signal) {
+      if (errored) throw error;
+      if (closed) return totalBytesWritten;
       if (signal !== undefined) {
         signal.throwIfAborted();
         // TODO(@jasnell): The stream/iter spec allows individual sync end
@@ -2370,13 +2371,16 @@ class QuicStream {
       } finally {
         drainWakeup = null;
       }
-      return endSync();
+      if (errored) throw error;
+      const result = endSync();
+      if (errored) throw error;
+      return result;
     }
 
     function fail(reason) {
       if (closed || errored) return;
       errored = true;
-      error = reason ?? new ERR_INVALID_STATE('Failed');
+      error = reason;
       // `writer.fail()` is always an error path, so the wire code on
       // RESET_STREAM must never be `0n` (which means "no error" in
       // most application protocols). Resolve the code in priority
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 16cb4c06533c..ddce0d12d42c 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -61,7 +61,6 @@ const {
   hasProtocol,
   onSignalAbort,
   parsePullArgs,
-  wrapError,
   toWriterUint8Array,
   validateBatchEntry,
 } = require('internal/streams/iter/utils');
@@ -81,6 +80,7 @@ const kCanWrite = Symbol('kCanWrite');
 const kOnBufferDrained = Symbol('kOnBufferDrained');
 const kOnEndDrained = Symbol('kOnEndDrained');
 const kPendingWriteRemoved = Symbol('kPendingWriteRemoved');
+const kNoBroadcastError = Symbol('kNoBroadcastError');
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -107,6 +107,7 @@ class BroadcastImpl {
   #waiters = [];  // Consumers with pending resolve (subset of #consumers)
   #ended = false;
   #error;
+  #errored = false;
   #cancelled = false;
   #options;
   #writer = null;
@@ -176,6 +177,7 @@ class BroadcastImpl {
       reject: null,
       pending: [],
       detached: false,
+      error: kNoBroadcastError,
     };
 
     this.#consumers.add(state);
@@ -211,8 +213,8 @@ class BroadcastImpl {
           __proto__: null,
           next() {
             if (state.detached) {
-              if (self.#error !== undefined) {
-                return PromiseReject(self.#error);
+              if (state.error !== kNoBroadcastError) {
+                return PromiseReject(state.error);
               }
               return kDone;
             }
@@ -231,8 +233,9 @@ class BroadcastImpl {
                 { __proto__: null, done: false, value: chunk });
             }
 
-            if (self.#error !== undefined) {
+            if (self.#errored) {
               state.detached = true;
+              state.error = self.#error;
               self.#deleteConsumer(state);
               return PromiseReject(self.#error);
             }
@@ -272,11 +275,13 @@ class BroadcastImpl {
 
   cancel(reason) {
     if (this.#cancelled) return;
+    const hasReason = arguments.length > 0;
     this.#cancelled = true;
     this.#ended = true; // Prevents [kAbort]() from redundantly iterating consumers
 
-    if (reason !== undefined) {
+    if (hasReason) {
       this.#error = reason;
+      this.#errored = true;
     }
 
     // Reject pending writes on the writer so the pump doesn't hang
@@ -284,7 +289,7 @@ class BroadcastImpl {
 
     for (const consumer of this.#consumers) {
       if (consumer.resolve) {
-        if (reason !== undefined) {
+        if (hasReason) {
           consumer.reject?.(reason);
         } else {
           consumer.resolve({ __proto__: null, done: true, value: undefined });
@@ -292,7 +297,8 @@ class BroadcastImpl {
         consumer.resolve = null;
         consumer.reject = null;
       }
-      if (reason !== undefined) {
+      if (hasReason) {
+        consumer.error = reason;
         this.#rejectPending(consumer, reason);
       } else {
         this.#resolvePendingDone(consumer);
@@ -389,7 +395,8 @@ class BroadcastImpl {
   }
 
   [kAbort](reason) {
-    if (this.#error !== undefined) return;
+    if (this.#errored) return;
+    this.#errored = true;
     this.#error = reason;
     this.#ended = true;
 
@@ -401,6 +408,7 @@ class BroadcastImpl {
         consumer.reject = null;
       }
       this.#rejectPending(consumer, reason);
+      consumer.error = reason;
       consumer.detached = true;
     }
     this.#consumers.clear();
@@ -460,7 +468,7 @@ class BroadcastImpl {
       return validateBatchEntry(entry);
     } catch (error) {
       this.#writer.fail(error);
-      if (this.#error === undefined) this[kAbort](error);
+      if (!this.#errored) this[kAbort](error);
       this.#buffer.clear();
       this.#bufferedBytes = 0;
       return null;
@@ -706,12 +714,11 @@ class BroadcastWriter {
   fail(reason) {
     if (this.#state === 'errored' || this.#state === 'closed') return;
     this.#state = 'errored';
-    const error = reason ?? new ERR_INVALID_STATE.TypeError('Failed');
-    this.#error = error;
-    this.#rejectPendingWrites(error);
-    this.#rejectPendingDrains(error);
-    this.#pendingEnd?.reject(error);
-    this.#broadcast[kAbort](error);
+    this.#error = reason;
+    this.#rejectPendingWrites(reason);
+    this.#rejectPendingDrains(reason);
+    this.#pendingEnd?.reject(reason);
+    this.#broadcast[kAbort](reason);
   }
 
   [SymbolAsyncDispose]() {
@@ -818,7 +825,7 @@ function wireBroadcastWriteSignal(entry, signal, resolve, reject, self) {
     const idx = pendingWrites.indexOf(entry);
     if (idx !== -1) pendingWrites.removeAt(idx);
     entry.batch = null;
-    reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
+    reject(signal.reason);
     if (idx !== -1) self[kPendingWriteRemoved]();
   };
   entry.resolve = function() {
@@ -937,7 +944,7 @@ const Broadcast = {
           await w.end(signal ? { signal } : undefined);
         }
       } catch (error) {
-        w.fail(wrapError(error));
+        w.fail(error);
       }
     };
     PromisePrototypeThen(pump(), undefined, () => {});
diff --git a/lib/internal/streams/iter/classic.js b/lib/internal/streams/iter/classic.js
index 28f6079e6fe2..4ca384cae9ab 100644
--- a/lib/internal/streams/iter/classic.js
+++ b/lib/internal/streams/iter/classic.js
@@ -13,6 +13,7 @@
 
 const {
   ArrayPrototypePush,
+  FunctionPrototypeCall,
   NumberMAX_SAFE_INTEGER,
   Promise,
   PromisePrototypeThen,
@@ -32,9 +33,11 @@ const {
   AbortError,
   aggregateTwoErrors,
   codes: {
+    ERR_FALSY_VALUE_REJECTION,
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
     ERR_INVALID_STATE,
+    ERR_OPERATION_FAILED,
     ERR_STREAM_WRITE_AFTER_END,
   },
 } = require('internal/errors');
@@ -67,6 +70,25 @@ const {
 
 const { Buffer } = require('buffer');
 const destroyImpl = require('internal/streams/destroy');
+const { isError } = require('internal/util');
+
+// Classic stream error channels require a truthy Error object.
+function toClassicError(reason, reasonMap) {
+  try {
+    if (isError(reason)) return reason;
+  } catch {
+    // Wrap values whose proxy traps make the Error check fail.
+  }
+  let error;
+  if (!reason) {
+    error = new ERR_FALSY_VALUE_REJECTION.HideStackFramesError(reason);
+  } else {
+    error = new ERR_OPERATION_FAILED('Non-Error value');
+    error.reason = reason;
+  }
+  reasonMap?.set(error, { __proto__: null, reason });
+  return error;
+}
 
 // Lazy-loaded to avoid circular dependencies. Readable and Writable
 // both require this module's parent, so we defer the require.
@@ -299,11 +321,17 @@ function toReadable(source, options = kNullPrototype) {
         backpressure.resolve();
         backpressure = null;
       }
-      if (typeof iterator.return === 'function') {
-        PromisePrototypeThen(iterator.return(),
-                             () => cb(err), (e) => cb(e || err));
-      } else {
-        cb(err);
+      try {
+        const returnMethod = iterator.return;
+        if (typeof returnMethod !== 'function') {
+          cb(err);
+          return;
+        }
+        const returned = FunctionPrototypeCall(returnMethod, iterator);
+        PromisePrototypeThen(PromiseResolve(returned), () => cb(err),
+                             (error) => cb(err || toClassicError(error)));
+      } catch (error) {
+        cb(err || toClassicError(error));
       }
     },
   });
@@ -331,7 +359,7 @@ function toReadable(source, options = kNullPrototype) {
       }
     } catch (err) {
       done = true;
-      readable.destroy(err);
+      readable.destroy(toClassicError(err));
     }
   }
 
@@ -372,30 +400,43 @@ function toReadableSync(source, options = kNullPrototype) {
     __proto__: null,
     highWaterMark,
     read() {
-      for (;;) {
-        if (hasBatch) {
-          while (batchIndex < batch.length) {
-            if (!this.push(batch[batchIndex++])) return;
+      try {
+        for (;;) {
+          if (hasBatch) {
+            while (batchIndex < batch.length) {
+              if (!this.push(batch[batchIndex++])) return;
+            }
+            batch = undefined;
+            hasBatch = false;
+            batchIndex = 0;
           }
-          batch = undefined;
-          hasBatch = false;
-          batchIndex = 0;
-        }
 
-        const result = iterator.next();
-        const { done } = result;
-        if (done) {
-          this.push(null);
-          return;
+          const result = iterator.next();
+          const { done } = result;
+          if (done) {
+            this.push(null);
+            return;
+          }
+          batch = result.value;
+          hasBatch = true;
         }
-        batch = result.value;
-        hasBatch = true;
+      } catch (error) {
+        const classicError = toClassicError(error);
+        throw classicError;
       }
     },
     destroy(err, cb) {
       batch = undefined;
       hasBatch = false;
-      if (typeof iterator.return === 'function') iterator.return();
+      try {
+        const returnMethod = iterator.return;
+        if (typeof returnMethod === 'function') {
+          FunctionPrototypeCall(returnMethod, iterator);
+        }
+      } catch (error) {
+        cb(err || toClassicError(error));
+        return;
+      }
       cb(err);
     },
   });
@@ -471,6 +512,9 @@ function fromWritable(writable, options = kNullPrototype) {
   // expose the full stream.Writable property set.
   const hwm = writable.writableHighWaterMark ?? 16384;
   let totalBytes = 0;
+  let errored = false;
+  let error;
+  let pendingEnd;
 
   // Waiters pending on backpressure resolution (block policy only).
   // Multiple un-awaited writes can each add a waiter, so this must be
@@ -504,11 +548,17 @@ function fromWritable(writable, options = kNullPrototype) {
   }
 
   // Reject all pending waiters and remove the drain/error listeners.
-  function cleanup(err) {
+  function cleanup(err, preserveReason = false) {
     const pending = waiters;
     waiters = [];
     for (let i = 0; i < pending.length; i++) {
-      pending[i].reject(err ?? new AbortError());
+      if (!preserveReason &&
+          (err === undefined || err === null) &&
+          pending[i].close !== undefined) {
+        pending[i].close();
+      } else {
+        pending[i].reject(preserveReason ? err : err ?? new AbortError());
+      }
     }
     if (!listenersInstalled) return;
     listenersInstalled = false;
@@ -526,7 +576,8 @@ function fromWritable(writable, options = kNullPrototype) {
   function isWritable() {
     // Duck-typed streams may not have these properties -- treat missing
     // as false (i.e., writable is still open).
-    return !(writable.destroyed ?? false) &&
+    return !errored &&
+           !(writable.destroyed ?? false) &&
            !(writable.writableFinished ?? false) &&
            !(writable.writableEnded ?? false);
   }
@@ -580,6 +631,7 @@ function fromWritable(writable, options = kNullPrototype) {
     write(chunk, options) {
       const bytes = toWriterUint8Array(chunk);
       getWriterSignal(options);
+      if (errored) return PromiseReject(error);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
@@ -617,6 +669,7 @@ function fromWritable(writable, options = kNullPrototype) {
     writev(chunks, options) {
       chunks = convertChunks(chunks);
       getWriterSignal(options);
+      if (errored) return PromiseReject(error);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
@@ -665,51 +718,71 @@ function fromWritable(writable, options = kNullPrototype) {
     // write().
     end(options) {
       getWriterSignal(options);
+      if (errored) return PromiseReject(error);
+      if (pendingEnd) return pendingEnd.promise;
       if ((writable.writableFinished ?? false) ||
           (writable.destroyed ?? false)) {
         cleanup();
         return PromiseResolve(totalBytes);
       }
 
-      const { promise, resolve, reject } = PromiseWithResolvers();
+      pendingEnd = PromiseWithResolvers();
+      const { promise, resolve, reject } = pendingEnd;
 
-      if (!(writable.writableEnded ?? false)) {
-        writable.end();
-      }
+      try {
+        if (!(writable.writableEnded ?? false)) {
+          writable.end();
+        }
 
-      eos(writable, { writable: true, readable: false }, (err) => {
-        cleanup(err);
-        if (err) reject(err);
-        else resolve(totalBytes);
-      });
+        eos(writable, { writable: true, readable: false }, (err) => {
+          if (errored) return;
+          pendingEnd = undefined;
+          cleanup(err);
+          if (err) reject(err);
+          else resolve(totalBytes);
+        });
+      } catch (reason) {
+        pendingEnd = undefined;
+        errored = true;
+        error = reason;
+        cleanup(reason, true);
+        reject(reason);
+        try {
+          writable.destroy?.(toClassicError(reason));
+        } catch {
+          // Preserve the original terminal reason.
+        }
+      }
 
       return promise;
     },
 
     fail(reason) {
-      cleanup(reason);
+      if (errored ||
+          (writable.writableFinished ?? false) ||
+          (writable.destroyed ?? false)) {
+        return;
+      }
+      errored = true;
+      error = reason;
+      pendingEnd?.reject(reason);
+      pendingEnd = undefined;
+      cleanup(reason, true);
       if (typeof writable.destroy === 'function') {
-        writable.destroy(reason);
+        writable.destroy(toClassicError(reason));
       }
     },
 
     [SymbolAsyncDispose]() {
+      if (pendingEnd) return pendingEnd.promise;
       if (isWritable()) {
-        cleanup();
-        if (typeof writable.destroy === 'function') {
-          writable.destroy();
-        }
+        this.fail();
       }
       return PromiseResolve();
     },
 
     [SymbolDispose]() {
-      if (isWritable()) {
-        cleanup();
-        if (typeof writable.destroy === 'function') {
-          writable.destroy();
-        }
-      }
+      this.fail();
     },
   };
 
@@ -719,11 +792,12 @@ function fromWritable(writable, options = kNullPrototype) {
     if ((writable.writableLength ?? 0) < hwm) {
       return PromiseResolve(true);
     }
-    const { promise, resolve } = PromiseWithResolvers();
+    const { promise, resolve, reject } = PromiseWithResolvers();
     ArrayPrototypePush(waiters, {
       __proto__: null,
       resolve() { resolve(true); },
-      reject() { resolve(false); },
+      reject,
+      close() { resolve(false); },
     });
     installListeners();
     return promise;
@@ -761,6 +835,7 @@ function toWritable(writer) {
   const hasEndSync = hasEnd &&
                      typeof writer.endSync === 'function';
   const hasFail = typeof writer.fail === 'function';
+  const classicErrorReasons = new SafeWeakMap();
   // Try-sync-first pattern: attempt the synchronous method and fall back to the
   // async method if it returns false (data not accepted synchronously).
   // When the sync path succeeds, the callback is deferred via queueMicrotask
@@ -778,14 +853,16 @@ function toWritable(writer) {
         }
         // WriteSync returned false: not accepted, fall through to async.
       } catch (err) {
-        cb(err);
+        cb(toClassicError(err, classicErrorReasons));
         return;
       }
     }
     try {
-      PromisePrototypeThen(writer.write(bytes), () => cb(), cb);
+      PromisePrototypeThen(
+        writer.write(bytes), () => cb(),
+        (err) => cb(toClassicError(err, classicErrorReasons)));
     } catch (err) {
-      cb(err);
+      cb(toClassicError(err, classicErrorReasons));
     }
   }
 
@@ -804,14 +881,16 @@ function toWritable(writer) {
         }
         // WritevSync returned false: not accepted, fall through to async.
       } catch (err) {
-        cb(err);
+        cb(toClassicError(err, classicErrorReasons));
         return;
       }
     }
     try {
-      PromisePrototypeThen(writer.writev(chunks), () => cb(), cb);
+      PromisePrototypeThen(
+        writer.writev(chunks), () => cb(),
+        (err) => cb(toClassicError(err, classicErrorReasons)));
     } catch (err) {
-      cb(err);
+      cb(toClassicError(err, classicErrorReasons));
     }
   }
 
@@ -829,22 +908,31 @@ function toWritable(writer) {
         }
         // Result < 0: can't end synchronously, fall through to async.
       } catch (err) {
-        cb(err);
+        cb(toClassicError(err, classicErrorReasons));
         return;
       }
     }
     try {
-      PromisePrototypeThen(writer.end(), () => cb(), cb);
+      PromisePrototypeThen(
+        writer.end(), () => cb(),
+        (err) => cb(toClassicError(err, classicErrorReasons)));
     } catch (err) {
-      cb(err);
+      cb(toClassicError(err, classicErrorReasons));
     }
   }
 
   function _destroy(err, cb) {
     if (err && hasFail) {
-      writer.fail(err);
+      const wrapped = classicErrorReasons.get(err);
+      classicErrorReasons.delete(err);
+      try {
+        writer.fail(wrapped === undefined ? err : wrapped.reason);
+      } catch (error) {
+        cb(err || toClassicError(error, classicErrorReasons));
+        return;
+      }
     }
-    cb();
+    cb(err);
   }
 
   const writableOptions = {
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index 6b44f5c5e431..01a9504dc871 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -35,6 +35,7 @@ const {
 const {
   AbortController,
   AbortSignal,
+  abortSignal,
 } = require('internal/abort_controller');
 
 const {
@@ -54,7 +55,6 @@ const {
   toUint8Array,
   validateBatchEntry,
   validateByteView,
-  wrapError,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
 const {
@@ -723,8 +723,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
   let abortHandler;
   if (signal) {
     abortHandler = () => {
-      controller.abort(signal.reason ??
-        lazyDOMException('Aborted', 'AbortError'));
+      abortSignal(controller.signal, signal.reason);
     };
     signal.addEventListener('abort', abortHandler, { __proto__: null, once: true });
   }
@@ -785,7 +784,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
     completed = true;
   } catch (error) {
     if (!controller.signal.aborted) {
-      controller.abort(wrapError(error));
+      abortSignal(controller.signal, error);
     }
     throw error;
   } finally {
@@ -868,7 +867,7 @@ function pull(source, ...args) {
           return iterator.return(value);
         },
         throw(error) {
-          controller.abort(error);
+          abortSignal(controller.signal, error);
           return iterator.throw(error);
         },
         [SymbolAsyncIterator]() {
@@ -1028,7 +1027,7 @@ function pipeToSync(source, ...args) {
     }
   } catch (error) {
     if (!options.preventFail) {
-      writer.fail?.(wrapError(error));
+      writer.fail?.(error);
     }
     throw error;
   }
@@ -1053,7 +1052,7 @@ async function pipeTo(source, ...args) {
 
   function failWriter(error) {
     if (!options.preventFail) {
-      writer.fail?.(wrapError(error));
+      writer.fail?.(error);
     }
   }
 
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index 0536d8212c2a..31b437c85b75 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -12,7 +12,6 @@ const {
   PromiseResolve,
   PromiseWithResolvers,
   SafeWeakSet,
-  Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
@@ -23,7 +22,6 @@ const {
     ERR_INVALID_STATE,
   },
 } = require('internal/errors');
-const { lazyDOMException } = require('internal/util');
 const {
   validateInteger,
 } = require('internal/validators');
@@ -55,7 +53,6 @@ const {
   RingBuffer,
 } = require('internal/streams/iter/ringbuffer');
 
-const kNoFailReason = Symbol('kNoFailReason');
 const consumerReturnErrors = new SafeWeakSet();
 
 function isConsumerReturnError(error) {
@@ -108,8 +105,10 @@ class PushQueue {
   #writerState = 'open';
   /** Consumer state: 'active' | 'returned' | 'thrown' */
   #consumerState = 'active';
-  /** Error that closed the stream */
-  #error = null;
+  /** Error that closed the writer */
+  #writerError;
+  /** Error supplied by the consumer */
+  #consumerError;
   /** Total bytes written */
   #bytesWritten = 0;
   /** Pending end promise (resolves when consumer drains past end sentinel) */
@@ -255,12 +254,11 @@ class PushQueue {
       throw new ERR_INVALID_STATE.TypeError('Writer is closing');
     }
     if (this.#writerState === 'errored') {
-      throw this.#error;
+      throw this.#writerError;
     }
     if (this.#consumerState !== 'active') {
-      throw this.#consumerState === 'thrown' && this.#error ?
-        this.#error :
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+      if (this.#consumerState === 'thrown') throw this.#consumerError;
+      throw new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
     }
 
     // Check for pre-aborted signal (after state checks per spec)
@@ -307,7 +305,7 @@ class PushQueue {
           this.#pendingWrites.removeAt(idx);
           this.#resolvePendingReads();
         }
-        reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
+        reject(signal.reason);
       };
 
       // Wrap resolve/reject to clean up signal listener
@@ -379,25 +377,23 @@ class PushQueue {
    * No-op if errored or closed (fully drained).
    * If closing (draining), short-circuits the drain.
    */
-  fail(reason = kNoFailReason) {
+  fail(reason) {
     if (this.#writerState === 'errored' || this.#writerState === 'closed') {
       return;
     }
 
     const wasClosing = this.#writerState === 'closing';
     this.#writerState = 'errored';
-    this.#error = reason === kNoFailReason ?
-      new ERR_INVALID_STATE('Failed') :
-      reason;
+    this.#writerError = reason;
     this.#cleanup();
-    this.#rejectPendingReads(this.#error);
-    this.#rejectPendingDrains(this.#error);
-    this.#rejectPendingWrites(this.#error);
+    this.#rejectPendingReads(this.#writerError);
+    this.#rejectPendingDrains(this.#writerError);
+    this.#rejectPendingWrites(this.#writerError);
 
     if (wasClosing) {
       // Short-circuit the graceful drain: reject the pending end promise
       if (this.#pendingEnd) {
-        this.#pendingEnd.reject(this.#error);
+        this.#pendingEnd.reject(this.#writerError);
         this.#pendingEnd = null;
       }
     }
@@ -408,7 +404,7 @@ class PushQueue {
   }
 
   get error() {
-    return this.#error;
+    return this.#writerError;
   }
 
   get backpressurePolicy() {
@@ -446,7 +442,7 @@ class PushQueue {
       return { __proto__: null, done: true, value: undefined };
     }
     if (this.#consumerState === 'thrown') {
-      throw this.#error;
+      throw this.#consumerError;
     }
 
     // If there's data in the buffer, return it immediately
@@ -467,7 +463,7 @@ class PushQueue {
     }
 
     if (this.#writerState === 'errored') {
-      throw this.#error;
+      throw this.#writerError;
     }
 
     const { promise, resolve, reject } = PromiseWithResolvers();
@@ -489,7 +485,7 @@ class PushQueue {
   consumerThrow(error) {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'thrown';
-    this.#error = error;
+    this.#consumerError = error;
     this.#terminateWriterFromConsumer(error);
     this.#rejectPendingReads(error);
     // Reject pending drains - the consumer errored
@@ -531,7 +527,7 @@ class PushQueue {
     this.#bufferedBytes = 0;
     if (this.#writerState === 'open' || this.#writerState === 'closing') {
       this.#writerState = 'errored';
-      this.#error = error;
+      this.#writerError = error;
     }
     this.#cleanup();
     this.#rejectPendingWrites(error);
@@ -548,7 +544,7 @@ class PushQueue {
         pending.resolve({ __proto__: null, done: true, value: undefined });
       } else if (this.#consumerState === 'thrown') {
         const pending = this.#pendingReads.shift();
-        pending.reject(this.#error);
+        pending.reject(this.#consumerError);
       } else if (this.#slots.length > 0) {
         const pending = this.#pendingReads.shift();
         try {
@@ -569,7 +565,7 @@ class PushQueue {
         pending.resolve({ __proto__: null, done: true, value: undefined });
       } else if (this.#writerState === 'errored') {
         const pending = this.#pendingReads.shift();
-        pending.reject(this.#error);
+        pending.reject(this.#writerError);
       } else {
         break;
       }
@@ -685,6 +681,11 @@ class PushWriter {
 
   end(options) {
     const signal = getWriterSignal(options);
+    const state = this.#queue.writerState;
+    if (state === 'errored') return PromiseReject(this.#queue.error);
+    if (state === 'closed') {
+      return PromiseResolve(this.#queue.totalBytesWritten);
+    }
     if (signal?.aborted) return PromiseReject(signal.reason);
 
     const result = this.#queue.end();
@@ -707,7 +708,7 @@ class PushWriter {
   }
 
   fail(reason) {
-    this.#queue.fail(arguments.length === 0 ? kNoFailReason : reason);
+    this.#queue.fail(reason);
   }
 
   [SymbolAsyncDispose]() {
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 70179dffd3c1..6154509a5b64 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -7,6 +7,7 @@
 
 const {
   ArrayPrototypePush,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
@@ -41,7 +42,6 @@ const {
   getMinCursor,
   hasProtocol,
   onSignalAbort,
-  wrapError,
   parsePullArgs,
   validateBatchEntry,
 } = require('internal/streams/iter/utils');
@@ -79,7 +79,7 @@ class ShareImpl {
   #consumers = new SafeSet();
   #sourceIterator = null;
   #sourceExhausted = false;
-  #sourceError;
+  #sourceError = kNoShareError;
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
@@ -192,7 +192,7 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) {
+              if (self.#sourceError !== kNoShareError) {
                 state.error = self.#sourceError;
                 throw state.error;
               }
@@ -254,28 +254,33 @@ class ShareImpl {
 
   cancel(reason) {
     if (this.#cancelled) return;
+    const hasReason = arguments.length > 0;
     this.#cancelled = true;
 
-    if (reason !== undefined) {
+    if (hasReason) {
       this.#cancelError = reason;
     }
 
     this.#resolveCancel(kShareCancelled);
     this.#resolveCancel = null;
 
-    if (this.#sourceIterator?.return) {
-      try {
+    try {
+      const returnMethod = this.#sourceIterator?.return;
+      if (typeof returnMethod === 'function') {
         PromisePrototypeThen(
-          PromiseResolve(this.#sourceIterator.return()), undefined, () => {});
-      } catch {
-        // Cancellation has precedence over source cleanup errors.
+          PromiseResolve(FunctionPrototypeCall(
+            returnMethod, this.#sourceIterator)),
+          undefined,
+          () => {});
       }
+    } catch {
+      // Cancellation has precedence over source cleanup errors.
     }
 
     for (const consumer of this.#consumers) {
       consumer.error = this.#cancelError;
       if (consumer.resolve) {
-        if (reason !== undefined) {
+        if (hasReason) {
           consumer.reject?.(reason);
         } else {
           consumer.resolve({ __proto__: null, done: true, value: undefined });
@@ -304,7 +309,7 @@ class ShareImpl {
   async #waitForBufferSpace() {
     while (this.#bufferedBytes >= this.#options.budget) {
       if (this.#cancelled ||
-          this.#sourceError !== undefined ||
+          this.#sourceError !== kNoShareError ||
           this.#sourceExhausted) {
         return this.#cancelled ? null : true;
       }
@@ -345,7 +350,7 @@ class ShareImpl {
   async #waitForBufferSpaceAfterDrop() {
     while (this.#bufferedBytes >= this.#options.budget &&
            !this.#cancelled &&
-           this.#sourceError === undefined &&
+           this.#sourceError === kNoShareError &&
            !this.#sourceExhausted) {
       const { promise, resolve } = PromiseWithResolvers();
       ArrayPrototypePush(this.#pullWaiters, resolve);
@@ -406,7 +411,7 @@ class ShareImpl {
           this.#bufferedBytes += entry.byteLength;
         }
       } catch (error) {
-        this.#sourceError = wrapError(error);
+        this.#sourceError = error;
         this.#sourceExhausted = true;
       } finally {
         this.#pulling = false;
@@ -483,7 +488,7 @@ class SyncShareImpl {
   #consumers = new SafeSet();
   #sourceIterator = null;
   #sourceExhausted = false;
-  #sourceError;
+  #sourceError = kNoShareError;
   #cancelled = false;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
@@ -513,6 +518,7 @@ class SyncShareImpl {
       __proto__: null,
       cursor: this.#bufferStart,
       detached: false,
+      error: kNoShareError,
     };
 
     this.#consumers.add(state);
@@ -532,14 +538,16 @@ class SyncShareImpl {
         return {
           __proto__: null,
           next() {
-            if (self.#sourceError !== undefined) {
-              state.detached = true;
-              self.#deleteConsumer(state);
-              throw self.#sourceError;
-            }
             if (state.detached) {
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
+            if (self.#sourceError !== kNoShareError) {
+              state.detached = true;
+              state.error = self.#sourceError;
+              self.#deleteConsumer(state);
+              throw state.error;
+            }
             if (self.#cancelled) {
               state.detached = true;
               self.#deleteConsumer(state);
@@ -600,10 +608,11 @@ class SyncShareImpl {
 
             self.#pullFromSource();
 
-            if (self.#sourceError !== undefined) {
+            if (self.#sourceError !== kNoShareError) {
               state.detached = true;
+              state.error = self.#sourceError;
               self.#deleteConsumer(state);
-              throw self.#sourceError;
+              throw state.error;
             }
 
             const newBufferIndex = state.cursor - self.#bufferStart;
@@ -649,17 +658,24 @@ class SyncShareImpl {
 
   cancel(reason) {
     if (this.#cancelled) return;
+    const hasReason = arguments.length > 0;
     this.#cancelled = true;
 
-    if (reason !== undefined) {
+    if (hasReason) {
       this.#sourceError = reason;
     }
 
-    if (this.#sourceIterator?.return) {
-      this.#sourceIterator.return();
+    try {
+      const returnMethod = this.#sourceIterator?.return;
+      if (typeof returnMethod === 'function') {
+        FunctionPrototypeCall(returnMethod, this.#sourceIterator);
+      }
+    } catch {
+      // Cancellation has precedence over source cleanup errors.
     }
 
     for (const consumer of this.#consumers) {
+      if (hasReason) consumer.error = reason;
       consumer.detached = true;
     }
     this.#consumers.clear();
@@ -685,7 +701,7 @@ class SyncShareImpl {
         this.#bufferedBytes += entry.byteLength;
       }
     } catch (error) {
-      this.#sourceError = wrapError(error);
+      this.#sourceError = error;
       this.#sourceExhausted = true;
     }
   }
diff --git a/lib/internal/streams/iter/transform.js b/lib/internal/streams/iter/transform.js
index cb35906ded02..c4f08b8cd32b 100644
--- a/lib/internal/streams/iter/transform.js
+++ b/lib/internal/streams/iter/transform.js
@@ -35,7 +35,6 @@ const {
   },
   genericNodeError,
 } = require('internal/errors');
-const { lazyDOMException } = require('internal/util');
 const { isArrayBufferView, isAnyArrayBuffer } = require('internal/util/types');
 const { kValidatedTransform } = require('internal/streams/iter/types');
 const {
@@ -399,8 +398,7 @@ function makeZlibTransform(createHandleFn, processFlag, finishFlag) {
         resolveWrite = undefined;
         rejectWrite = undefined;
         if (reject) {
-          reject(signal.reason ??
-                 lazyDOMException('The operation was aborted', 'AbortError'));
+          reject(signal.reason);
         }
       };
       signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 08337a5536f2..95d2d914eb1a 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -9,7 +9,6 @@ const {
   PromiseWithResolvers,
   SafePromisePrototypeFinally,
   SafePromiseRace,
-  String,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -27,10 +26,8 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_STATE,
-    ERR_OPERATION_FAILED,
   },
 } = require('internal/errors');
-const { isError } = require('internal/util');
 
 const { isSharedArrayBuffer, isUint8Array } = require('internal/util/types');
 
@@ -337,15 +334,6 @@ function toWriterUint8Array(chunk) {
   }));
 }
 
-/**
- * Wrap a caught value as an Error, converting non-Error values.
- * @param {unknown} error
- * @returns {Error}
- */
-function wrapError(error) {
-  return isError(error) ? error : new ERR_OPERATION_FAILED(String(error));
-}
-
 /**
  * Check if a value implements a Symbol-keyed protocol (has a function
  * at the given symbol key).
@@ -445,6 +433,5 @@ module.exports = {
   validateBackpressure,
   validateBatchEntry,
   validateByteView,
-  wrapError,
   yieldAbortable,
 };
diff --git a/test/parallel/test-fs-promises-file-handle-pull.js b/test/parallel/test-fs-promises-file-handle-pull.js
index 3fc531baf713..cdfaf273f933 100644
--- a/test/parallel/test-fs-promises-file-handle-pull.js
+++ b/test/parallel/test-fs-promises-file-handle-pull.js
@@ -198,7 +198,7 @@ async function testPullAbortSignal() {
   const ac = new AbortController();
   const fh = await open(filePath, 'r');
   try {
-    ac.abort();
+    ac.abort(null);
     const readable = fh.pull({ signal: ac.signal });
 
     await assert.rejects(
@@ -208,7 +208,7 @@ async function testPullAbortSignal() {
           assert.fail('Should not reach here');
         }
       },
-      (err) => err.name === 'AbortError',
+      (err) => err === null,
     );
   } finally {
     await fh.close();
diff --git a/test/parallel/test-fs-promises-file-handle-writer.js b/test/parallel/test-fs-promises-file-handle-writer.js
index d43bababad1e..a636844f8e57 100644
--- a/test/parallel/test-fs-promises-file-handle-writer.js
+++ b/test/parallel/test-fs-promises-file-handle-writer.js
@@ -764,8 +764,12 @@ async function testEndSyncReturnsFalseDuringAsync() {
   const p = w.write(Buffer.from('data'));
   assert.strictEqual(w.endSync(), -1);
 
+  const ending = w.end();
+  assert.strictEqual(w.writeSync(Buffer.from('more')), false);
+  assert.strictEqual(w.endSync(), -1);
+  await assert.rejects(w.write('more'), { code: 'ERR_INVALID_STATE' });
   await p;
-  const totalBytes = await w.end();
+  const totalBytes = await ending;
   await fh.close();
 
   assert.strictEqual(totalBytes, 4);
@@ -850,6 +854,50 @@ async function testEndRejectsOnErrored() {
   await fh.close();
 }
 
+async function testFailPreservesReason() {
+  for (const reason of [undefined, null, false, 0, '', 'failure']) {
+    const suffix = String(reason).replaceAll(' ', '-');
+    const filePath = path.join(tmpDir, `writer-fail-${suffix}.txt`);
+    const fh = await open(filePath, 'w');
+    const w = fh.writer();
+
+    w.fail(reason);
+
+    await assert.rejects(w.write('data'), (error) => error === reason);
+    await assert.rejects(w.end(), (error) => error === reason);
+    await fh.close();
+  }
+}
+
+async function testFailRejectsPendingWriteWithReason() {
+  const filePath = path.join(tmpDir, 'writer-fail-pending.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+  const reason = null;
+  const pending = w.write(Buffer.alloc(1024 * 1024));
+
+  w.fail(reason);
+
+  await assert.rejects(pending, (error) => error === reason);
+  await fh.close();
+}
+
+async function testFailWhileClosingPreservesReason() {
+  const filePath = path.join(tmpDir, 'writer-fail-closing.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+  const reason = false;
+  const pendingWrite = w.write(Buffer.alloc(1024 * 1024));
+  const pendingEnd = w.end();
+
+  w.fail(reason);
+
+  for (const promise of [pendingWrite, pendingEnd]) {
+    await assert.rejects(promise, (error) => error === reason);
+  }
+  await fh.close();
+}
+
 // =============================================================================
 // end() is idempotent when closing/closed
 // =============================================================================
@@ -914,7 +962,7 @@ async function testAsyncDisposeCallsFail() {
   // Writer should be in errored state - write should reject
   await assert.rejects(
     w.write(Buffer.from('more')),
-    (err) => err instanceof Error,
+    (reason) => reason === undefined,
   );
 
   // Handle should be unlocked and reusable
@@ -1125,6 +1173,9 @@ Promise.all([
   testEndSyncAutoClose(),
   testFullSyncPipeline(),
   testEndRejectsOnErrored(),
+  testFailPreservesReason(),
+  testFailRejectsPendingWriteWithReason(),
+  testFailWhileClosingPreservesReason(),
   testEndIdempotent(),
   testAsyncDisposeWhileClosing(),
   testAsyncDisposeCallsFail(),
diff --git a/test/parallel/test-quic-stream-writer-api.mjs b/test/parallel/test-quic-stream-writer-api.mjs
index 4f19502d8579..6ccd52b046a4 100644
--- a/test/parallel/test-quic-stream-writer-api.mjs
+++ b/test/parallel/test-quic-stream-writer-api.mjs
@@ -130,8 +130,8 @@ await clientSession.opened;
 {
   const stream = await clientSession.createBidirectionalStream();
   const w = stream.writer;
-  const testError = new Error('writer fail test');
-  w.fail(testError);
+  const reason = null;
+  w.fail(reason);
   // After fail, canWrite is null.
   assert.strictEqual(w.canWrite, null);
   // drainableProtocol returns null when errored.
@@ -141,8 +141,12 @@ await clientSession.opened;
   assert.strictEqual(w.endSync(), -1);
   // WriteSync after fail returns false.
   assert.strictEqual(w.writeSync(encoder.encode('x')), false);
-  // Write after fail throws with the original error.
-  await assert.rejects(w.write(encoder.encode('x')), testError);
+  // Stored failure takes precedence over per-operation cancellation.
+  const signal = AbortSignal.abort('operation cancelled');
+  await assert.rejects(
+    w.write(encoder.encode('x'), { signal }),
+    (error) => error === reason);
+  await assert.rejects(w.end({ signal }), (error) => error === reason);
   // Don't await stream.closed here — the reset stream may not trigger
   // server onstream (no data was sent before fail), so the server
   // won't count it. The stream is cleaned up when the session closes.
diff --git a/test/parallel/test-stream-iter-broadcast-backpressure.js b/test/parallel/test-stream-iter-broadcast-backpressure.js
index 6efa7eb54c73..e42bb93d5f1f 100644
--- a/test/parallel/test-stream-iter-broadcast-backpressure.js
+++ b/test/parallel/test-stream-iter-broadcast-backpressure.js
@@ -4,6 +4,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { broadcast, ondrain, text } = require('stream/iter');
+const { setImmediate } = require('timers/promises');
 
 // =============================================================================
 // Backpressure policies
@@ -67,7 +68,7 @@ async function testDropPoliciesReportPhysicalCapacity() {
     // Drop policies still accept writes despite having no physical capacity.
     assert.strictEqual(writer.writeSync(chunk), true);
     assert.strictEqual(writer.canWrite, false);
-    await new Promise(setImmediate);
+    await setImmediate();
     assert.strictEqual(drained, false);
 
     assert.strictEqual((await iterator.next()).done, false);
@@ -93,14 +94,14 @@ async function testBlockBackpressure() {
   // Next write should block
   let writeResolved = false;
   const writePromise = writer.write(kChunk).then(() => { writeResolved = true; });
-  await new Promise(setImmediate);
+  await setImmediate();
   assert.strictEqual(writeResolved, false);
 
   // Drain consumer to unblock the pending write
   const iter = consumer[Symbol.asyncIterator]();
   const first = await iter.next();
   assert.strictEqual(first.done, false);
-  await new Promise(setImmediate);
+  await setImmediate();
   assert.strictEqual(writeResolved, true);
 
   writer.endSync();
@@ -122,7 +123,7 @@ async function testBlockBackpressureContent() {
 
   writer.writeSync(chunk1);
   const writePromise = writer.write(chunk2);
-  await new Promise(setImmediate);
+  await setImmediate();
 
   // Read all and verify content
   const iter = consumer[Symbol.asyncIterator]();
@@ -158,11 +159,7 @@ async function testStrictBackpressureOverflow() {
   });
 
   writer.fail();
-  await assert.rejects(pending, {
-    name: 'TypeError',
-    code: 'ERR_INVALID_STATE',
-    message: 'Invalid state: Failed',
-  });
+  await assert.rejects(pending, (reason) => reason === undefined);
 }
 
 async function testEndDrainsPendingWrite() {
@@ -195,7 +192,7 @@ async function testEndDrainsPendingWrite() {
 
   let endResolved = false;
   endPromise.then(common.mustCall(() => { endResolved = true; }));
-  await new Promise(setImmediate);
+  await setImmediate();
   assert.strictEqual(endResolved, false);
 
   assert.strictEqual((await iter.next()).done, true);
diff --git a/test/parallel/test-stream-iter-reason-propagation.js b/test/parallel/test-stream-iter-reason-propagation.js
new file mode 100644
index 000000000000..7511dbb2c410
--- /dev/null
+++ b/test/parallel/test-stream-iter-reason-propagation.js
@@ -0,0 +1,271 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  Broadcast,
+  broadcast,
+  from,
+  fromSync,
+  pipeTo,
+  pipeToSync,
+  pull,
+  push,
+  share,
+  shareSync,
+} = require('stream/iter');
+
+const reasons = [undefined, null, false, 0, '', 'failure'];
+
+async function rejectsWith(promise, expected) {
+  await assert.rejects(promise, (reason) => reason === expected);
+}
+
+function throwsWith(fn, expected) {
+  assert.throws(fn, (reason) => reason === expected);
+}
+
+function asyncThrowingSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return {
+        __proto__: null,
+        next() { return Promise.reject(reason); },
+      };
+    },
+  };
+}
+
+function syncThrowingSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.iterator]() {
+      return {
+        __proto__: null,
+        next() { throw reason; },
+      };
+    },
+  };
+}
+
+async function testPipeReasons() {
+  for (const reason of reasons) {
+    let asyncFailCalled = false;
+    let asyncFailReason;
+    const asyncWriter = {
+      __proto__: null,
+      write() {},
+      fail(error) { asyncFailCalled = true; asyncFailReason = error; },
+    };
+    const asyncSource = asyncThrowingSource(reason);
+
+    await rejectsWith(pipeTo(asyncSource, asyncWriter), reason);
+    assert.strictEqual(asyncFailCalled, true);
+    assert.strictEqual(asyncFailReason, reason);
+
+    let syncFailCalled = false;
+    let syncFailReason;
+    const syncWriter = {
+      __proto__: null,
+      writeSync() { return true; },
+      endSync() { return 0; },
+      fail(error) { syncFailCalled = true; syncFailReason = error; },
+    };
+    const syncSource = syncThrowingSource(reason);
+
+    throwsWith(() => pipeToSync(syncSource, syncWriter), reason);
+    assert.strictEqual(syncFailCalled, true);
+    assert.strictEqual(syncFailReason, reason);
+  }
+}
+
+async function testSharedSourceReasons() {
+  for (const reason of reasons) {
+    const asyncSource = asyncThrowingSource(reason);
+    const asyncIterator = share(asyncSource).pull()[Symbol.asyncIterator]();
+    await rejectsWith(asyncIterator.next(), reason);
+
+    const syncSource = syncThrowingSource(reason);
+    const syncIterator = shareSync(syncSource).pull()[Symbol.iterator]();
+    throwsWith(() => syncIterator.next(), reason);
+  }
+}
+
+async function testBroadcastFromReason() {
+  const reason = 'source failure';
+  const source = asyncThrowingSource(reason);
+  const { broadcast: channel } = Broadcast.from(source);
+  await rejectsWith(channel.push()[Symbol.asyncIterator]().next(), reason);
+}
+
+async function testWriterFailReasons() {
+  for (const reason of reasons) {
+    const pushed = push();
+    pushed.writer.fail(reason);
+    await rejectsWith(
+      pushed.readable[Symbol.asyncIterator]().next(), reason);
+    await rejectsWith(pushed.writer.write('data'), reason);
+    await rejectsWith(pushed.writer.end(), reason);
+
+    const broadcasted = broadcast();
+    const iterator = broadcasted.broadcast.push()[Symbol.asyncIterator]();
+    const pendingRead = iterator.next();
+    broadcasted.writer.fail(reason);
+    await rejectsWith(pendingRead, reason);
+    await rejectsWith(broadcasted.writer.write('data'), reason);
+    await rejectsWith(broadcasted.writer.end(), reason);
+    await rejectsWith(
+      broadcasted.broadcast.push()[Symbol.asyncIterator]().next(), reason);
+  }
+}
+
+async function testDisposeFailsWithUndefined() {
+  const pushed = push();
+  pushed.writer[Symbol.dispose]();
+  await rejectsWith(
+    pushed.readable[Symbol.asyncIterator]().next(), undefined);
+
+  const broadcasted = broadcast();
+  const next = broadcasted.broadcast
+    .push()[Symbol.asyncIterator]().next();
+  broadcasted.writer[Symbol.dispose]();
+  await rejectsWith(next, undefined);
+}
+
+async function testExplicitUndefinedCancellation() {
+  const broadcasted = broadcast();
+  const broadcastNext = broadcasted.broadcast
+    .push()[Symbol.asyncIterator]().next();
+  broadcasted.broadcast.cancel(undefined);
+  await rejectsWith(broadcastNext, undefined);
+
+  const shared = share(from('data'));
+  const shareIterator = shared.pull()[Symbol.asyncIterator]();
+  shared.cancel(undefined);
+  await rejectsWith(shareIterator.next(), undefined);
+
+  const syncShared = shareSync(fromSync('data'));
+  const syncIterator = syncShared.pull()[Symbol.iterator]();
+  syncShared.cancel(undefined);
+  throwsWith(() => syncIterator.next(), undefined);
+}
+
+async function testPendingWriteAbortReasons() {
+  const chunk = new Uint8Array(16384);
+
+  const pushed = push({ budget: chunk.byteLength });
+  pushed.writer.writeSync(chunk);
+  const pushController = new AbortController();
+  const pushWrite = pushed.writer.write('data', {
+    signal: pushController.signal,
+  });
+  pushController.abort(null);
+  await rejectsWith(pushWrite, null);
+
+  const broadcasted = broadcast({ budget: chunk.byteLength });
+  broadcasted.broadcast.push();
+  broadcasted.writer.writeSync(chunk);
+  const broadcastController = new AbortController();
+  const broadcastWrite = broadcasted.writer.write('data', {
+    signal: broadcastController.signal,
+  });
+  broadcastController.abort(null);
+  await rejectsWith(broadcastWrite, null);
+  broadcasted.broadcast.cancel();
+}
+
+async function testTransformReasons() {
+  for (const thrownReason of [undefined, 'transform failure']) {
+    let observedReason;
+    const watchSignal = (batch, { signal }) => {
+      signal.addEventListener('abort', () => {
+        observedReason = signal.reason;
+      }, { once: true });
+      return batch;
+    };
+    const throwReason = () => { throw thrownReason; };
+    const transformed = pull(from('data'), watchSignal, throwReason);
+    const iterator = transformed[Symbol.asyncIterator]();
+    await rejectsWith(iterator.next(), thrownReason);
+    assert.strictEqual(observedReason, thrownReason);
+  }
+
+  const controller = new AbortController();
+  const started = Promise.withResolvers();
+  const waitForAbort = (batch, { signal }) => {
+    started.resolve();
+    const { promise, reject } = Promise.withResolvers();
+    signal.addEventListener('abort', () => reject(signal.reason), {
+      once: true,
+    });
+    return promise;
+  };
+  const abortedIterator = pull(from('data'), waitForAbort, {
+    signal: controller.signal,
+  })[Symbol.asyncIterator]();
+  const next = abortedIterator.next();
+  await started.promise;
+  controller.abort(null);
+  await rejectsWith(next, null);
+}
+
+async function testIteratorThrowReasonReachesTransforms() {
+  const reason = undefined;
+  let observedReason;
+  const transformed = pull(from('data'), (batch, { signal }) => {
+    signal.addEventListener('abort', () => {
+      observedReason = signal.reason;
+    }, { once: true });
+    return batch;
+  });
+  const iterator = transformed[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await rejectsWith(iterator.throw(reason), reason);
+  assert.strictEqual(observedReason, reason);
+}
+
+async function testErroredWriterPrecedesOperationSignal() {
+  const failure = 0;
+  const consumerReason = 'consumer failure';
+  const signal = AbortSignal.abort(null);
+  const { writer, readable } = push();
+  const iterator = readable[Symbol.asyncIterator]();
+
+  writer.fail(failure);
+
+  await rejectsWith(writer.write('data', { signal }), failure);
+  await rejectsWith(writer.end({ signal }), failure);
+  await rejectsWith(iterator.throw(consumerReason), consumerReason);
+  await rejectsWith(writer.write('data'), failure);
+}
+
+async function testCompletedBroadcastConsumerStaysCompleted() {
+  const { writer, broadcast: channel } = broadcast();
+  const iterator = channel.push()[Symbol.asyncIterator]();
+
+  await iterator.return();
+  writer.fail(undefined);
+
+  assert.deepStrictEqual(await iterator.next(), {
+    __proto__: null,
+    done: true,
+    value: undefined,
+  });
+}
+
+Promise.all([
+  testPipeReasons(),
+  testSharedSourceReasons(),
+  testBroadcastFromReason(),
+  testWriterFailReasons(),
+  testDisposeFailsWithUndefined(),
+  testExplicitUndefinedCancellation(),
+  testPendingWriteAbortReasons(),
+  testTransformReasons(),
+  testIteratorThrowReasonReachesTransforms(),
+  testErroredWriterPrecedesOperationSignal(),
+  testCompletedBroadcastConsumerStaysCompleted(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-share-coverage.js b/test/parallel/test-stream-iter-share-coverage.js
index 48866e61deab..8b0cc1967f2f 100644
--- a/test/parallel/test-stream-iter-share-coverage.js
+++ b/test/parallel/test-stream-iter-share-coverage.js
@@ -88,32 +88,122 @@ async function testSyncIteratorThrow() {
   assert.strictEqual(shared.consumerCount, 0);
 }
 
-// Async source throws non-Error value → wrapError
+async function testCompletedSyncConsumerStaysCompleted() {
+  const reason = undefined;
+  const source = {
+    __proto__: null,
+    [Symbol.iterator]() {
+      return {
+        __proto__: null,
+        next() { throw reason; },
+      };
+    },
+  };
+  const shared = shareSync(source);
+  const completed = shared.pull()[Symbol.iterator]();
+  const active = shared.pull()[Symbol.iterator]();
+
+  completed.return();
+  let caught = false;
+  try {
+    active.next();
+  } catch (error) {
+    caught = true;
+    assert.strictEqual(error, reason);
+  }
+  assert.strictEqual(caught, true);
+  assert.deepStrictEqual(completed.next(), {
+    __proto__: null,
+    done: true,
+    value: undefined,
+  });
+}
+
+async function testSyncCancelIgnoresCleanupError() {
+  const reason = null;
+  const source = {
+    __proto__: null,
+    [Symbol.iterator]() {
+      let done = false;
+      return {
+        __proto__: null,
+        next() {
+          if (done) return { done: true, value: undefined };
+          done = true;
+          return { done: false, value: [Buffer.from('data')] };
+        },
+        get return() { throw new Error('cleanup failed'); },
+      };
+    },
+  };
+  const shared = shareSync(source);
+  const iterator = shared.pull()[Symbol.iterator]();
+
+  iterator.next();
+  shared.cancel(reason);
+
+  assert.strictEqual(shared.consumerCount, 0);
+  assert.throws(() => iterator.next(), (error) => error === reason);
+}
+
+async function testAsyncCancelIgnoresCleanupGetterError() {
+  const reason = null;
+  const source = {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      let done = false;
+      return {
+        __proto__: null,
+        next() {
+          if (done) return Promise.resolve({ done: true, value: undefined });
+          done = true;
+          return Promise.resolve({
+            done: false,
+            value: [Buffer.from('data')],
+          });
+        },
+        get return() { throw new Error('cleanup failed'); },
+      };
+    },
+  };
+  const shared = share(source);
+  const iterator = shared.pull()[Symbol.asyncIterator]();
+
+  await iterator.next();
+  shared.cancel(reason);
+
+  assert.strictEqual(shared.consumerCount, 0);
+  await assert.rejects(iterator.next(), (error) => error === reason);
+}
+
+// Async source preserves a non-Error thrown value.
 async function testShareSourceThrowsNonError() {
+  const reason = 'not an error';
   async function* source() {
     yield [new TextEncoder().encode('ok')];
-    throw 'not an error'; // eslint-disable-line no-throw-literal
+    throw reason;
   }
   const shared = share(source());
   const consumer = shared.pull();
   await assert.rejects(async () => {
     // eslint-disable-next-line no-unused-vars
     for await (const batch of consumer) { /* consume */ }
-  }, { code: 'ERR_OPERATION_FAILED' });
+  }, (error) => error === reason);
 }
 
-// Sync source throws non-Error value → wrapError
+// Sync source preserves a non-Error thrown value.
 async function testSyncShareSourceThrowsNonError() {
+  const reason = 42;
   function* source() {
     yield [new TextEncoder().encode('ok')];
-    throw 42; // eslint-disable-line no-throw-literal
+    throw reason;
   }
   const shared = shareSync(source());
   const consumer = shared.pull();
   assert.throws(() => {
     // eslint-disable-next-line no-unused-vars
     for (const batch of consumer) { /* consume */ }
-  }, { code: 'ERR_OPERATION_FAILED' });
+  }, (error) => error === reason);
 }
 
 Promise.all([
@@ -123,6 +213,9 @@ Promise.all([
   testSyncShareDispose(),
   testAsyncIteratorThrow(),
   testSyncIteratorThrow(),
+  testCompletedSyncConsumerStaysCompleted(),
+  testSyncCancelIgnoresCleanupError(),
+  testAsyncCancelIgnoresCleanupGetterError(),
   testShareSourceThrowsNonError(),
   testSyncShareSourceThrowsNonError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-to-readable.js b/test/parallel/test-stream-iter-to-readable.js
index d8287036e7e7..a58bf0087df5 100644
--- a/test/parallel/test-stream-iter-to-readable.js
+++ b/test/parallel/test-stream-iter-to-readable.js
@@ -16,13 +16,15 @@ const {
   toReadableSync,
 } = require('stream/iter');
 
+const kNeverResolves = new Promise(() => { });
+
 function collect(readable) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    readable.on('data', (chunk) => chunks.push(chunk));
-    readable.on('end', () => resolve(Buffer.concat(chunks)));
-    readable.on('error', reject);
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const chunks = [];
+  readable.on('data', (chunk) => chunks.push(chunk));
+  readable.on('end', () => resolve(Buffer.concat(chunks)));
+  readable.on('error', reject);
+  return promise;
 }
 
 // =============================================================================
@@ -105,6 +107,84 @@ async function testErrorAsync() {
   }, { message: 'source failed' });
 }
 
+async function testFalsyErrorAsync() {
+  for (const [reason, code] of [
+    [null, 'ERR_FALSY_VALUE_REJECTION'],
+    [{ __proto__: null }, 'ERR_OPERATION_FAILED'],
+  ]) {
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() { return Promise.reject(reason); },
+          return() { return Promise.resolve({ done: true }); },
+        };
+      },
+    };
+
+    await assert.rejects(collect(toReadable(source)), (error) => {
+      return error.code === code && error.reason === reason;
+    });
+  }
+}
+
+async function testFalsyThenableCleanupError() {
+  const reason = null;
+  const source = {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return {
+        __proto__: null,
+        next() { return kNeverResolves; },
+        return() {
+          return {
+            __proto__: null,
+            then(resolve, reject) { reject(reason); },
+          };
+        },
+      };
+    },
+  };
+  const readable = toReadable(source);
+  const { promise, resolve } = Promise.withResolvers();
+  readable.once('error', resolve);
+
+  readable.destroy();
+
+  const result = await promise;
+  assert.strictEqual(result.code, 'ERR_FALSY_VALUE_REJECTION');
+  assert.strictEqual(result.reason, reason);
+}
+
+async function testFalsyCleanupGetterErrors() {
+  for (const [symbol, create] of [
+    [Symbol.asyncIterator, toReadable],
+    [Symbol.iterator, toReadableSync],
+  ]) {
+    const reason = false;
+    const source = {
+      __proto__: null,
+      [symbol]() {
+        return {
+          __proto__: null,
+          next() { return kNeverResolves; },
+          get return() { throw reason; },
+        };
+      },
+    };
+    const readable = create(source);
+    const { promise, resolve } = Promise.withResolvers();
+    readable.once('error', resolve);
+
+    readable.destroy();
+
+    const result = await promise;
+    assert.strictEqual(result.code, 'ERR_FALSY_VALUE_REJECTION');
+    assert.strictEqual(result.reason, reason);
+  }
+}
+
 // =============================================================================
 // fromStreamIter: empty source
 // =============================================================================
@@ -155,16 +235,16 @@ async function testDestroyAsync() {
 
   // Read a couple chunks then destroy
   const chunks = [];
-  await new Promise((resolve, reject) => {
-    readable.on('data', (chunk) => {
-      chunks.push(chunk);
-      if (chunks.length >= 3) {
-        readable.destroy();
-      }
-    });
-    readable.on('close', resolve);
-    readable.on('error', reject);
+  const { promise, resolve, reject } = Promise.withResolvers();
+  readable.on('data', (chunk) => {
+    chunks.push(chunk);
+    if (chunks.length >= 3) {
+      readable.destroy();
+    }
   });
+  readable.on('close', resolve);
+  readable.on('error', reject);
+  await promise;
 
   assert.ok(chunks.length >= 3);
   assert.ok(returnCalled, 'iterator.return() should have been called');
@@ -190,15 +270,20 @@ async function testDestroyDuringBackpressure() {
   const readable = toReadable(gen(), { highWaterMark: 1 });
 
   // Read one chunk to start the pump, then destroy while it's waiting
-  const chunk = await new Promise((resolve) => {
+  {
+    const { promise, resolve } = Promise.withResolvers();
     readable.once('readable', () => resolve(readable.read()));
-  });
-  assert.ok(chunk);
+    assert.ok(await promise);
+  }
 
   // The pump should be waiting on backpressure now. Destroy the stream.
   readable.destroy();
 
-  await new Promise((resolve) => readable.on('close', resolve));
+  {
+    const { promise, resolve } = Promise.withResolvers();
+    readable.on('close', resolve);
+    await promise;
+  }
   assert.ok(readable.destroyed);
   assert.ok(returnCalled, 'iterator.return() should have been called');
 }
@@ -243,11 +328,11 @@ async function testPipeAsync() {
     },
   });
 
-  await new Promise((resolve, reject) => {
-    readable.pipe(writable);
-    writable.on('finish', resolve);
-    writable.on('error', reject);
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  readable.pipe(writable);
+  writable.on('finish', resolve);
+  writable.on('error', reject);
+  await promise;
 
   assert.strictEqual(Buffer.concat(chunks).toString(), 'pipe test data');
 }
@@ -472,6 +557,24 @@ async function testErrorSync() {
   }, { message: 'sync source failed' });
 }
 
+async function testFalsyErrorSync() {
+  const reason = false;
+  const source = {
+    __proto__: null,
+    [Symbol.iterator]() {
+      return {
+        __proto__: null,
+        next() { throw reason; },
+      };
+    },
+  };
+
+  await assert.rejects(collect(toReadableSync(source)), (error) => {
+    return error.code === 'ERR_FALSY_VALUE_REJECTION' &&
+           error.reason === reason;
+  });
+}
+
 // =============================================================================
 // fromStreamIterSync: empty source
 // =============================================================================
@@ -506,7 +609,9 @@ async function testDestroySync() {
   readable.read();  // Start iteration
   readable.destroy();
 
-  await new Promise((resolve) => readable.on('close', resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  readable.on('close', resolve);
+  await promise;
   assert.ok(returnCalled, 'iterator.return() should have been called');
 }
 
@@ -615,6 +720,9 @@ Promise.all([
   testMultiBatchAsync(),
   testBackpressureAsync(),
   testErrorAsync(),
+  testFalsyErrorAsync(),
+  testFalsyThenableCleanupError(),
+  testFalsyCleanupGetterErrors(),
   testEmptyAsync(),
   testEmptyBatchAsync(),
   testDestroyAsync(),
@@ -628,6 +736,7 @@ Promise.all([
   testBackpressureSync(),
   testBackpressureSyncMultiChunkBatch(),
   testErrorSync(),
+  testFalsyErrorSync(),
   testDestroySync(),
   testRoundTrip(),
   testRoundTripWithCompression(),
diff --git a/test/parallel/test-stream-iter-writable-from.js b/test/parallel/test-stream-iter-writable-from.js
index 46cfb627cb4a..5cf7371caa5a 100644
--- a/test/parallel/test-stream-iter-writable-from.js
+++ b/test/parallel/test-stream-iter-writable-from.js
@@ -6,6 +6,7 @@
 
 const common = require('../common');
 const assert = require('assert');
+const { setImmediate, setTimeout } = require('timers/promises');
 const {
   push,
   text,
@@ -28,6 +29,79 @@ async function testBasicWrite() {
   assert.strictEqual(result, 'hello world');
 }
 
+async function testFalsyWriterRejectionBecomesClassicError() {
+  const nonCoercible = { __proto__: null };
+  const trapped = new Proxy({}, {
+    getPrototypeOf() { throw new Error('unexpected coercion'); },
+  });
+  for (const [reason, code] of [
+    [null, 'ERR_FALSY_VALUE_REJECTION'],
+    [nonCoercible, 'ERR_OPERATION_FAILED'],
+    [trapped, 'ERR_OPERATION_FAILED'],
+  ]) {
+    let failed = false;
+    let failReason;
+    const writable = toWritable({
+      __proto__: null,
+      write() { return Promise.reject(reason); },
+      fail(error) { failed = true; failReason = error; },
+    });
+    writable.on('error', common.mustCall());
+
+    const { promise, resolve, reject } = Promise.withResolvers();
+    writable.write('data', common.mustCall((error) => {
+      for (const symbol of Object.getOwnPropertySymbols(error)) {
+        delete error[symbol];
+      }
+      if (error) reject(error);
+      else resolve();
+    }));
+
+    await assert.rejects(promise, (error) => {
+      return error.code === code && error.reason === reason;
+    });
+    await setImmediate();
+    assert.strictEqual(failed, true);
+    assert.strictEqual(failReason, reason);
+  }
+}
+
+async function testClassicWrapperReusePreservesErrorIdentity() {
+  const first = toWritable({
+    __proto__: null,
+    write() { return Promise.reject(null); },
+    fail() {},
+  });
+  first.on('error', common.mustCall());
+  let wrapper;
+  {
+    const { promise, resolve } = Promise.withResolvers();
+    first.write('first', common.mustCall((error) => {
+      wrapper = error;
+      resolve();
+    }));
+    await promise;
+  }
+
+  let failReason;
+  const second = toWritable({
+    __proto__: null,
+    write() { return Promise.reject(wrapper); },
+    fail(reason) { failReason = reason; },
+  });
+  second.on('error', common.mustCall());
+  {
+    const { promise, resolve } = Promise.withResolvers();
+    second.write('second', common.mustCall((error) => {
+      assert.strictEqual(error, wrapper);
+      resolve();
+    }));
+    await promise;
+  }
+  await setImmediate();
+  assert.strictEqual(failReason, wrapper);
+}
+
 // =============================================================================
 // _write delegates to writer.write()
 // =============================================================================
@@ -46,12 +120,12 @@ async function testWriteDelegatesToWriter() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve, reject) => {
-    writable.write('hello', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('hello', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await promise;
 
   assert.strictEqual(Buffer.concat(chunks).toString(), 'hello');
 }
@@ -86,7 +160,9 @@ async function testWritevDelegation() {
   writable.write('c');
   writable.uncork();
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   // Writev should have been called with the batched chunks
   assert.ok(batches.length > 0, 'writev should have been called');
@@ -129,9 +205,9 @@ async function testWriteSyncFirst() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => {
-    writable.write('test', resolve);
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('test', resolve);
+  await promise;
 
   assert.ok(syncCalled, 'writeSync should have been called');
   assert.ok(!asyncCalled, 'write should not have been called');
@@ -160,9 +236,9 @@ async function testWriteSyncFallback() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => {
-    writable.write('test', resolve);
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('test', resolve);
+  await promise;
 
   assert.ok(syncCalled, 'writeSync should have been called');
   assert.ok(asyncCalled, 'write should have been called as fallback');
@@ -191,7 +267,9 @@ async function testEndSyncFirst() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   assert.ok(endSyncCalled, 'endSync should have been called');
   assert.ok(!endAsyncCalled, 'end should not have been called');
@@ -220,7 +298,9 @@ async function testEndSyncFallback() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   assert.ok(endSyncCalled, 'endSync should have been called');
   assert.ok(endAsyncCalled, 'end should have been called as fallback');
@@ -243,7 +323,9 @@ async function testFinalDelegatesToEnd() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   assert.ok(endCalled, 'writer.end() should have been called');
 }
@@ -261,13 +343,13 @@ async function testDestroyDelegatesToFail() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});  // Prevent unhandled
+  writable.on('error', common.mustCall());
 
   const testErr = new Error('destroy test');
   writable.destroy(testErr);
 
   // Give a tick for destroy to propagate
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
 
   assert.strictEqual(failReason, testErr);
 }
@@ -286,13 +368,14 @@ async function testWriteErrorPropagation() {
   };
 
   const writable = toWritable(writer);
-
-  await assert.rejects(new Promise((resolve, reject) => {
-    writable.write('data', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  }), { message: 'write failed' });
+  writable.on('error', common.mustCall());
+
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('data', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await assert.rejects(promise, { message: 'write failed' });
 }
 
 // =============================================================================
@@ -343,12 +426,12 @@ async function testPushWriterBlockBackpressureNoDuplicate() {
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   const writable = toWritable(writer);
 
-  await new Promise((resolve, reject) => {
-    writable.write('a', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('a', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await promise;
 
   writable.write('b');
   writable.end();
@@ -365,12 +448,12 @@ async function testPushWriterBlockBackpressureWritevNoDuplicate() {
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   const writable = toWritable(writer);
 
-  await new Promise((resolve, reject) => {
-    writable.write('a', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('a', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await promise;
 
   writable.cork();
   writable.write('b');
@@ -423,16 +506,14 @@ async function testSyncCallbackDeferred() {
 
   const writable = toWritable(writer);
 
-  const p = new Promise((resolve) => {
-    writable.write('test', () => {
-      callbackTick = true;
-      resolve();
-    });
-    // Callback should NOT have fired synchronously
-    assert.strictEqual(callbackTick, false);
-  });
-
-  await p;
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('test', common.mustCall(() => {
+    callbackTick = true;
+    resolve();
+  }));
+  // Callback should NOT have fired synchronously
+  assert.strictEqual(callbackTick, false);
+  await promise;
   assert.strictEqual(callbackTick, true);
 }
 
@@ -452,10 +533,10 @@ async function testMinimalWriter() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => {
-    writable.write('minimal');
-    writable.end(resolve);
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('minimal');
+  writable.end(resolve);
+  await promise;
 
   assert.strictEqual(Buffer.concat(chunks).toString(), 'minimal');
 }
@@ -474,7 +555,7 @@ async function testDestroyWithoutError() {
   const writable = toWritable(writer);
   writable.destroy();
 
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
 
   assert.ok(!failCalled, 'fail should not be called on clean destroy');
 }
@@ -491,12 +572,12 @@ async function testDestroyWithError() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});
+  writable.on('error', common.mustCall());
 
   const err = new Error('test');
   writable.destroy(err);
 
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
 
   assert.strictEqual(failReason, err);
 }
@@ -512,12 +593,12 @@ async function testDestroyWithoutFail() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});
+  writable.on('error', common.mustCall());
 
   // Should not throw even though writer has no fail()
   writable.destroy(new Error('test'));
 
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
   assert.ok(writable.destroyed);
 }
 
@@ -553,13 +634,14 @@ async function testWriteSyncThrowsPropagation() {
   };
 
   const writable = toWritable(writer);
-
-  await assert.rejects(new Promise((resolve, reject) => {
-    writable.write('test', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  }), { message: 'sync broken' });
+  writable.on('error', common.mustCall());
+
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('test', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await assert.rejects(promise, { message: 'sync broken' });
 }
 
 // =============================================================================
@@ -575,13 +657,15 @@ async function testWriteThrowsSyncPropagation() {
   };
 
   const writable = toWritable(writer);
+  writable.on('error', common.mustCall());
 
-  await assert.rejects(new Promise((resolve, reject) => {
-    writable.write('data', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  }), { message: 'sync throw from write' });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('data', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+
+  await assert.rejects(promise, { message: 'sync throw from write' });
 }
 
 // =============================================================================
@@ -598,15 +682,16 @@ async function testEndThrowsSyncPropagation() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});
+  writable.on('error', common.mustCall());
 
-  await new Promise((resolve) => {
-    writable.end(common.mustCall((err) => {
-      assert.ok(err);
-      assert.strictEqual(err.message, 'sync throw from end');
-      resolve();
-    }));
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(common.mustCall((err) => {
+    assert.ok(err);
+    assert.strictEqual(err.message, 'sync throw from end');
+    resolve();
+  }));
+
+  await promise;
 }
 
 // =============================================================================
@@ -619,6 +704,8 @@ testHighWaterMarkIsMaxSafeInt();
 
 Promise.all([
   testBasicWrite(),
+  testFalsyWriterRejectionBecomesClassicError(),
+  testClassicWrapperReusePreservesErrorIdentity(),
   testWriteDelegatesToWriter(),
   testWritevDelegation(),
   testWriteSyncFirst(),
diff --git a/test/parallel/test-stream-iter-writable-interop.js b/test/parallel/test-stream-iter-writable-interop.js
index a8ae0a99cad7..9940ffc34c93 100644
--- a/test/parallel/test-stream-iter-writable-interop.js
+++ b/test/parallel/test-stream-iter-writable-interop.js
@@ -7,6 +7,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { Writable } = require('stream');
+const { setImmediate } = require('timers/promises');
 const {
   from,
   fromWritable,
@@ -356,7 +357,7 @@ async function testEndReturnsByteCount() {
 
 async function testFail() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
-  writable.on('error', () => {});  // Prevent unhandled error
+  writable.on('error', common.mustCall());
   const writer = fromWritable(writable);
 
   writer.fail(new Error('test fail'));
@@ -496,6 +497,7 @@ async function testPipeToWithTransform() {
 
 async function testDispose() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
+  writable.on('error', common.mustCall());
   const writer = fromWritable(writable);
 
   writer[Symbol.dispose]();
@@ -504,6 +506,7 @@ async function testDispose() {
 
 async function testAsyncDispose() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
+  writable.on('error', common.mustCall());
   const writer = fromWritable(writable);
 
   await writer[Symbol.asyncDispose]();
@@ -581,7 +584,7 @@ async function testFailRejectsPendingWaiters() {
       // Never call cb -- stuck
     },
   });
-  writable.on('error', () => {});  // Prevent unhandled error
+  writable.on('error', common.mustCall());
 
   const writer = fromWritable(writable, { backpressure: 'unbounded' });
 
@@ -594,6 +597,58 @@ async function testFailRejectsPendingWaiters() {
   await assert.rejects(writePromise, { message: 'fail reason' });
 }
 
+async function testFailPreservesReason() {
+  let classicError;
+  const writable = new Writable({
+    highWaterMark: 1,
+    write() {},
+  });
+  writable.on('error', common.mustCall((error) => { classicError = error; }));
+  const writer = fromWritable(writable, { backpressure: 'unbounded' });
+  const pending = writer.write('blocked data');
+  const draining = ondrain(writer);
+
+  writer.fail(null);
+
+  await assert.rejects(pending, (reason) => reason === null);
+  await assert.rejects(draining, (reason) => reason === null);
+  await assert.rejects(writer.write('more'), (reason) => reason === null);
+  await assert.rejects(writer.end(), (reason) => reason === null);
+  await setImmediate();
+  assert.strictEqual(classicError.code, 'ERR_FALSY_VALUE_REJECTION');
+  assert.strictEqual(classicError.reason, null);
+}
+
+async function testEndThrowPreservesReason() {
+  const reason = undefined;
+  const writable = new Writable({
+    write(chunk, encoding, callback) { callback(); },
+  });
+  writable.on('error', common.mustCall());
+  writable.end = () => { throw reason; };
+  const writer = fromWritable(writable);
+
+  await assert.rejects(writer.end(), (error) => error === reason);
+  await assert.rejects(writer.write('more'), (error) => error === reason);
+}
+
+async function testFailWhileClosingPreservesReason() {
+  let finish;
+  const writable = new Writable({
+    write(chunk, encoding, callback) { callback(); },
+    final(callback) { finish = callback; },
+  });
+  writable.on('error', common.mustCall());
+  const writer = fromWritable(writable);
+  const ending = writer.end();
+
+  writer.fail(false);
+
+  await assert.rejects(ending, (reason) => reason === false);
+  await assert.rejects(writer.write('more'), (reason) => reason === false);
+  finish();
+}
+
 // =============================================================================
 // dispose rejects pending block waiters
 // =============================================================================
@@ -605,6 +660,7 @@ async function testDisposeRejectsPendingWaiters() {
       // Never call cb -- stuck
     },
   });
+  writable.on('error', common.mustCall());
 
   const writer = fromWritable(writable, { backpressure: 'unbounded' });
 
@@ -613,7 +669,7 @@ async function testDisposeRejectsPendingWaiters() {
 
   writer[Symbol.dispose]();
 
-  await assert.rejects(writePromise, { name: 'AbortError' });
+  await assert.rejects(writePromise, (reason) => reason === undefined);
 }
 
 // =============================================================================
@@ -672,5 +728,8 @@ Promise.all([
   testAsyncDispose(),
   testWriteInvalidChunkType(),
   testFailRejectsPendingWaiters(),
+  testFailPreservesReason(),
+  testFailWhileClosingPreservesReason(),
+  testEndThrowPreservesReason(),
   testDisposeRejectsPendingWaiters(),
 ]).then(common.mustCall());

From 9afe7dc6adee42be854f839c1ab9521dbe4d699b Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Mon, 7 Sep 2026 11:54:53 +0200
Subject: [PATCH 185/202] 2026-09-08, Version 24.21.0 'Krypton' (LTS)

Notable changes:

crypto:
  * update root certificates to NSS 3.126 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/65495
  * (SEMVER-MINOR) support loading private keys through STORE loaders (Filip Skokan) https://github.com/nodejs/node/pull/63949
deps:
  * update OpenSSL to 3.5.8 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/65542
  * update Undici to 7.29.1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/65789
lib,src:
  * (SEMVER-MINOR) improve histogram implementation (James M Snell) https://github.com/nodejs/node/pull/65024
net:
  * (SEMVER-MINOR) improve performance of `net.BlockList` (James M Snell) https://github.com/nodejs/node/pull/64974
perf_hooks:
  * (SEMVER-MINOR) add statistical hypothesis testing to histogram (James M Snell) https://github.com/nodejs/node/pull/65416
util:
  * (SEMVER-MINOR) add non-throwing `MIMEType.parse` (James M Snell) https://github.com/nodejs/node/pull/64965

PR-URL: https://github.com/nodejs/node/pull/65873
---
 CHANGELOG.md                    |   3 +-
 doc/api/buffer.md               |   6 +-
 doc/api/cli.md                  |   4 +-
 doc/api/crypto.md               |   4 +-
 doc/api/fs.md                   |   6 +-
 doc/api/net.md                  |  40 +++--
 doc/api/perf_hooks.md           |  78 +++++++---
 doc/api/sqlite.md               |  68 ++++++---
 doc/api/tty.md                  |   8 +-
 doc/api/util.md                 |   4 +-
 doc/changelogs/CHANGELOG_V24.md | 256 ++++++++++++++++++++++++++++++++
 11 files changed, 420 insertions(+), 57 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72a9d331c098..df831a89bc5a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -55,7 +55,8 @@ release.
 <a href="doc/changelogs/CHANGELOG_V26.md#26.0.0">26.0.0</a><br/>
   </td>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V24.md#24.20.0">24.20.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V24.md#24.21.0">24.21.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V24.md#24.20.0">24.20.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.19.0">24.19.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.18.1">24.18.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.18.0">24.18.0</a><br/>
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index a78254919ff9..f7c73d6b6377 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5345,7 +5345,8 @@ added:
   - v19.6.0
   - v18.15.0
 changes:
-  - version: v26.8.0
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64504
     description: Detached `ArrayBuffer`s and views backed by them are treated
                  as empty.
@@ -5366,7 +5367,8 @@ added:
   - v19.4.0
   - v18.14.0
 changes:
-  - version: v26.8.0
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64504
     description: Detached `ArrayBuffer`s and views backed by them are treated
                  as empty.
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 2fbbac6cd510..41f9d6534f81 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -384,7 +384,9 @@ Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --a
 ### `--allow-openssl-store`
 
 <!-- YAML
-added: v26.7.0
+added:
+ - v26.7.0
+ - v24.21.0
 -->
 
 > Stability: 1.1 - Active development
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index a08519a57688..c95104f4e16e 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -4225,7 +4225,9 @@ require options or a key with provider-specific properties.
 <!-- YAML
 added: v11.6.0
 changes:
-  - version: v26.7.0
+  - version:
+     - v26.7.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63949
     description: The key can also be a URL referencing an object for an
                  OpenSSL STORE loader. The `properties` option was added.
diff --git a/doc/api/fs.md b/doc/api/fs.md
index 5955cfe0bf01..461ea5438c26 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -2985,7 +2985,8 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v0.1.31
 changes:
-  - version: v26.8.0
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63851
     description: Add the `windowsHandle` option.
   - version: v16.10.0
@@ -3122,7 +3123,8 @@ If `options` is a string, then it specifies the encoding.
 <!-- YAML
 added: v0.1.31
 changes:
-  - version: v26.8.0
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63851
     description: Add the `windowsHandle` option.
   - version: v22.0.0
diff --git a/doc/api/net.md b/doc/api/net.md
index de13e601b69b..f6fac2b6932a 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -99,7 +99,9 @@ Adds a rule to block the given IP address.
 ### `blockList.addAddresses(addresses[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `addresses` {string\[]|net.SocketAddress\[]} An array of IPv4 or IPv6
@@ -114,7 +116,9 @@ are inserted under a single internal lock acquisition.
 ### `blockList.addCIDR(cidr)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
@@ -128,7 +132,9 @@ the parsed network address, prefix length, and family.
 ### `blockList.addCIDRs(cidrs)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `cidrs` {string\[]} An array of IPv4 or IPv6 subnets in CIDR notation.
@@ -202,7 +208,9 @@ console.log(blockList.check('::ffff:123.123.123.123', 'ipv6')); // Prints: true
 ### `blockList.clear()`
 
 <!--
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 Clears all rules from the `BlockList`.
@@ -245,7 +253,9 @@ added:
 ### `BlockList.PRIVATE_RANGES`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {string\[]}
@@ -277,7 +287,9 @@ console.log(blockList.check('8.8.8.8'));       // Prints: false
 ### `blockList.removeAddress(address[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `address` {string|net.SocketAddress} An IPv4 or IPv6 address.
@@ -290,7 +302,9 @@ specified address does not exist, this is a no-op.
 ### `blockList.removeCIDR(cidr)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
@@ -304,7 +318,9 @@ and family. If the specified subnet does not exist, this is a no-op.
 ### `blockList.removeRange(start, end[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `start` {string|net.SocketAddress} The starting IPv4 or IPv6 address in the
@@ -319,7 +335,9 @@ If the specified range does not exist, this is a no-op.
 ### `blockList.removeSubnet(net, prefix[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `net` {string|net.SocketAddress} The network IPv4 or IPv6 address.
@@ -347,7 +365,9 @@ The list of rules added to the blocklist.
 ### `blockList.size`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 8df9716fa732..8926fc0a16ec 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1964,7 +1964,9 @@ added: v11.10.0
 ### `histogram.burnRate(sloTarget)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `sloTarget` {number} The SLO target as a fraction between 0 and 1
@@ -2019,7 +2021,9 @@ The number of samples recorded by the histogram.
 ### `histogram.ccdf(value)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `value` {number} The value to query.
@@ -2032,7 +2036,9 @@ will exceed `value`. Equivalent to `1 - histogram.cdf(value)`.
 ### `histogram.cdf(value)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `value` {number} The value to query.
@@ -2046,7 +2052,9 @@ than or equal to `value`. This is the inverse operation of
 ### `histogram.cliffsD(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2061,7 +2069,9 @@ opposite; 0 means no tendency in either direction.
 ### `histogram.cohensD(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2076,7 +2086,9 @@ Both histograms must have at least 2 recorded values; otherwise returns 0.
 ### `histogram.countAt(value)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `value` {number} The value to query.
@@ -2112,7 +2124,7 @@ loop delay threshold.
 ### `histogram.export()`
 
 <!-- YAML
-added: REPLACEME
+added: v24.21.0
 -->
 
 * Returns: {Uint8Array}
@@ -2161,7 +2173,9 @@ Returns `0` when EWMA is disabled or no values have been recorded.
 ### `histogram.ewmaStddev`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2173,7 +2187,9 @@ when EWMA is disabled or no values have been recorded.
 ### `histogram.ewmaErrorRate`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2186,7 +2202,9 @@ recorded.
 ### `histogram.ksTest(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2200,7 +2218,9 @@ detecting performance regressions by comparing before/after histograms.
 ### `histogram.kurtosis`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2213,7 +2233,9 @@ lighter tails.
 ### `histogram.linearBuckets(stepSize)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `stepSize` {number} The width of each linear bucket.
@@ -2225,7 +2247,9 @@ of `stepSize`. Useful for visualization and export.
 ### `histogram.logBuckets(firstBucket, base)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `firstBucket` {number} The value of the first bucket boundary.
@@ -2239,7 +2263,9 @@ Useful for visualization and export.
 ### `histogram.mannWhitneyTest(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2370,7 +2396,9 @@ Returns the value at the given percentile.
 ### `histogram.percentileCI(percentile[, options])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `percentile` {number} A percentile value in the range (0, 100].
@@ -2426,7 +2454,9 @@ Returns a `Map` object detailing the accumulated percentile distribution.
 ### `histogram.percentilesAt(percentiles)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `percentiles` {number\[]} An array of percentile values in the range (0, 100].
@@ -2448,7 +2478,9 @@ Resets the collected histogram data.
 ### `histogram.skewness`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2471,7 +2503,9 @@ The standard deviation of the recorded event loop delays.
 ### `histogram.welchTest(other[, options])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2587,7 +2621,9 @@ previous call to `recordDelta()` and records that amount in the histogram.
 ### `histogram.recordCorrected(val, expectedInterval)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `val` {number|bigint} The value to record.
@@ -2602,7 +2638,9 @@ latency.
 ### `histogram.subtract(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {RecordableHistogram}
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 8a3480060173..36804b060e80 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -715,7 +715,9 @@ changes:
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62757
     description: Add the `persistent` option.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/65157
     description: Throw `ERR_INVALID_ARG_VALUE` if `sql` contains no statements.
 -->
@@ -1111,10 +1113,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1203,10 +1209,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1242,10 +1252,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1290,10 +1304,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1478,10 +1496,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
@@ -1507,10 +1529,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
@@ -1536,10 +1562,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
@@ -1564,10 +1594,14 @@ changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65709
     description: Bind `undefined` to `NULL`.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
diff --git a/doc/api/tty.md b/doc/api/tty.md
index 5af3c454fe2f..8fee96bb4c6d 100644
--- a/doc/api/tty.md
+++ b/doc/api/tty.md
@@ -70,7 +70,9 @@ A `boolean` that is always `true` for `tty.ReadStream` instances.
 <!-- YAML
 added: v0.7.7
 changes:
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64140
     description: The `mode` argument supports `'raw'` and `'io'`.
 -->
@@ -104,7 +106,9 @@ Windows.
 ### `readStream.rawMode`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * {boolean|string}
diff --git a/doc/api/util.md b/doc/api/util.md
index 52e2c06b09ff..81ccff315d1a 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -1910,7 +1910,9 @@ console.log(JSON.stringify(myMIMES));
 ### `MIMEType.parse(string)`
 
 <!--
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `string` {string} The input MIME to parse
diff --git a/doc/changelogs/CHANGELOG_V24.md b/doc/changelogs/CHANGELOG_V24.md
index 912abaabc33b..b8bc22c8c5ad 100644
--- a/doc/changelogs/CHANGELOG_V24.md
+++ b/doc/changelogs/CHANGELOG_V24.md
@@ -9,6 +9,7 @@
 </tr>
 <tr>
 <td>
+<a href="#24.21.0">24.21.0</a><br/>
 <a href="#24.20.0">24.20.0</a><br/>
 <a href="#24.19.0">24.19.0</a><br/>
 <a href="#24.18.1">24.18.1</a><br/>
@@ -71,6 +72,261 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="24.21.0"></a>
+
+## 2026-09-08, Version 24.21.0 'Krypton' (LTS), @aduh95
+
+### Notable Changes
+
+* \[[`71106e1f17`](https://github.com/nodejs/node/commit/71106e1f17)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
+* \[[`afca0a912d`](https://github.com/nodejs/node/commit/afca0a912d)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](https://github.com/nodejs/node/pull/63949)
+* \[[`6274fccbd9`](https://github.com/nodejs/node/commit/6274fccbd9)] - **deps**: update OpenSSL to 3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`53cba013c7`](https://github.com/nodejs/node/commit/53cba013c7)] - **deps**: update Undici to 7.29.1 (Node.js GitHub Bot) [#65789](https://github.com/nodejs/node/pull/65789)
+* \[[`0529772798`](https://github.com/nodejs/node/commit/0529772798)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
+* \[[`41c7062b81`](https://github.com/nodejs/node/commit/41c7062b81)] - **(SEMVER-MINOR)** **net**: improve performance of `net.BlockList` (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
+* \[[`5197b5a3c5`](https://github.com/nodejs/node/commit/5197b5a3c5)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`35c635b032`](https://github.com/nodejs/node/commit/35c635b032)] - **(SEMVER-MINOR)** **util**: add non-throwing `MIMEType.parse` (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
+
+### Commits
+
+* \[[`84d706cb9b`](https://github.com/nodejs/node/commit/84d706cb9b)] - **assert**: improve documentation wording (Kamal Rawal) [#64953](https://github.com/nodejs/node/pull/64953)
+* \[[`90d127db33`](https://github.com/nodejs/node/commit/90d127db33)] - **(SEMVER-MINOR)** **benchmark**: add --analyze mode to compare.js (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`ad1d7884c3`](https://github.com/nodejs/node/commit/ad1d7884c3)] - **benchmark**: add test-only and mock timers cases (Luan Muniz) [#64097](https://github.com/nodejs/node/pull/64097)
+* \[[`1d8f045914`](https://github.com/nodejs/node/commit/1d8f045914)] - **benchmark**: apply `highWaterMark` in webstreams `pipe-to` (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`ed7ba3c993`](https://github.com/nodejs/node/commit/ed7ba3c993)] - **benchmark**: complete the sqlite is-transaction fix (Edy Silva) [#65218](https://github.com/nodejs/node/pull/65218)
+* \[[`c8837e1aa3`](https://github.com/nodejs/node/commit/c8837e1aa3)] - **benchmark**: add test runner hooks and options (Luan Muniz) [#63754](https://github.com/nodejs/node/pull/63754)
+* \[[`2ba8661e23`](https://github.com/nodejs/node/commit/2ba8661e23)] - **buffer**: prevent string write offset overflow (Matteo Collina) [#65043](https://github.com/nodejs/node/pull/65043)
+* \[[`cc9ee6c2ae`](https://github.com/nodejs/node/commit/cc9ee6c2ae)] - **buffer**: treat detached ArrayBuffers as empty (Archkon) [#64504](https://github.com/nodejs/node/pull/64504)
+* \[[`5a5d73e4c5`](https://github.com/nodejs/node/commit/5a5d73e4c5)] - **build**: pass target architecture to small-icu genccode (ulofiai) [#65095](https://github.com/nodejs/node/pull/65095)
+* \[[`273e72d1a5`](https://github.com/nodejs/node/commit/273e72d1a5)] - **build**: deprecate always enabled `--enable-static` (Chengzhong Wu) [#65103](https://github.com/nodejs/node/pull/65103)
+* \[[`89a67246e3`](https://github.com/nodejs/node/commit/89a67246e3)] - **build**: check FIPS option value in node.gyp (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`2d21f41cd5`](https://github.com/nodejs/node/commit/2d21f41cd5)] - **build**: handle malformed OpenSSL macros (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`f62bc0f862`](https://github.com/nodejs/node/commit/f62bc0f862)] - **build,win**: add PGO workload scripts (Stefan Stojanovic) [#63696](https://github.com/nodejs/node/pull/63696)
+* \[[`33d0c7dc12`](https://github.com/nodejs/node/commit/33d0c7dc12)] - **child\_process**: keep SIGWINCH from killing on Win (Kirill Saied) [#64510](https://github.com/nodejs/node/pull/64510)
+* \[[`71106e1f17`](https://github.com/nodejs/node/commit/71106e1f17)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
+* \[[`419af8b86d`](https://github.com/nodejs/node/commit/419af8b86d)] - **crypto**: fix missing error checks on ASN1\_STRING\_to\_UTF8() (Nora Dossche) [#65200](https://github.com/nodejs/node/pull/65200)
+* \[[`8029383f3f`](https://github.com/nodejs/node/commit/8029383f3f)] - **crypto**: use available BoringSSL APIs (Filip Skokan) [#65423](https://github.com/nodejs/node/pull/65423)
+* \[[`a9bd780e19`](https://github.com/nodejs/node/commit/a9bd780e19)] - **crypto**: remove obsolete BoringSSL shims (Filip Skokan) [#65423](https://github.com/nodejs/node/pull/65423)
+* \[[`7defefad3f`](https://github.com/nodejs/node/commit/7defefad3f)] - **crypto**: read WebCrypto inputs through primordials (Filip Skokan) [#65115](https://github.com/nodejs/node/pull/65115)
+* \[[`6ed1e38627`](https://github.com/nodejs/node/commit/6ed1e38627)] - **crypto**: fix disabling FIPS mode (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`afca0a912d`](https://github.com/nodejs/node/commit/afca0a912d)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](https://github.com/nodejs/node/pull/63949)
+* \[[`9b9dd6e9cf`](https://github.com/nodejs/node/commit/9b9dd6e9cf)] - **debugger**: wait for target startup (Filip Skokan) [#65194](https://github.com/nodejs/node/pull/65194)
+* \[[`07faaeeffd`](https://github.com/nodejs/node/commit/07faaeeffd)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`53cba013c7`](https://github.com/nodejs/node/commit/53cba013c7)] - **deps**: update undici to 7.29.1 (Node.js GitHub Bot) [#65789](https://github.com/nodejs/node/pull/65789)
+* \[[`0268ca547c`](https://github.com/nodejs/node/commit/0268ca547c)] - **deps**: update archs files for openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`6274fccbd9`](https://github.com/nodejs/node/commit/6274fccbd9)] - **deps**: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`6bdcd121fa`](https://github.com/nodejs/node/commit/6bdcd121fa)] - **deps**: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) [#65316](https://github.com/nodejs/node/pull/65316)
+* \[[`c2aa446b6d`](https://github.com/nodejs/node/commit/c2aa446b6d)] - **deps**: update simdjson to 4.6.7 (Node.js GitHub Bot) [#65318](https://github.com/nodejs/node/pull/65318)
+* \[[`3e58e48ea8`](https://github.com/nodejs/node/commit/3e58e48ea8)] - **deps**: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) [#65317](https://github.com/nodejs/node/pull/65317)
+* \[[`670b3665c0`](https://github.com/nodejs/node/commit/670b3665c0)] - **deps**: cherry-pick libuv/libuv\@e640dc9 (ulofiai) [#65118](https://github.com/nodejs/node/pull/65118)
+* \[[`ca1c67b021`](https://github.com/nodejs/node/commit/ca1c67b021)] - **deps**: float ICU-23262 patch for icu78 (René) [#64678](https://github.com/nodejs/node/pull/64678)
+* \[[`4ad043b0aa`](https://github.com/nodejs/node/commit/4ad043b0aa)] - **deps**: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) [#65136](https://github.com/nodejs/node/pull/65136)
+* \[[`96b4af109b`](https://github.com/nodejs/node/commit/96b4af109b)] - **deps**: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) [#65153](https://github.com/nodejs/node/pull/65153)
+* \[[`774f663c56`](https://github.com/nodejs/node/commit/774f663c56)] - **dgram**: don't swallow bind errors when callback is provided (armanmikoyan) [#62602](https://github.com/nodejs/node/pull/62602)
+* \[[`94b118d62e`](https://github.com/nodejs/node/commit/94b118d62e)] - **diagnostics\_channel**: validate before channel activation (Trivikram Kamat) [#65313](https://github.com/nodejs/node/pull/65313)
+* \[[`09788665bd`](https://github.com/nodejs/node/commit/09788665bd)] - **dns**: validate address type in lookupService (Lazizbek Ergashev) [#64878](https://github.com/nodejs/node/pull/64878)
+* \[[`15f95fc0e2`](https://github.com/nodejs/node/commit/15f95fc0e2)] - **dns**: validate port range in `setServers()` (René) [#65021](https://github.com/nodejs/node/pull/65021)
+* \[[`37b9e9a154`](https://github.com/nodejs/node/commit/37b9e9a154)] - **dns**: fix crash on setServers with port 0 (Lazizbek Ergashev) [#65009](https://github.com/nodejs/node/pull/65009)
+* \[[`cd6205fa0d`](https://github.com/nodejs/node/commit/cd6205fa0d)] - **doc**: update AHAFS reference link (Taeuk Ha) [#65481](https://github.com/nodejs/node/pull/65481)
+* \[[`0e6f9ae42e`](https://github.com/nodejs/node/commit/0e6f9ae42e)] - **doc**: fix property names in os.networkInterfaces() example (Jihwan) [#65469](https://github.com/nodejs/node/pull/65469)
+* \[[`034a827b41`](https://github.com/nodejs/node/commit/034a827b41)] - **doc**: fix broken links in cli.md (Donghoon Kang) [#65412](https://github.com/nodejs/node/pull/65412)
+* \[[`eb364621d4`](https://github.com/nodejs/node/commit/eb364621d4)] - **doc**: remove outdated WASI version fallback (이혜미) [#65303](https://github.com/nodejs/node/pull/65303)
+* \[[`b13f425bf8`](https://github.com/nodejs/node/commit/b13f425bf8)] - **doc**: fix broken GYP link in n-api.md (Donghoon Kang) [#65413](https://github.com/nodejs/node/pull/65413)
+* \[[`45c4011067`](https://github.com/nodejs/node/commit/45c4011067)] - **doc**: document that an empty OPENSSL\_CONF skips config loading (Orgad Shaneh) [#64949](https://github.com/nodejs/node/pull/64949)
+* \[[`fde6776c5f`](https://github.com/nodejs/node/commit/fde6776c5f)] - **doc**: fix broken TLS security level example (soreavis) [#65391](https://github.com/nodejs/node/pull/65391)
+* \[[`290c1fec04`](https://github.com/nodejs/node/commit/290c1fec04)] - **doc**: clarify socket destroyed behavior (Dayun) [#65395](https://github.com/nodejs/node/pull/65395)
+* \[[`a7e8269947`](https://github.com/nodejs/node/commit/a7e8269947)] - **doc**: update outdated nodejs.org guide links (Donghoon Kang) [#65394](https://github.com/nodejs/node/pull/65394)
+* \[[`7809f11249`](https://github.com/nodejs/node/commit/7809f11249)] - **doc**: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) [#62117](https://github.com/nodejs/node/pull/62117)
+* \[[`64cd3a6e95`](https://github.com/nodejs/node/commit/64cd3a6e95)] - **doc**: clarify how fs.Dirent file types are determined (soreavis) [#64532](https://github.com/nodejs/node/pull/64532)
+* \[[`9b92fdce14`](https://github.com/nodejs/node/commit/9b92fdce14)] - **doc**: update security release prepare command (Rafael Gonzaga) [#64699](https://github.com/nodejs/node/pull/64699)
+* \[[`6f9b9df3c1`](https://github.com/nodejs/node/commit/6f9b9df3c1)] - **doc**: clarify copyFile symlink behavior (T) [#62941](https://github.com/nodejs/node/pull/62941)
+* \[[`2480acb550`](https://github.com/nodejs/node/commit/2480acb550)] - **doc**: document setRawMode write access on Windows (Erik Demaine) [#63856](https://github.com/nodejs/node/pull/63856)
+* \[[`a1e9c3a5db`](https://github.com/nodejs/node/commit/a1e9c3a5db)] - **doc**: add missing return types in fs.md (Chaseton Collins) [#65307](https://github.com/nodejs/node/pull/65307)
+* \[[`4533572040`](https://github.com/nodejs/node/commit/4533572040)] - **doc**: add missing return types in buffer.md (Yuya Inoue) [#65308](https://github.com/nodejs/node/pull/65308)
+* \[[`39ecedbbd2`](https://github.com/nodejs/node/commit/39ecedbbd2)] - **doc**: fix lint clean command (greenhead) [#65274](https://github.com/nodejs/node/pull/65274)
+* \[[`0b1fb8fcd8`](https://github.com/nodejs/node/commit/0b1fb8fcd8)] - **doc**: fix typo in onboarding.md (서울민트초코) [#65295](https://github.com/nodejs/node/pull/65295)
+* \[[`3165b5d38a`](https://github.com/nodejs/node/commit/3165b5d38a)] - **doc**: add missing `added:` tags to `fs.lchmod` (Lazizbek Ergashev) [#65283](https://github.com/nodejs/node/pull/65283)
+* \[[`113b808e59`](https://github.com/nodejs/node/commit/113b808e59)] - **doc**: fix SQLite changeset constant descriptions (greenhead) [#65265](https://github.com/nodejs/node/pull/65265)
+* \[[`c3eb51d5a1`](https://github.com/nodejs/node/commit/c3eb51d5a1)] - **doc**: document open pull request limit (Matteo Collina) [#65250](https://github.com/nodejs/node/pull/65250)
+* \[[`d7accdcd52`](https://github.com/nodejs/node/commit/d7accdcd52)] - **doc**: document http2 header constants (Harjoth Khara) [#64548](https://github.com/nodejs/node/pull/64548)
+* \[[`f47111416f`](https://github.com/nodejs/node/commit/f47111416f)] - **doc**: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) [#62105](https://github.com/nodejs/node/pull/62105)
+* \[[`c3b120e737`](https://github.com/nodejs/node/commit/c3b120e737)] - **doc**: update synopsis (Augustin Mauroy) [#65171](https://github.com/nodejs/node/pull/65171)
+* \[[`39f4c831fd`](https://github.com/nodejs/node/commit/39f4c831fd)] - **doc**: fix broken internal links (greenhead) [#64901](https://github.com/nodejs/node/pull/64901)
+* \[[`be25cdd69e`](https://github.com/nodejs/node/commit/be25cdd69e)] - **doc**: report proper return type on urlPattern.test (Brian Muenzenmeyer) [#64831](https://github.com/nodejs/node/pull/64831)
+* \[[`1bf7737810`](https://github.com/nodejs/node/commit/1bf7737810)] - **doc**: fix permission documentation examples (greenhead) [#64897](https://github.com/nodejs/node/pull/64897)
+* \[[`b7932e68a1`](https://github.com/nodejs/node/commit/b7932e68a1)] - **doc**: document sqlite parameter binding (Guilherme Araújo) [#65089](https://github.com/nodejs/node/pull/65089)
+* \[[`5234a5169c`](https://github.com/nodejs/node/commit/5234a5169c)] - **doc**: finalize statements in sqlite examples (Guilherme Araújo) [#65088](https://github.com/nodejs/node/pull/65088)
+* \[[`39ea929da7`](https://github.com/nodejs/node/commit/39ea929da7)] - **doc**: document quic stopSending() and resetStream() (Issac) [#64888](https://github.com/nodejs/node/pull/64888)
+* \[[`2ba198db73`](https://github.com/nodejs/node/commit/2ba198db73)] - **doc**: clarify sqlite bare parameter default (Sumit Kumar Das) [#62009](https://github.com/nodejs/node/pull/62009)
+* \[[`314f9b200f`](https://github.com/nodejs/node/commit/314f9b200f)] - **doc**: remove usage of `util.inherits` (Augustin Mauroy) [#60817](https://github.com/nodejs/node/pull/60817)
+* \[[`d82a61662c`](https://github.com/nodejs/node/commit/d82a61662c)] - **doc**: fix grammar in worker\_threads.md (이혜미) [#64913](https://github.com/nodejs/node/pull/64913)
+* \[[`44c0c8ff5b`](https://github.com/nodejs/node/commit/44c0c8ff5b)] - **doc**: clarify OpenSSL FIPS configuration (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`9b2ca70e0d`](https://github.com/nodejs/node/commit/9b2ca70e0d)] - **doc**: remove `--expose-gc` flag from CLI documentation (Dario Piotrowicz) [#58909](https://github.com/nodejs/node/pull/58909)
+* \[[`a0a12397b9`](https://github.com/nodejs/node/commit/a0a12397b9)] - **doc**: document ArrayBuffer support in pbkd2Sync (kyungrae2002) [#64976](https://github.com/nodejs/node/pull/64976)
+* \[[`b48699e077`](https://github.com/nodejs/node/commit/b48699e077)] - **doc**: correct default highWaterMark values (Yilong Li) [#64617](https://github.com/nodejs/node/pull/64617)
+* \[[`0312ee133c`](https://github.com/nodejs/node/commit/0312ee133c)] - **esm**: avoid super-linear data URL MIME regex (Sumit Kumar Das) [#61951](https://github.com/nodejs/node/pull/61951)
+* \[[`cd84d55c81`](https://github.com/nodejs/node/commit/cd84d55c81)] - **esm**: only register text format when enabled (Efe Karasakal) [#64992](https://github.com/nodejs/node/pull/64992)
+* \[[`c0a8ef611e`](https://github.com/nodejs/node/commit/c0a8ef611e)] - **esm**: fix wasm import name in error message (이혜미) [#64950](https://github.com/nodejs/node/pull/64950)
+* \[[`e6c34f90c2`](https://github.com/nodejs/node/commit/e6c34f90c2)] - **events**: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) [#64473](https://github.com/nodejs/node/pull/64473)
+* \[[`6ee4b40c91`](https://github.com/nodejs/node/commit/6ee4b40c91)] - **events**: inline createEvent hybrid dispatch closure (Szymon Łągiewka) [#64473](https://github.com/nodejs/node/pull/64473)
+* \[[`367549eed5`](https://github.com/nodejs/node/commit/367549eed5)] - **fs**: use sized reads for large files in readFileUtf8 (Shelley Vohr) [#65328](https://github.com/nodejs/node/pull/65328)
+* \[[`8a5b1ae4c2`](https://github.com/nodejs/node/commit/8a5b1ae4c2)] - **fs**: fix realpath of namespaced drive paths (Jason Zhang) [#65378](https://github.com/nodejs/node/pull/65378)
+* \[[`c9233b950d`](https://github.com/nodejs/node/commit/c9233b950d)] - **fs**: fix glob early return skipping sibling entries (Srinu desetti) [#64895](https://github.com/nodejs/node/pull/64895)
+* \[[`bc54dd8905`](https://github.com/nodejs/node/commit/bc54dd8905)] - **fs**: pass symlink type in cp when filter is provided (Jerry Zhao) [#62654](https://github.com/nodejs/node/pull/62654)
+* \[[`fcb4333aca`](https://github.com/nodejs/node/commit/fcb4333aca)] - **fs**: allocate FSReqPromise stat arrays lazily (Samuel Attard) [#63886](https://github.com/nodejs/node/pull/63886)
+* \[[`c35876154e`](https://github.com/nodejs/node/commit/c35876154e)] - **fs**: fix out-of-bounds write in mkdtemp for long prefixes (Hierax\_Umbra) [#64770](https://github.com/nodejs/node/pull/64770)
+* \[[`b269616936`](https://github.com/nodejs/node/commit/b269616936)] - **fs**: treat `std::errc::permission_denied` as `EPERM` error (Kirill Saied) [#64698](https://github.com/nodejs/node/pull/64698)
+* \[[`212fe77e76`](https://github.com/nodejs/node/commit/212fe77e76)] - **fs**: add windowsHandle option to file streams (Kirill Saied) [#63851](https://github.com/nodejs/node/pull/63851)
+* \[[`75df6cb435`](https://github.com/nodejs/node/commit/75df6cb435)] - **http**: improve performance with known-length calls to end() (Tim Perry) [#65466](https://github.com/nodejs/node/pull/65466)
+* \[[`48d9cd4a28`](https://github.com/nodejs/node/commit/48d9cd4a28)] - **http**: cache maxHeaderPairs per header section (GetThatCookie) [#64988](https://github.com/nodejs/node/pull/64988)
+* \[[`04785c8f43`](https://github.com/nodejs/node/commit/04785c8f43)] - **http**: fix keylog listener setup on existing agent sockets (Shani Singh) [#65066](https://github.com/nodejs/node/pull/65066)
+* \[[`4b90031534`](https://github.com/nodejs/node/commit/4b90031534)] - **http**: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) [#64991](https://github.com/nodejs/node/pull/64991)
+* \[[`83a27559cd`](https://github.com/nodejs/node/commit/83a27559cd)] - **http2**: adapt receive deferral for Node.js 24 (Matteo Collina) [#65093](https://github.com/nodejs/node/pull/65093)
+* \[[`f43bed0ecc`](https://github.com/nodejs/node/commit/f43bed0ecc)] - **http2**: avoid uaf while receiving and sending rst\_stream (esgor) [#64166](https://github.com/nodejs/node/pull/64166)
+* \[[`b42d664321`](https://github.com/nodejs/node/commit/b42d664321)] - **inspector**: avoid calling into JS from V8 interrupts (Joyee Cheung) [#65028](https://github.com/nodejs/node/pull/65028)
+* \[[`6bf852197d`](https://github.com/nodejs/node/commit/6bf852197d)] - **lib**: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) [#61500](https://github.com/nodejs/node/pull/61500)
+* \[[`151ca7e104`](https://github.com/nodejs/node/commit/151ca7e104)] - **lib**: harden webidl dictionary member reads (Filip Skokan) [#65115](https://github.com/nodejs/node/pull/65115)
+* \[[`7e8c2c9f44`](https://github.com/nodejs/node/commit/7e8c2c9f44)] - **lib**: use validateArray for array arguments (greenhead) [#64959](https://github.com/nodejs/node/pull/64959)
+* \[[`424fe2bc5a`](https://github.com/nodejs/node/commit/424fe2bc5a)] - **lib**: add and test \[EnforceRange] in webcrypto dictionaries (Filip Skokan) [#65091](https://github.com/nodejs/node/pull/65091)
+* \[[`0529772798`](https://github.com/nodejs/node/commit/0529772798)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
+* \[[`186e1b76e8`](https://github.com/nodejs/node/commit/186e1b76e8)] - **meta**: move targos to emeritus (Michaël Zasso) [#65393](https://github.com/nodejs/node/pull/65393)
+* \[[`b41b07c72a`](https://github.com/nodejs/node/commit/b41b07c72a)] - **meta**: add unified http api initiative (James M Snell) [#65139](https://github.com/nodejs/node/pull/65139)
+* \[[`f85b6ecd67`](https://github.com/nodejs/node/commit/f85b6ecd67)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#65182](https://github.com/nodejs/node/pull/65182)
+* \[[`8f3d01bdce`](https://github.com/nodejs/node/commit/8f3d01bdce)] - **meta**: add Aviv Keller to `.mailmap` (Aviv Keller) [#65048](https://github.com/nodejs/node/pull/65048)
+* \[[`cfad1d5b28`](https://github.com/nodejs/node/commit/cfad1d5b28)] - **meta**: update sccache to 0.17.0 (René) [#64985](https://github.com/nodejs/node/pull/64985)
+* \[[`349c53c441`](https://github.com/nodejs/node/commit/349c53c441)] - **module**: report unreadable package.json (Paul Bouchon) [#65223](https://github.com/nodejs/node/pull/65223)
+* \[[`bd21e6706e`](https://github.com/nodejs/node/commit/bd21e6706e)] - **module**: cache nearest parent package.json per directory (Shelley Vohr) [#65326](https://github.com/nodejs/node/pull/65326)
+* \[[`961bd04370`](https://github.com/nodejs/node/commit/961bd04370)] - **module**: fix --check on ambiguous ESM files (Paul Bouchon) [#65203](https://github.com/nodejs/node/pull/65203)
+* \[[`f45ef73420`](https://github.com/nodejs/node/commit/f45ef73420)] - **net**: handle undefined parent in \_unrefTimer and \_destroy (Shivay-98) [#64644](https://github.com/nodejs/node/pull/64644)
+* \[[`41c7062b81`](https://github.com/nodejs/node/commit/41c7062b81)] - **(SEMVER-MINOR)** **net**: improve performance of net.BlockList (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
+* \[[`5197b5a3c5`](https://github.com/nodejs/node/commit/5197b5a3c5)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`1722ddac28`](https://github.com/nodejs/node/commit/1722ddac28)] - **permission**: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) [#65432](https://github.com/nodejs/node/pull/65432)
+* \[[`dff2b675db`](https://github.com/nodejs/node/commit/dff2b675db)] - **process**: validate resource stats array offsets (Archkon) [#65098](https://github.com/nodejs/node/pull/65098)
+* \[[`f277983e7b`](https://github.com/nodejs/node/commit/f277983e7b)] - **quic**: changes for nghttp3\_conn\_close\_stream2 (Marten Richter) [#64574](https://github.com/nodejs/node/pull/64574)
+* \[[`a4c770c78e`](https://github.com/nodejs/node/commit/a4c770c78e)] - **quic**: mark drain promise handled (James M Snell) [#65319](https://github.com/nodejs/node/pull/65319)
+* \[[`2460b171c5`](https://github.com/nodejs/node/commit/2460b171c5)] - **quic**: reset rejected HTTP/3 request streams with H3\_REQUEST\_REJECTED (trivenay) [#65442](https://github.com/nodejs/node/pull/65442)
+* \[[`18a7ccf302`](https://github.com/nodejs/node/commit/18a7ccf302)] - **quic**: write desired size needs update on maxstream (Marten Richter) [#64768](https://github.com/nodejs/node/pull/64768)
+* \[[`9017f4a780`](https://github.com/nodejs/node/commit/9017f4a780)] - **quic**: do not destroy incoming streams that have a consumer (trivenay) [#65335](https://github.com/nodejs/node/pull/65335)
+* \[[`ddc41c1ef4`](https://github.com/nodejs/node/commit/ddc41c1ef4)] - **quic**: fix wake up blob (Marten Richter) [#64044](https://github.com/nodejs/node/pull/64044)
+* \[[`88bee43d7c`](https://github.com/nodejs/node/commit/88bee43d7c)] - **quic**: convert incoming :status header to number (Hallison Pereira Melo) [#63589](https://github.com/nodejs/node/pull/63589)
+* \[[`cd776fe97c`](https://github.com/nodejs/node/commit/cd776fe97c)] - **quic**: fix infinite loop if STOP\_SENDING received on a buffering stream (Tim Perry) [#64715](https://github.com/nodejs/node/pull/64715)
+* \[[`4f6eda3c23`](https://github.com/nodejs/node/commit/4f6eda3c23)] - **repl**: keep entries added while history file is loading (Mhayk Whandson) [#64513](https://github.com/nodejs/node/pull/64513)
+* \[[`cd1e6ce29b`](https://github.com/nodejs/node/commit/cd1e6ce29b)] - **repl**: add benchmarks (Aviv Keller) [#64590](https://github.com/nodejs/node/pull/64590)
+* \[[`2ba740669d`](https://github.com/nodejs/node/commit/2ba740669d)] - **sea**: avoid dangling CLI option pointers (Archkon) [#64755](https://github.com/nodejs/node/pull/64755)
+* \[[`ec5e2d6856`](https://github.com/nodejs/node/commit/ec5e2d6856)] - **sea**: handle NUL bytes in asset keys (Archkon) [#64773](https://github.com/nodejs/node/pull/64773)
+* \[[`703b854293`](https://github.com/nodejs/node/commit/703b854293)] - **sea**: reject trailing content in config JSON (Archkon) [#64774](https://github.com/nodejs/node/pull/64774)
+* \[[`a61a5fdd1c`](https://github.com/nodejs/node/commit/a61a5fdd1c)] - **sqlite**: prevent reentrant session.close() (Trivikram Kamat) [#65349](https://github.com/nodejs/node/pull/65349)
+* \[[`6ae81be0a3`](https://github.com/nodejs/node/commit/6ae81be0a3)] - **sqlite**: reject statement-less SQL in prepare() (Trevor Burnham) [#65157](https://github.com/nodejs/node/pull/65157)
+* \[[`043dfe4996`](https://github.com/nodejs/node/commit/043dfe4996)] - **sqlite**: reject statement-less SQL in SQLTagStore (Trevor Burnham) [#65157](https://github.com/nodejs/node/pull/65157)
+* \[[`b8faee02e1`](https://github.com/nodejs/node/commit/b8faee02e1)] - **sqlite**: check null returns from sqlite value functions (Nora Dossche) [#63288](https://github.com/nodejs/node/pull/63288)
+* \[[`d6d2a71bee`](https://github.com/nodejs/node/commit/d6d2a71bee)] - **sqlite**: validate maxSize argument in createTagStore() (Anshika Jain) [#63792](https://github.com/nodejs/node/pull/63792)
+* \[[`61a046309f`](https://github.com/nodejs/node/commit/61a046309f)] - **sqlite**: reject non-positive backup rates (Trivikram Kamat) [#64893](https://github.com/nodejs/node/pull/64893)
+* \[[`514e3f30fb`](https://github.com/nodejs/node/commit/514e3f30fb)] - **sqlite**: clear SQLTagStore bindings (Matteo Collina) [#65041](https://github.com/nodejs/node/pull/65041)
+* \[[`c1542255b8`](https://github.com/nodejs/node/commit/c1542255b8)] - **sqlite**: bind Boolean (mike-git374) [#62001](https://github.com/nodejs/node/pull/62001)
+* \[[`cdb732beb5`](https://github.com/nodejs/node/commit/cdb732beb5)] - **sqlite**: fix undefined behaviour in `Session::Changeset()` (Nora Dossche) [#63637](https://github.com/nodejs/node/pull/63637)
+* \[[`fbe8861111`](https://github.com/nodejs/node/commit/fbe8861111)] - **sqlite**: bind ArrayBuffer (mike-git374) [#62061](https://github.com/nodejs/node/pull/62061)
+* \[[`e3c6bd6bc8`](https://github.com/nodejs/node/commit/e3c6bd6bc8)] - **src**: add missing vector include (Filip Skokan) [#65622](https://github.com/nodejs/node/pull/65622)
+* \[[`793cf69df8`](https://github.com/nodejs/node/commit/793cf69df8)] - **src**: fix heap value deduplication in embedder graph (Ilyas Shabi) [#64801](https://github.com/nodejs/node/pull/64801)
+* \[[`ea5935b04c`](https://github.com/nodejs/node/commit/ea5935b04c)] - **src**: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) [#64512](https://github.com/nodejs/node/pull/64512)
+* \[[`22e5023f4d`](https://github.com/nodejs/node/commit/22e5023f4d)] - **src**: escape Windows environment variables in task runner (Antoine du Hamel) [#65217](https://github.com/nodejs/node/pull/65217)
+* \[[`a0f3c62bd9`](https://github.com/nodejs/node/commit/a0f3c62bd9)] - **src**: simplify c++ diagnostics channel API (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`8e831a3d2e`](https://github.com/nodejs/node/commit/8e831a3d2e)] - **src**: make minor cleanup to permission checks (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`968b2ca3a3`](https://github.com/nodejs/node/commit/968b2ca3a3)] - **src**: use DictionaryTemplate for permission diag channel message (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`18e16e7f8d`](https://github.com/nodejs/node/commit/18e16e7f8d)] - **src**: cache permission strings (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`c8625a4b6f`](https://github.com/nodejs/node/commit/c8625a4b6f)] - **src**: add SetAbortHandler (Max H Fisher) [#64684](https://github.com/nodejs/node/pull/64684)
+* \[[`c990140d60`](https://github.com/nodejs/node/commit/c990140d60)] - **src**: match cmd.exe case-insensitively in task runner (Archkon) [#64907](https://github.com/nodejs/node/pull/64907)
+* \[[`d7463b9dbc`](https://github.com/nodejs/node/commit/d7463b9dbc)] - **src**: reuse cached env strings in remaining files (Seongeun Lee) [#65039](https://github.com/nodejs/node/pull/65039)
+* \[[`b055a43b93`](https://github.com/nodejs/node/commit/b055a43b93)] - **src**: expose Windows-only fs open flags (Kirill Saied) [#64775](https://github.com/nodejs/node/pull/64775)
+* \[[`7f21e37496`](https://github.com/nodejs/node/commit/7f21e37496)] - **src**: report why --enable-fips failed (Filip Skokan) [#64979](https://github.com/nodejs/node/pull/64979)
+* \[[`8c11beae27`](https://github.com/nodejs/node/commit/8c11beae27)] - **src**: update repeated use strings to env (James M Snell) [#64760](https://github.com/nodejs/node/pull/64760)
+* \[[`9e2c477e26`](https://github.com/nodejs/node/commit/9e2c477e26)] - **stream**: normalize fused stateless transform results (Trivikram Kamat) [#65367](https://github.com/nodejs/node/pull/65367)
+* \[[`107e96dd41`](https://github.com/nodejs/node/commit/107e96dd41)] - **stream**: encode whole chunks in TextEncoderStream (Matteo Collina) [#65414](https://github.com/nodejs/node/pull/65414)
+* \[[`164068279b`](https://github.com/nodejs/node/commit/164068279b)] - **stream**: prevent share from eagerly draining source (Trivikram Kamat) [#65338](https://github.com/nodejs/node/pull/65338)
+* \[[`93d822bdc1`](https://github.com/nodejs/node/commit/93d822bdc1)] - **stream**: drain pending writes before broadcast end (Trivikram Kamat) [#65334](https://github.com/nodejs/node/pull/65334)
+* \[[`6b8b9c362f`](https://github.com/nodejs/node/commit/6b8b9c362f)] - **stream**: reuse unexposed managed read buffers (GetThatCookie) [#64990](https://github.com/nodejs/node/pull/64990)
+* \[[`4ec4fab367`](https://github.com/nodejs/node/commit/4ec4fab367)] - **stream**: avoid duplicated endReadableNT scheduling (Matteo Collina) [#65310](https://github.com/nodejs/node/pull/65310)
+* \[[`86d1196ebf`](https://github.com/nodejs/node/commit/86d1196ebf)] - **stream**: decouple transform backpressure changes (Matteo Collina) [#65143](https://github.com/nodejs/node/pull/65143)
+* \[[`b8a7a75b19`](https://github.com/nodejs/node/commit/b8a7a75b19)] - **stream**: reject pull on signal abort during flush (Trivikram Kamat) [#65346](https://github.com/nodejs/node/pull/65346)
+* \[[`386ed6a06d`](https://github.com/nodejs/node/commit/386ed6a06d)] - **stream**: avoid leaking consumers on signal failure (Trivikram Kamat) [#65299](https://github.com/nodejs/node/pull/65299)
+* \[[`74d53bd73b`](https://github.com/nodejs/node/commit/74d53bd73b)] - **stream**: use validateObject for zlib/iter params (greenhead) [#65015](https://github.com/nodejs/node/pull/65015)
+* \[[`3a174ce16b`](https://github.com/nodejs/node/commit/3a174ce16b)] - **stream**: use validateNumber for BYOB reader options.min (greenhead) [#65014](https://github.com/nodejs/node/pull/65014)
+* \[[`859ea01cb2`](https://github.com/nodejs/node/commit/859ea01cb2)] - **stream**: consolidate non-op algorithm callbacks (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`c577669825`](https://github.com/nodejs/node/commit/c577669825)] - **stream**: cut promise churn in webstreams hot paths (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`d631e910db`](https://github.com/nodejs/node/commit/d631e910db)] - **stream**: preserve falsy cancellation reasons (Trivikram Kamat) [#64705](https://github.com/nodejs/node/pull/64705)
+* \[[`f9c21eabbd`](https://github.com/nodejs/node/commit/f9c21eabbd)] - **stream**: use validateBuffer for BYOB reader view (greenhead) [#65046](https://github.com/nodejs/node/pull/65046)
+* \[[`b89c8f5d1e`](https://github.com/nodejs/node/commit/b89c8f5d1e)] - **stream**: fix recursive WritableStream abort (Jeong SeokChan) [#64825](https://github.com/nodejs/node/pull/64825)
+* \[[`39e0457e86`](https://github.com/nodejs/node/commit/39e0457e86)] - **test**: fix link-local dgram scope assertion (Filip Skokan) [#65629](https://github.com/nodejs/node/pull/65629)
+* \[[`1433cf9d5b`](https://github.com/nodejs/node/commit/1433cf9d5b)] - **test**: account for varied OpenSSL CCM final behaviours (Filip Skokan) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`7d135d24b7`](https://github.com/nodejs/node/commit/7d135d24b7)] - **test**: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) [#65279](https://github.com/nodejs/node/pull/65279)
+* \[[`421ee11715`](https://github.com/nodejs/node/commit/421ee11715)] - **test**: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) [#65351](https://github.com/nodejs/node/pull/65351)
+* \[[`929d5705bc`](https://github.com/nodejs/node/commit/929d5705bc)] - **test**: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) [#65424](https://github.com/nodejs/node/pull/65424)
+* \[[`f38f154c14`](https://github.com/nodejs/node/commit/f38f154c14)] - **test**: simplify test-timers-interval-promisified.js (Donghoon Kang) [#65322](https://github.com/nodejs/node/pull/65322)
+* \[[`a98e27f2a9`](https://github.com/nodejs/node/commit/a98e27f2a9)] - **test**: add Headers coverage and benchmark (Yagiz Nizipli) [#65365](https://github.com/nodejs/node/pull/65365)
+* \[[`38fdbb62aa`](https://github.com/nodejs/node/commit/38fdbb62aa)] - **test**: deflake test-net-listen-ipv6only (sangwook) [#64173](https://github.com/nodejs/node/pull/64173)
+* \[[`06c7684b01`](https://github.com/nodejs/node/commit/06c7684b01)] - **test**: use common/child\_process spawnSync helpers (Junsoo Ha) [#65377](https://github.com/nodejs/node/pull/65377)
+* \[[`6438c70004`](https://github.com/nodejs/node/commit/6438c70004)] - **test**: fix Linux debug skip in SEA test guard (구현우) [#63751](https://github.com/nodejs/node/pull/63751)
+* \[[`fe0e4f1b65`](https://github.com/nodejs/node/commit/fe0e4f1b65)] - **test**: avoid timer race in event loop delay test (Trivikram Kamat) [#64728](https://github.com/nodejs/node/pull/64728)
+* \[[`6ff69baea8`](https://github.com/nodejs/node/commit/6ff69baea8)] - **test**: enforce exit code in `test-http-server-stale-close` (Antoine du Hamel) [#65198](https://github.com/nodejs/node/pull/65198)
+* \[[`ba87603016`](https://github.com/nodejs/node/commit/ba87603016)] - **test**: convert test-async-local-storage-bind to async loop (freida-code) [#65270](https://github.com/nodejs/node/pull/65270)
+* \[[`8d6b89f454`](https://github.com/nodejs/node/commit/8d6b89f454)] - **test**: replace `forEach()` with `for...of` in parallel tests (Phillip Markert) [#65272](https://github.com/nodejs/node/pull/65272)
+* \[[`a60572a7bb`](https://github.com/nodejs/node/commit/a60572a7bb)] - **test**: convert forEach to for in test-constant.js file (NIxxy25) [#65271](https://github.com/nodejs/node/pull/65271)
+* \[[`f82060c6ce`](https://github.com/nodejs/node/commit/f82060c6ce)] - **test**: use for-of instead of forEach (Felix P.) [#65268](https://github.com/nodejs/node/pull/65268)
+* \[[`5ded71f9cc`](https://github.com/nodejs/node/commit/5ded71f9cc)] - **test**: cover `realpathSync` resolving symlinks after a FIFO stat (Hendrik Liebau) [#65113](https://github.com/nodejs/node/pull/65113)
+* \[[`ac9835225e`](https://github.com/nodejs/node/commit/ac9835225e)] - **test**: account for \[EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) [#65173](https://github.com/nodejs/node/pull/65173)
+* \[[`550d24277e`](https://github.com/nodejs/node/commit/550d24277e)] - **test**: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) [#65150](https://github.com/nodejs/node/pull/65150)
+* \[[`2aa26559f0`](https://github.com/nodejs/node/commit/2aa26559f0)] - **test**: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) [#65151](https://github.com/nodejs/node/pull/65151)
+* \[[`d45c010108`](https://github.com/nodejs/node/commit/d45c010108)] - **test**: fix hidden error in test-http-server-stale-close.js (Meghan Denny) [#59357](https://github.com/nodejs/node/pull/59357)
+* \[[`881f8d092d`](https://github.com/nodejs/node/commit/881f8d092d)] - **test**: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) [#65079](https://github.com/nodejs/node/pull/65079)
+* \[[`e4b1e3ee75`](https://github.com/nodejs/node/commit/e4b1e3ee75)] - **test**: allow half-open CONNECT tunnel sockets (Trivikram Kamat) [#64973](https://github.com/nodejs/node/pull/64973)
+* \[[`00f4240d48`](https://github.com/nodejs/node/commit/00f4240d48)] - **test**: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) [#65077](https://github.com/nodejs/node/pull/65077)
+* \[[`cf7680efb7`](https://github.com/nodejs/node/commit/cf7680efb7)] - **test**: use libuv clock for immediate queue test (Trivikram Kamat) [#64889](https://github.com/nodejs/node/pull/64889)
+* \[[`b0c12772ff`](https://github.com/nodejs/node/commit/b0c12772ff)] - **test**: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) [#64719](https://github.com/nodejs/node/pull/64719)
+* \[[`7e279104b4`](https://github.com/nodejs/node/commit/7e279104b4)] - **test**: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) [#64977](https://github.com/nodejs/node/pull/64977)
+* \[[`ac11f88d16`](https://github.com/nodejs/node/commit/ac11f88d16)] - **test,doc**: cover and document multi-byte offset/size in randomFill (kyungrae2002) [#64834](https://github.com/nodejs/node/pull/64834)
+* \[[`67da38cada`](https://github.com/nodejs/node/commit/67da38cada)] - **test\_runner**: match dotfiles in default coverage exclude (semimikoh) [#63401](https://github.com/nodejs/node/pull/63401)
+* \[[`b06c61a08f`](https://github.com/nodejs/node/commit/b06c61a08f)] - **test\_runner**: print coverage and diagnostic info with dot reporter (mag123c) [#61423](https://github.com/nodejs/node/pull/61423)
+* \[[`7cb9c9c126`](https://github.com/nodejs/node/commit/7cb9c9c126)] - **test\_runner**: use run options with isolation="none" (Sylvester Keil) [#62269](https://github.com/nodejs/node/pull/62269)
+* \[[`339acf4201`](https://github.com/nodejs/node/commit/339acf4201)] - **test\_runner**: mock dual-package with conditional exports (Maruthan G) [#62943](https://github.com/nodejs/node/pull/62943)
+* \[[`e7a68bca08`](https://github.com/nodejs/node/commit/e7a68bca08)] - **test\_runner**: add classname hierarchy for JUnit reporter (mag123c) [#60220](https://github.com/nodejs/node/pull/60220)
+* \[[`6a248acefe`](https://github.com/nodejs/node/commit/6a248acefe)] - **test\_runner**: fix junit report on empty diagnostic (Lazizbek Ergashev) [#65357](https://github.com/nodejs/node/pull/65357)
+* \[[`d01dda79b6`](https://github.com/nodejs/node/commit/d01dda79b6)] - **test\_runner**: do not tag-filter test file wrappers (Chemi Atlow) [#65170](https://github.com/nodejs/node/pull/65170)
+* \[[`32ead10ddd`](https://github.com/nodejs/node/commit/32ead10ddd)] - **test\_runner**: fix env option validation (Jihwan) [#64865](https://github.com/nodejs/node/pull/64865)
+* \[[`b0ef155440`](https://github.com/nodejs/node/commit/b0ef155440)] - **tls**: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) [#65076](https://github.com/nodejs/node/pull/65076)
+* \[[`dcf65c50ce`](https://github.com/nodejs/node/commit/dcf65c50ce)] - **tls**: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) [#64677](https://github.com/nodejs/node/pull/64677)
+* \[[`b0f54bda78`](https://github.com/nodejs/node/commit/b0f54bda78)] - **tools**: improve commit queue failure comment (Filip Skokan) [#65433](https://github.com/nodejs/node/pull/65433)
+* \[[`bc1f2718d5`](https://github.com/nodejs/node/commit/bc1f2718d5)] - **tools**: fix max body length handler in `create-release-proposal.sh` (Antoine du Hamel) [#65455](https://github.com/nodejs/node/pull/65455)
+* \[[`bbe76516a9`](https://github.com/nodejs/node/commit/bbe76516a9)] - **tools**: bump brace-expansion in `/tools/clang-format` (dependabot\[bot]) [#64984](https://github.com/nodejs/node/pull/64984)
+* \[[`67697debdf`](https://github.com/nodejs/node/commit/67697debdf)] - **tools**: make env variables consistent in cron jobs (Antoine du Hamel) [#65168](https://github.com/nodejs/node/pull/65168)
+* \[[`ac8a68ec92`](https://github.com/nodejs/node/commit/ac8a68ec92)] - **tools**: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) [#65197](https://github.com/nodejs/node/pull/65197)
+* \[[`6d9999fa2e`](https://github.com/nodejs/node/commit/6d9999fa2e)] - **tools**: remove skip logic in `commit-queue.sh` (Antoine du Hamel) [#65162](https://github.com/nodejs/node/pull/65162)
+* \[[`60bfa1694e`](https://github.com/nodejs/node/commit/60bfa1694e)] - **tools**: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot\[bot]) [#65129](https://github.com/nodejs/node/pull/65129)
+* \[[`782748527e`](https://github.com/nodejs/node/commit/782748527e)] - **tools**: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot\[bot]) [#65130](https://github.com/nodejs/node/pull/65130)
+* \[[`dac257340f`](https://github.com/nodejs/node/commit/dac257340f)] - **tools**: fix GITHUB\_TOKEN permissions for CQ workflow (Antoine du Hamel) [#65192](https://github.com/nodejs/node/pull/65192)
+* \[[`e624785846`](https://github.com/nodejs/node/commit/e624785846)] - **tools**: use the read-only token when filtering PRs in CQ (Antoine du Hamel) [#65169](https://github.com/nodejs/node/pull/65169)
+* \[[`7d9dcfaaa7`](https://github.com/nodejs/node/commit/7d9dcfaaa7)] - **tools**: delay removal of `commit-queue` label (Antoine du Hamel) [#65101](https://github.com/nodejs/node/pull/65101)
+* \[[`0d7c7936e7`](https://github.com/nodejs/node/commit/0d7c7936e7)] - **tools**: move ncu config to global for commit queue (Filip Skokan) [#65132](https://github.com/nodejs/node/pull/65132)
+* \[[`5e1db5a38a`](https://github.com/nodejs/node/commit/5e1db5a38a)] - **tools**: prefilter commit queue metadata (Filip Skokan) [#64343](https://github.com/nodejs/node/pull/64343)
+* \[[`f41509b91d`](https://github.com/nodejs/node/commit/f41509b91d)] - **tools**: lazy-abort failed PR merges in CQ (Antoine du Hamel) [#65004](https://github.com/nodejs/node/pull/65004)
+* \[[`ceb0e99acd`](https://github.com/nodejs/node/commit/ceb0e99acd)] - **tools**: sync mk-ca-bundle.pl with curl (Archkon) [#64753](https://github.com/nodejs/node/pull/64753)
+* \[[`600663b23f`](https://github.com/nodejs/node/commit/600663b23f)] - **tty**: add raw-vt and io raw modes (Samuel Williams) [#64140](https://github.com/nodejs/node/pull/64140)
+* \[[`a40bfc742e`](https://github.com/nodejs/node/commit/a40bfc742e)] - **typings**: add signal\_wrap internal binding types (Seongeun Lee) [#65229](https://github.com/nodejs/node/pull/65229)
+* \[[`b103a4a3b9`](https://github.com/nodejs/node/commit/b103a4a3b9)] - **typings**: add diagnostics\_channel typings (Seongeun Lee) [#65227](https://github.com/nodejs/node/pull/65227)
+* \[[`e64de34b89`](https://github.com/nodejs/node/commit/e64de34b89)] - **typings**: add watchdog internal binding types (Seongeun Lee) [#65228](https://github.com/nodejs/node/pull/65228)
+* \[[`c57c83b4d1`](https://github.com/nodejs/node/commit/c57c83b4d1)] - **typings**: add internal\_only\_v8 binding typeis (Donghoon Kang) [#65071](https://github.com/nodejs/node/pull/65071)
+* \[[`f15e8c9dcd`](https://github.com/nodejs/node/commit/f15e8c9dcd)] - **typings**: add credentials internal binding types (Donghoon Kang) [#65036](https://github.com/nodejs/node/pull/65036)
+* \[[`a500256b0b`](https://github.com/nodejs/node/commit/a500256b0b)] - **url**: skip unused href reuse comparison (Yagiz Nizipli) [#65361](https://github.com/nodejs/node/pull/65361)
+* \[[`58390f8bec`](https://github.com/nodejs/node/commit/58390f8bec)] - **url**: speed up WHATWG URL parsing (Yagiz Nizipli) [#65361](https://github.com/nodejs/node/pull/65361)
+* \[[`7d5428c812`](https://github.com/nodejs/node/commit/7d5428c812)] - **url**: speed up URLSearchParams (Yagiz Nizipli) [#65363](https://github.com/nodejs/node/pull/65363)
+* \[[`8e2461d819`](https://github.com/nodejs/node/commit/8e2461d819)] - **url**: bounds-check short Windows file URL paths (Archkon) [#64788](https://github.com/nodejs/node/pull/64788)
+* \[[`9ffc0da90c`](https://github.com/nodejs/node/commit/9ffc0da90c)] - **url**: handle unparsable serialized URLs in setters (Matteo Collina) [#64651](https://github.com/nodejs/node/pull/64651)
+* \[[`fa9d4e075d`](https://github.com/nodejs/node/commit/fa9d4e075d)] - **util**: allow single-line format when break length is infinite (Hamid Reza Ghavami) [#64238](https://github.com/nodejs/node/pull/64238)
+* \[[`b68a7c3862`](https://github.com/nodejs/node/commit/b68a7c3862)] - **util**: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) [#64319](https://github.com/nodejs/node/pull/64319)
+* \[[`10cbb6dc00`](https://github.com/nodejs/node/commit/10cbb6dc00)] - **util**: fix formatting of functions returned from getters (Richard Gibson) [#64839](https://github.com/nodejs/node/pull/64839)
+* \[[`64c20b449e`](https://github.com/nodejs/node/commit/64c20b449e)] - **util**: use more primordials in `comparisons.js` (Ayoub Mabrouk) [#61198](https://github.com/nodejs/node/pull/61198)
+* \[[`cea9786de8`](https://github.com/nodejs/node/commit/cea9786de8)] - **util**: preserve function names without source map names (Hiroki Osame) [#65108](https://github.com/nodejs/node/pull/65108)
+* \[[`35c635b032`](https://github.com/nodejs/node/commit/35c635b032)] - **(SEMVER-MINOR)** **util**: add non-throwing MIMEType.parse (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
+* \[[`5858c2ba9a`](https://github.com/nodejs/node/commit/5858c2ba9a)] - **zlib**: validate pledgedSrcSize for sync zstd (Archkon) [#64601](https://github.com/nodejs/node/pull/64601)
+
 <a id="24.20.0"></a>
 
 ## 2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95

From 7055c484ff74e72c5ed30bf1b19b8f8d4e793d11 Mon Sep 17 00:00:00 2001
From: James M Snell <jsnell@cloudflare.com>
Date: Sun, 6 Sep 2026 14:33:46 -0700
Subject: [PATCH 186/202] zlib: improve zstd decoding across chunk boundaries

Discovered when testing some other changes that zstd was not
handling certain chunk boundaries very well. This fixes it.

- Decodes concatenated and skippable zstd frames across all
  chunk boundaries.
- Preserves rejectGarbageAfterEnd semantics.
- Reports corruption in subsequent frames.
- Handles trailing partial frame identifiers consistently.
- Covers classic sync/async and iterable APIs.
- Updated documentation and internal typings.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/65865
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/zlib.md                               |   5 +-
 lib/zlib.js                                   |  12 +-
 src/node_zlib.cc                              | 119 ++++++++++++---
 .../test-stream-iter-transform-roundtrip.js   |  16 ++
 .../test-stream-iter-transform-sync.js        |  11 ++
 .../test-zlib-reject-garbage-after-end.js     | 142 +++++++++++++++++-
 typings/internalBinding/zlib.d.ts             |   4 +-
 7 files changed, 282 insertions(+), 27 deletions(-)

diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index 9ab581678e08..fc6bc63b9766 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -2230,7 +2230,7 @@ Each Zstd-based class takes an `options` object. All options are optional.
   to improve compression efficiency when compressing or decompressing data that
   shares common patterns with the dictionary.
 * `rejectGarbageAfterEnd` {boolean} If `true`, decompression fails when
-  input remains after the first complete compressed stream. **Default:** `false`
+  input remains after a complete sequence of Zstd frames. **Default:** `false`
 
 For example:
 
@@ -2266,7 +2266,8 @@ added:
   - v22.15.0
 -->
 
-Decompress data using the Zstd algorithm.
+Decompress data using the Zstd algorithm. Concatenated Zstd and skippable frames
+are decoded as a single stream.
 
 ## `zlib.constants`
 
diff --git a/lib/zlib.js b/lib/zlib.js
index 3e6986bf8127..9fffcc20af62 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -201,9 +201,14 @@ function zlibOnError(message, errno, code) {
   // There is no way to cleanly recover.
   // Continuing only obscures problems.
 
-  const error = genericNodeError(message, { errno, code });
-  error.errno = errno;
-  error.code = code;
+  let error;
+  if (code === 'ERR_TRAILING_JUNK_AFTER_STREAM_END') {
+    error = new ERR_TRAILING_JUNK_AFTER_STREAM_END();
+  } else {
+    error = genericNodeError(message, { errno, code });
+    error.errno = errno;
+    error.code = code;
+  }
   self.destroy(error);
   self[kError] = error;
 }
@@ -924,6 +929,7 @@ class Zstd extends ZlibBase {
       writeState,
       processCallback,
       dictionary,
+      opts?.rejectGarbageAfterEnd === true,
     );
 
     super(opts, mode, handle, zstdDefaultOpts);
diff --git a/src/node_zlib.cc b/src/node_zlib.cc
index af82aa2ae73b..c74e98c9cd11 100644
--- a/src/node_zlib.cc
+++ b/src/node_zlib.cc
@@ -336,7 +336,8 @@ class ZstdCompressContext final : public ZstdContext {
 
   // Zstd specific:
   CompressionError Init(uint64_t pledged_src_size,
-                        std::string_view dictionary = {});
+                        std::string_view dictionary = {},
+                        bool reject_garbage_after_end = false);
   CompressionError SetParameter(int key, int value);
 
   // Wrap ZSTD_freeCCtx to remove the return type.
@@ -365,7 +366,8 @@ class ZstdDecompressContext final : public ZstdContext {
 
   // Zstd specific:
   CompressionError Init(uint64_t pledged_src_size,
-                        std::string_view dictionary = {});
+                        std::string_view dictionary = {},
+                        bool reject_garbage_after_end = false);
 
   CompressionError SetParameter(int key, int value);
 
@@ -379,6 +381,11 @@ class ZstdDecompressContext final : public ZstdContext {
  private:
   DeleteFnPtr<ZSTD_DCtx, ZstdDecompressContext::FreeZstd> dctx_;
   bool frame_complete_ = false;
+  bool decoding_frame_after_complete_ = false;
+  bool reject_garbage_after_end_ = false;
+  bool ignoring_trailing_input_ = false;
+  size_t frame_prefix_size_ = 0;
+  uint8_t possible_frame_types_ = 0;
 };
 
 class CompressionStreamMemoryOwner {
@@ -947,9 +954,9 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
   }
 
   static void Init(const FunctionCallbackInfo<Value>& args) {
-    CHECK((args.Length() == 4 || args.Length() == 5) &&
+    CHECK((args.Length() >= 4 && args.Length() <= 6) &&
           "init(params, pledgedSrcSize, writeResult, writeCallback[, "
-          "dictionary])");
+          "dictionary[, rejectGarbageAfterEnd]])");
 
     ZstdStream* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
@@ -986,7 +993,7 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
     AllocScope alloc_scope(wrap);
     std::string_view dictionary;
     ArrayBufferViewContents<char> contents;
-    if (args.Length() == 5 && !args[4]->IsUndefined()) {
+    if (args.Length() >= 5 && !args[4]->IsUndefined()) {
       if (!args[4]->IsArrayBufferView()) {
         THROW_ERR_INVALID_ARG_TYPE(
             wrap->env(), "dictionary must be an ArrayBufferView if provided");
@@ -996,7 +1003,14 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
       dictionary = std::string_view(contents.data(), contents.length());
     }
 
-    CompressionError err = wrap->context()->Init(pledged_src_size, dictionary);
+    bool reject_garbage_after_end = false;
+    if (args.Length() == 6) {
+      CHECK(args[5]->IsBoolean());
+      reject_garbage_after_end = args[5]->IsTrue();
+    }
+
+    CompressionError err = wrap->context()->Init(
+        pledged_src_size, dictionary, reject_garbage_after_end);
     if (err.IsError()) {
       wrap->EmitError(err);
       THROW_ERR_ZLIB_INITIALIZATION_FAILED(wrap->env(), err.message);
@@ -1661,7 +1675,8 @@ void ZstdCompressContext::Close() {
 }
 
 CompressionError ZstdCompressContext::Init(uint64_t pledged_src_size,
-                                           std::string_view dictionary) {
+                                           std::string_view dictionary,
+                                           bool) {
   pledged_src_size_ = pledged_src_size;
   if (pledged_src_size == ZSTD_CONTENTSIZE_UNKNOWN) {
     consumed_src_size_.reset();
@@ -1745,8 +1760,14 @@ void ZstdDecompressContext::Close() {
 }
 
 CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
-                                             std::string_view dictionary) {
+                                             std::string_view dictionary,
+                                             bool reject_garbage_after_end) {
   frame_complete_ = false;
+  decoding_frame_after_complete_ = false;
+  reject_garbage_after_end_ = reject_garbage_after_end;
+  ignoring_trailing_input_ = false;
+  frame_prefix_size_ = 0;
+  possible_frame_types_ = 0;
 
 #ifdef NODE_BUNDLED_ZSTD
   ZSTD_customMem custom_mem = {
@@ -1779,10 +1800,14 @@ CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
 CompressionError ZstdDecompressContext::ResetStream() {
   // We pass ZSTD_CONTENTSIZE_UNKNOWN because the argument is ignored for
   // decompression.
-  return Init(ZSTD_CONTENTSIZE_UNKNOWN);
+  return Init(ZSTD_CONTENTSIZE_UNKNOWN, {}, reject_garbage_after_end_);
 }
 
 void ZstdDecompressContext::DoThreadPoolWork() {
+  if (ignoring_trailing_input_) {
+    return;
+  }
+
   // The JavaScript processing loop retries with an empty input buffer when the
   // previous call filled the output buffer. Avoid interpreting that retry as
   // the beginning of a new, incomplete frame.
@@ -1790,15 +1815,64 @@ void ZstdDecompressContext::DoThreadPoolWork() {
     return;
   }
 
-  size_t const ret = ZSTD_decompressStream(dctx_.get(), &output_, &input_);
-  if (ZSTD_isError(ret)) {
-    frame_complete_ = false;
-    error_ = ZSTD_getErrorCode(ret);
-    error_code_string_ = ZstdStrerror(error_);
-    error_string_ = ZSTD_getErrorString(error_);
-  } else {
+  do {
+    if (frame_complete_) {
+      decoding_frame_after_complete_ = true;
+      frame_prefix_size_ = 0;
+      possible_frame_types_ = 0b11;
+    }
+
+    if (decoding_frame_after_complete_ && frame_prefix_size_ < 4) {
+      static constexpr uint8_t zstd_magic[] = {0x28, 0xb5, 0x2f, 0xfd};
+      static constexpr uint8_t skippable_magic[] = {0x50, 0x2a, 0x4d, 0x18};
+      const auto* data = static_cast<const uint8_t*>(input_.src);
+      size_t input_prefix_offset = 0;
+
+      while (frame_prefix_size_ < 4 &&
+             input_.pos + input_prefix_offset < input_.size) {
+        const size_t index = frame_prefix_size_;
+        const uint8_t byte = data[input_.pos + input_prefix_offset];
+        if (byte != zstd_magic[index]) {
+          possible_frame_types_ &= ~0b01;
+        }
+        if ((index == 0 && (byte & 0xf0) != skippable_magic[0]) ||
+            (index != 0 && byte != skippable_magic[index])) {
+          possible_frame_types_ &= ~0b10;
+        }
+        frame_prefix_size_++;
+        input_prefix_offset++;
+      }
+
+      if (possible_frame_types_ == 0) {
+        frame_complete_ = true;
+        decoding_frame_after_complete_ = false;
+        if (reject_garbage_after_end_) {
+          error_ = ZSTD_error_GENERIC;
+          error_code_string_ = "ERR_TRAILING_JUNK_AFTER_STREAM_END";
+          error_string_ =
+              "Trailing junk found after the end of the compressed stream";
+        } else {
+          ignoring_trailing_input_ = true;
+        }
+        return;
+      }
+    }
+
+    const size_t ret = ZSTD_decompressStream(dctx_.get(), &output_, &input_);
+    if (ZSTD_isError(ret)) {
+      frame_complete_ = false;
+      error_ = ZSTD_getErrorCode(ret);
+      error_code_string_ = ZstdStrerror(error_);
+      error_string_ = ZSTD_getErrorString(error_);
+      return;
+    }
+
     frame_complete_ = ret == 0;
-  }
+    if (frame_complete_) {
+      decoding_frame_after_complete_ = false;
+    }
+  } while (frame_complete_ && input_.pos < input_.size &&
+           output_.pos < output_.size);
 }
 
 CompressionError ZstdDecompressContext::GetErrorInfo() const {
@@ -1809,6 +1883,17 @@ CompressionError ZstdDecompressContext::GetErrorInfo() const {
 
   if (flush_ == ZSTD_e_end && !frame_complete_ && input_.pos == input_.size &&
       output_.pos < output_.size) {
+    if (decoding_frame_after_complete_) {
+      if (frame_prefix_size_ < 4) {
+        if (reject_garbage_after_end_) {
+          return CompressionError(
+              "Trailing junk found after the end of the compressed stream",
+              "ERR_TRAILING_JUNK_AFTER_STREAM_END",
+              -1);
+        }
+        return {};
+      }
+    }
     return CompressionError(
         "unexpected end of file", "Z_BUF_ERROR", Z_BUF_ERROR);
   }
diff --git a/test/parallel/test-stream-iter-transform-roundtrip.js b/test/parallel/test-stream-iter-transform-roundtrip.js
index d9a745593c27..a734b6c3132e 100644
--- a/test/parallel/test-stream-iter-transform-roundtrip.js
+++ b/test/parallel/test-stream-iter-transform-roundtrip.js
@@ -19,6 +19,7 @@ const {
   decompressBrotli,
   decompressZstd,
 } = require('zlib/iter');
+const zlib = require('zlib');
 
 // =============================================================================
 // Helper: compress then decompress, verify round-trip equality
@@ -143,6 +144,20 @@ async function testZstdActuallyCompresses() {
             `Compressed ${compressed.byteLength} should be < original ${inputBuf.byteLength}`);
 }
 
+async function testZstdConcatenatedFrames() {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b');
+  const input = Buffer.concat([first, second]);
+  const result = await bytes(pull(from(input), decompressZstd()));
+  assert.strictEqual(Buffer.from(result).toString(), 'ab');
+
+  const withJunk = await bytes(pull(
+    from([first, Buffer.from('junk'), second]),
+    decompressZstd(),
+  ));
+  assert.strictEqual(Buffer.from(withJunk).toString(), 'a');
+}
+
 // =============================================================================
 // Binary data round-trip - verify no corruption on non-text data
 // =============================================================================
@@ -280,6 +295,7 @@ async function testGzipWithLevel() {
   await testZstdRoundTrip();
   await testZstdLargeData();
   await testZstdActuallyCompresses();
+  await testZstdConcatenatedFrames();
 
   // Binary data
   await testBinaryRoundTripGzip();
diff --git a/test/parallel/test-stream-iter-transform-sync.js b/test/parallel/test-stream-iter-transform-sync.js
index d674c26cca10..991dba2748ed 100644
--- a/test/parallel/test-stream-iter-transform-sync.js
+++ b/test/parallel/test-stream-iter-transform-sync.js
@@ -19,6 +19,7 @@ const {
   decompressBrotliSync,
   decompressZstdSync,
 } = require('zlib/iter');
+const { zstdCompressSync } = require('zlib');
 
 // =============================================================================
 // Helper: sync compress then decompress, verify round-trip equality
@@ -118,6 +119,15 @@ function testZstdLargeData() {
   assert.strictEqual(result, input);
 }
 
+function testZstdConcatenatedFrames() {
+  const input = Buffer.concat([
+    zstdCompressSync('a'),
+    zstdCompressSync('b'),
+  ]);
+  const result = bytesSync(pullSync(fromSync(input), decompressZstdSync()));
+  assert.strictEqual(Buffer.from(result).toString(), 'ab');
+}
+
 // =============================================================================
 // Cross-algorithm: compress async-compatible, decompress sync (and vice versa)
 // The sync transforms should produce output compatible with the standard format
@@ -218,6 +228,7 @@ testBrotliRoundTrip();
 testBrotliLargeData();
 testZstdRoundTrip();
 testZstdLargeData();
+testZstdConcatenatedFrames();
 testGzipWithOptions();
 testBrotliWithOptions();
 testMixedStatelessAndStateful();
diff --git a/test/parallel/test-zlib-reject-garbage-after-end.js b/test/parallel/test-zlib-reject-garbage-after-end.js
index 8039865f5f11..5cd36f42c267 100644
--- a/test/parallel/test-zlib-reject-garbage-after-end.js
+++ b/test/parallel/test-zlib-reject-garbage-after-end.js
@@ -23,10 +23,13 @@ function callAsync(fn, input, options) {
   });
 }
 
-async function collect(stream, input) {
+async function collect(stream, ...inputs) {
   const chunks = [];
   stream.on('data', (chunk) => chunks.push(chunk));
-  stream.end(input);
+  for (let i = 0; i < inputs.length - 1; i++) {
+    stream.write(inputs[i]);
+  }
+  stream.end(inputs[inputs.length - 1]);
   await finished(stream);
   return Buffer.concat(chunks);
 }
@@ -79,6 +82,7 @@ const cases = [
     decompressSync: zlib.zstdDecompressSync,
     createDecompress: zlib.createZstdDecompress,
     defaultOutput: 'a',
+    trailingInput: Buffer.from('trailing junk'),
   },
 ];
 
@@ -89,10 +93,14 @@ for (const {
   decompressSync,
   createDecompress,
   defaultOutput,
+  trailingInput,
 } of cases) {
   test(`rejectGarbageAfterEnd rejects trailing input for ${label}`, async () => {
     const compressed = compress(Buffer.from('a'));
-    const withTrailingInput = Buffer.concat([compressed, compressed]);
+    const withTrailingInput = Buffer.concat([
+      compressed,
+      trailingInput ?? compressed,
+    ]);
 
     assert.strictEqual(decompressSync(withTrailingInput).toString(), defaultOutput);
     assert.strictEqual(
@@ -122,6 +130,134 @@ for (const {
   });
 }
 
+test('zstd decompresses concatenated frames regardless of chunking', async () => {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b');
+  const skippable = Buffer.alloc(12);
+  skippable.writeUInt32LE(0x184d2a50, 0);
+  skippable.writeUInt32LE(4, 4);
+  skippable.write('meta', 8);
+
+  for (const input of [
+    Buffer.concat([first, second]),
+    Buffer.concat([first, skippable, second]),
+  ]) {
+    for (const rejectGarbageAfterEnd of [false, true]) {
+      const options = { rejectGarbageAfterEnd };
+      assert.strictEqual(
+        zlib.zstdDecompressSync(input, options).toString(),
+        'ab',
+      );
+      assert.strictEqual(
+        (await callAsync(zlib.zstdDecompress, input, options)).toString(),
+        'ab',
+      );
+
+      for (let split = 0; split <= input.length; split++) {
+        assert.strictEqual(
+          (await collect(
+            zlib.createZstdDecompress(options),
+            input.subarray(0, split),
+            input.subarray(split),
+          )).toString(),
+          'ab',
+          `split at byte ${split}`,
+        );
+      }
+    }
+  }
+});
+
+test('zstd trailing junk handling is independent of chunking', async () => {
+  const compressed = zlib.zstdCompressSync('a');
+  const laterFrame = zlib.zstdCompressSync('b');
+  const junk = Buffer.from('trailing junk');
+
+  assert.strictEqual(
+    (await collect(
+      zlib.createZstdDecompress(),
+      compressed,
+      junk,
+      laterFrame,
+    )).toString(),
+    'a',
+  );
+  await assert.rejects(
+    collect(
+      zlib.createZstdDecompress({ rejectGarbageAfterEnd: true }),
+      compressed,
+      junk,
+    ),
+    trailingJunkError,
+  );
+});
+
+test('zstd handles incomplete trailing frame identifiers as junk', async () => {
+  const compressed = zlib.zstdCompressSync('a');
+  const framePrefix = zlib.zstdCompressSync('b').subarray(0, 3);
+
+  for (let length = 1; length <= framePrefix.length; length++) {
+    const trailing = framePrefix.subarray(0, length);
+    assert.strictEqual(
+      zlib.zstdDecompressSync(Buffer.concat([compressed, trailing])).toString(),
+      'a',
+    );
+    assert.throws(
+      () => zlib.zstdDecompressSync(Buffer.concat([compressed, trailing]), {
+        rejectGarbageAfterEnd: true,
+      }),
+      trailingJunkError,
+    );
+    assert.strictEqual(
+      (await collect(
+        zlib.createZstdDecompress(),
+        compressed,
+        trailing,
+      )).toString(),
+      'a',
+    );
+  }
+});
+
+test('zstd reports errors in subsequent frames', async () => {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b', {
+    params: {
+      [zlib.constants.ZSTD_c_checksumFlag]: 1,
+    },
+  });
+  second[second.length - 1] ^= 1;
+  const input = Buffer.concat([first, second]);
+  const checksumError = { code: 'ZSTD_error_checksum_wrong' };
+
+  assert.throws(() => zlib.zstdDecompressSync(input), checksumError);
+  await assert.rejects(
+    collect(zlib.createZstdDecompress(), first, second),
+    checksumError,
+  );
+});
+
+test('zstd decompresses multiple frames across output buffers', async () => {
+  const firstInput = Buffer.allocUnsafe(1024);
+  const secondInput = Buffer.allocUnsafe(1024);
+  for (let i = 0; i < firstInput.length; i++) {
+    firstInput[i] = i;
+    secondInput[i] = i + 1;
+  }
+  const input = Buffer.concat([
+    zlib.zstdCompressSync(firstInput),
+    zlib.zstdCompressSync(secondInput),
+  ]);
+  const expected = Buffer.concat([firstInput, secondInput]);
+  const options = { chunkSize: 64 };
+
+  assert.deepStrictEqual(zlib.zstdDecompressSync(input, options), expected);
+  assert.deepStrictEqual(
+    await collect(zlib.createZstdDecompress(options), input),
+    expected,
+  );
+});
+
 test('rejectGarbageAfterEnd must be a boolean', () => {
   const compressed = zlib.deflateSync(Buffer.from('a'));
 
diff --git a/typings/internalBinding/zlib.d.ts b/typings/internalBinding/zlib.d.ts
index 706337eb45a7..84c437350433 100644
--- a/typings/internalBinding/zlib.d.ts
+++ b/typings/internalBinding/zlib.d.ts
@@ -32,12 +32,12 @@ declare namespace InternalZlibBinding {
 
   class ZstdCompress extends ZlibBase {
     constructor();
-    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView): void;
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView, rejectGarbageAfterEnd?: boolean): void;
   }
 
   class ZstdDecompress extends ZlibBase {
     constructor();
-    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView): void;
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView, rejectGarbageAfterEnd?: boolean): void;
   }
 }
 

From dab3a73673e0d646f26afbee95f257edc68182f1 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 9 Sep 2026 02:58:39 +0200
Subject: [PATCH 187/202] doc: fix YAML errors due to bad conflict resolutions

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65921
Reviewed-By: LiviaMedeiros <livia@cirno.name>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/buffer.md | 2 ++
 doc/api/fs.md     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index f7c73d6b6377..fe22de84f9d1 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5345,6 +5345,7 @@ added:
   - v19.6.0
   - v18.15.0
 changes:
+  - version:
      - v26.8.0
      - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64504
@@ -5367,6 +5368,7 @@ added:
   - v19.4.0
   - v18.14.0
 changes:
+  - version:
      - v26.8.0
      - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64504
diff --git a/doc/api/fs.md b/doc/api/fs.md
index 461ea5438c26..03e9b8be5e9e 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -2985,6 +2985,7 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v0.1.31
 changes:
+  - version:
      - v26.8.0
      - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63851
@@ -3123,6 +3124,7 @@ If `options` is a string, then it specifies the encoding.
 <!-- YAML
 added: v0.1.31
 changes:
+  - version:
      - v26.8.0
      - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63851

From f9072f37ed965d89b09bc2659780cecc1c7376a6 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 8 Sep 2026 18:34:15 -0700
Subject: [PATCH 188/202] sqlite: always copy changeset before applying

SQLite can invoke JavaScript through user-defined SQL functions while
applying a changeset, even when no filter or conflict callback is set.
Copy non-empty changesets unconditionally so JavaScript cannot detach
or modify the input while SQLite is still reading it.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex
PR-URL: https://github.com/nodejs/node/pull/65870
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/node_sqlite.cc                   |  9 ++++---
 test/parallel/test-sqlite-session.js | 36 ++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index ed66ef9f0e3b..aa26b90931a2 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -2671,12 +2671,11 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  // A callback may detach/modify the input buffer mid-apply, so copy it.
-  // With no callbacks, no JS runs during sqlite3changeset_apply(), so no
-  // copy is needed.
+  // SQLite may invoke JavaScript through explicit callbacks or user-defined
+  // SQL functions while applying the changeset. Copy the input so JavaScript
+  // cannot detach or modify the memory while SQLite is still reading it.
   std::unique_ptr<BackingStore> changeset;
-  if (buf.length() > 0 &&
-      (context.filterCallback || context.conflictCallback)) {
+  if (buf.length() > 0) {
     changeset = ArrayBuffer::NewBackingStore(
         env->isolate(),
         buf.length(),
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index c36ed84a0858..40da13c4bb7f 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -462,6 +462,42 @@ test('database.applyChangeset() - changeset detached by filter', (t) => {
   ]);
 });
 
+test('database.applyChangeset() - changeset detached by SQL function', (t) => {
+  const database1 = new DatabaseSync(':memory:');
+  const database2 = new DatabaseSync(':memory:');
+  let changeset;
+  let detached = false;
+
+  database1.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+  database2.function('validate_changeset_value', (value) => {
+    if (!detached) {
+      detached = true;
+      const transferred = structuredClone(changeset.buffer, {
+        transfer: [changeset.buffer],
+      });
+      new Uint8Array(transferred).fill(0);
+    }
+    return value.length;
+  });
+  database2.exec(`
+    CREATE TABLE data(
+      key INTEGER PRIMARY KEY,
+      value TEXT CHECK (validate_changeset_value(value))
+    )
+  `);
+
+  const session = database1.createSession();
+  database1.exec("INSERT INTO data VALUES (1, 'hello'), (2, 'world')");
+  changeset = session.changeset();
+
+  t.assert.strictEqual(database2.applyChangeset(changeset), true);
+  t.assert.strictEqual(changeset.byteLength, 0);
+  deepStrictEqual(t)(database2.prepare('SELECT * FROM data').all(), [
+    { key: 1, value: 'hello' },
+    { key: 2, value: 'world' },
+  ]);
+});
+
 test('database.createSession() - filter changes', (t) => {
   const database1 = new DatabaseSync(':memory:');
   const database2 = new DatabaseSync(':memory:');

From 36f16e7ebad58af16715b2d7dd2acdb07c407e8a Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 8 Sep 2026 18:34:28 -0700
Subject: [PATCH 189/202] doc: qualify directory read ordering for native fs

Clarify that the documented operating system directory ordering applies
to reads handled by the native file system.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65868
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/api/fs.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/api/fs.md b/doc/api/fs.md
index 03e9b8be5e9e..4d15a82e4a09 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -7358,8 +7358,9 @@ Asynchronously read the next directory entry via readdir(3) as an
 A promise is returned that will be fulfilled with an {fs.Dirent}, or `null`
 if there are no more directory entries to read.
 
-Directory entries returned by this function are in no particular order as
-provided by the operating system's underlying directory mechanisms.
+For directory reads handled by the native file system, directory entries
+returned by this function are in no particular order as provided by the
+operating system's underlying directory mechanisms.
 Entries added or removed while iterating over the directory might not be
 included in the iteration results.
 

From dfcfe251f869150dd655141e343a05d153e83e59 Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 8 Sep 2026 18:34:40 -0700
Subject: [PATCH 190/202] vfs: return FileHandle from fs.promises.open

Wrap mounted virtual file descriptors in the public FileHandle
interface while delegating operations to the underlying provider
handle.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65730
Fixes: https://github.com/nodejs/node/issues/65729
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/vfs/fd.js                | 39 +++++++++++++++++++++++++++
 lib/internal/vfs/setup.js             |  5 ++--
 test/parallel/test-vfs-fs-promises.js |  3 +++
 3 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/lib/internal/vfs/fd.js b/lib/internal/vfs/fd.js
index bd36ad218f48..1d1ffaabc78d 100644
--- a/lib/internal/vfs/fd.js
+++ b/lib/internal/vfs/fd.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const {
+  FunctionPrototypeBind,
+  ObjectDefineProperty,
   SafeMap,
   Symbol,
 } = primordials;
@@ -46,6 +48,42 @@ class VirtualFD {
   get entry() {
     return this[kEntry];
   }
+
+  getAsyncId() {
+    return this[kFd];
+  }
+
+  async close() {
+    await this[kEntry].close();
+    closeVirtualFd(this[kFd]);
+  }
+
+  closeSync() {
+    this[kEntry].closeSync();
+    closeVirtualFd(this[kFd]);
+  }
+}
+
+const vfsFileHandleMethods = [
+  'appendFile', 'chmod', 'chown', 'datasync', 'sync', 'read', 'readv',
+  'readFile', 'stat', 'truncate', 'utimes', 'write', 'writev', 'writeFile',
+];
+let FileHandle;
+
+function createVfsFileHandle(vfd) {
+  FileHandle ??= require('internal/fs/promises').FileHandle;
+  const fileHandle = new FileHandle(vfd);
+  const entry = vfd.entry;
+  for (let i = 0; i < vfsFileHandleMethods.length; i++) {
+    const method = vfsFileHandleMethods[i];
+    ObjectDefineProperty(fileHandle, method, {
+      __proto__: null,
+      configurable: true,
+      value: FunctionPrototypeBind(entry[method], entry),
+      writable: true,
+    });
+  }
+  return fileHandle;
 }
 
 /**
@@ -81,6 +119,7 @@ function closeVirtualFd(fd) {
 module.exports = {
   VFS_FD_MASK,
   VirtualFD,
+  createVfsFileHandle,
   openVirtualFd,
   getVirtualFd,
   closeVirtualFd,
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index 3e6f246d794a..7231d10825ea 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -30,7 +30,7 @@ const {
   getLayerIdFromPath,
   getNormalizedVfsRoot,
 } = require('internal/vfs/router');
-const { getVirtualFd, closeVirtualFd } = require('internal/vfs/fd');
+const { getVirtualFd, closeVirtualFd, createVfsFileHandle } = require('internal/vfs/fd');
 const { assertEncoding, setVfsHandlers } = require('internal/fs/utils');
 const permission = require('internal/process/permission');
 const { getOptionValue } = require('internal/options');
@@ -786,8 +786,7 @@ function createVfsHandlers() {
         const r = findVFSForPath(pathStr);
         if (r !== null) {
           const fd = r.vfs.openSync(r.path, flags, mode);
-          const vfd = getVirtualFd(fd);
-          return PromiseResolve(vfd.entry);
+          return PromiseResolve(createVfsFileHandle(getVirtualFd(fd)));
         }
       }
       return undefined;
diff --git a/test/parallel/test-vfs-fs-promises.js b/test/parallel/test-vfs-fs-promises.js
index a5761d4ca5dd..af39fdf92b42 100644
--- a/test/parallel/test-vfs-fs-promises.js
+++ b/test/parallel/test-vfs-fs-promises.js
@@ -86,6 +86,9 @@ const vfs = require('node:vfs');
 
   // FileHandle via fsp.open
   const handle = await fsp.open(p('src/hello.txt'), 'r');
+  assert.strictEqual(handle.constructor.name, 'FileHandle');
+  assert.strictEqual(typeof handle.fd, 'number');
+  assert.strictEqual(typeof handle.createReadStream, 'function');
   assert.strictEqual(await handle.readFile('utf8'), 'hello');
   await handle.close();
 

From cb9b8708c93e992fa0a1e15eec1c0333bb07e465 Mon Sep 17 00:00:00 2001
From: Richard Lau <richard.lau@ibm.com>
Date: Wed, 9 Sep 2026 03:51:23 +0100
Subject: [PATCH 191/202] build: sync cargo/rustc version warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The version checks in `configure.py` were not updated when the minimum
rustc requirement was bumped to 1.86 for temporal_rs 0.2.3.

Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/65912
Refs: https://github.com/nodejs/node/pull/64543
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 configure.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/configure.py b/configure.py
index 84a688917efe..8b3332a461f4 100755
--- a/configure.py
+++ b/configure.py
@@ -1669,8 +1669,8 @@ def check_compiler(o):
   # cargo and rustc are needed for Temporal.
   if not options.v8_disable_temporal_support and not options.shared_temporal_capi:
     # Minimum cargo and rustc versions should match values in BUILDING.md.
-    min_cargo_ver_tuple = (1, 82)
-    min_rustc_ver_tuple = (1, 82)
+    min_cargo_ver_tuple = (1, 86)
+    min_rustc_ver_tuple = (1, 86)
     cargo = os.environ.get('CARGO', 'cargo')
     cargo_ver = get_cargo_version(cargo)
     print_verbose(f'Detected cargo (CARGO={cargo}): {cargo_ver}')

From 1dd48de141eb025917c2ecd700cada401dc450cd Mon Sep 17 00:00:00 2001
From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Date: Tue, 8 Sep 2026 22:27:35 -0700
Subject: [PATCH 192/202] vfs: reject statfs for missing paths

Validate mounted VFS paths before returning synthetic statfs data
so fs.statfsSync() and fs.promises.statfs() report ENOENT for missing
paths. Forward validation errors asynchronously to fs.statfs()
callbacks.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65693
Fixes: https://github.com/nodejs/node/issues/65692
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/fs.js                             |  8 +++++++-
 lib/internal/vfs/setup.js             |  5 +++--
 test/parallel/test-vfs-fs-promises.js |  5 +++++
 test/parallel/test-vfs-fs-statSync.js | 17 ++++++++++++++++-
 4 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/lib/fs.js b/lib/fs.js
index ad90551f40f1..10ab1cb2ecae 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -2050,7 +2050,13 @@ function statfs(path, options = { __proto__: null, bigint: false }, callback) {
 
   const h = vfsState.handlers;
   if (h !== null) {
-    const result = h.statfsSync(path, options);
+    let result;
+    try {
+      result = h.statfsSync(path, options);
+    } catch (err) {
+      process.nextTick(callback, err);
+      return;
+    }
     if (result !== undefined) {
       process.nextTick(callback, null, result);
       return;
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index 7231d10825ea..3e183e422831 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -320,6 +320,7 @@ function findVFSWith(filename, syscall, fn) {
   const r = findVFS(filename);
   if (r === null) return undefined;
   if (r.vfs.existsSync(filename)) {
+    if (fn === undefined) return true;
     return fn(r.vfs, filename);
   }
   throw createENOENT(syscall, filename);
@@ -432,7 +433,7 @@ function createVfsHandlers() {
     },
     statfsSync(path, options) {
       const pathStr = toPathStr(path);
-      if (pathStr !== null && findVFSForPath(pathStr) !== null) {
+      if (pathStr !== null && findVFSWith(pathStr, 'statfs')) {
         if (options?.bigint) {
           return {
             type: 0n, bsize: 4096n, blocks: 0n,
@@ -709,7 +710,7 @@ function createVfsHandlers() {
       vfsOp(path, (vfs, n) => vfs.promises.lutimes(n, atime, mtime).then(() => true)),
     statfs(path, options) {
       const pathStr = toPathStr(path);
-      if (pathStr !== null && findVFSForPath(pathStr) !== null) {
+      if (pathStr !== null && findVFSWith(pathStr, 'statfs')) {
         if (options?.bigint) {
           return {
             __proto__: null,
diff --git a/test/parallel/test-vfs-fs-promises.js b/test/parallel/test-vfs-fs-promises.js
index af39fdf92b42..b720aad37ccc 100644
--- a/test/parallel/test-vfs-fs-promises.js
+++ b/test/parallel/test-vfs-fs-promises.js
@@ -31,6 +31,11 @@ const vfs = require('node:vfs');
   // statfs
   const sfs = await fsp.statfs(p('src/hello.txt'));
   assert.strictEqual(typeof sfs.bsize, 'number');
+  await assert.rejects(fsp.statfs(p('missing')), {
+    code: 'ENOENT',
+    syscall: 'statfs',
+    path: p('missing'),
+  });
 
   // Path-based writes
   await fsp.writeFile(p('src/pw.txt'), 'pdata');
diff --git a/test/parallel/test-vfs-fs-statSync.js b/test/parallel/test-vfs-fs-statSync.js
index 5a48c4e426fa..6e5d27c3059e 100644
--- a/test/parallel/test-vfs-fs-statSync.js
+++ b/test/parallel/test-vfs-fs-statSync.js
@@ -4,7 +4,7 @@
 // fs.statSync / fs.lstatSync / fs.statfsSync dispatch through the VFS layer,
 // including the `throwIfNoEntry: false` option.
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
@@ -57,4 +57,19 @@ assert.strictEqual(
   assert.strictEqual(typeof s.bsize, 'bigint');
 }
 
+// statfsSync on a missing path throws ENOENT
+assert.throws(() => fs.statfsSync(path.join(mountPoint, 'missing')),
+              {
+                code: 'ENOENT',
+                syscall: 'statfs',
+                path: path.join(mountPoint, 'missing'),
+              });
+
+// Statfs on a missing path reports ENOENT through the callback
+fs.statfs(path.join(mountPoint, 'missing'), common.mustCall((err) => {
+  assert.strictEqual(err.code, 'ENOENT');
+  assert.strictEqual(err.syscall, 'statfs');
+  assert.strictEqual(err.path, path.join(mountPoint, 'missing'));
+}));
+
 myVfs.unmount();

From 8c9d14118b85b86ea118e053ba9634f980ae1990 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 9 Sep 2026 09:34:30 +0200
Subject: [PATCH 193/202] tools: unlabel author ready on base branch conflicts

Add a daily workflow that removes the `[author ready]` label from open
pull requests conflicting with their base branch and comments with
rebase guidance.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65872
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
---
 .github/workflows/author-ready-conflicts.yml | 48 ++++++++++++++++++++
 doc/contributing/collaborator-guide.md       |  1 +
 2 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/author-ready-conflicts.yml

diff --git a/.github/workflows/author-ready-conflicts.yml b/.github/workflows/author-ready-conflicts.yml
new file mode 100644
index 000000000000..f447c6b80a2e
--- /dev/null
+++ b/.github/workflows/author-ready-conflicts.yml
@@ -0,0 +1,48 @@
+name: Unlabel not-ready pull requests
+
+on:
+  schedule:
+    - cron: 15 3 * * *
+
+permissions:
+  contents: read
+
+jobs:
+  remove-label:
+    name: Remove author ready
+    if: github.repository == 'nodejs/node'
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Remove the label and comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MESSAGE: >-
+            This pull request has conflicts with its base branch, removing the
+            `author ready` label.
+
+            Please
+            [rebase](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-5-rebase)
+            your branch onto the latest base branch, resolve the conflicts
+            locally, and force-push.
+
+            Afterwards the pull request needs a fresh collaborator approval,
+            and a collaborator will add the label back once it is
+            [author ready](https://github.com/nodejs/node/blob/HEAD/doc/contributing/collaborator-guide.md#author-ready-pull-requests)
+            again.
+        run: |
+          # Requesting the mergeable field makes GitHub compute the merge state,
+          # pull requests still reported as UNKNOWN are picked up by a later run.
+          gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --label 'author ready' \
+            --state open \
+            --limit 100 \
+            --json number,mergeable \
+            --jq '.[] | select(.mergeable == "CONFLICTING") | .number' |
+            while read -r number; do
+              gh pr edit "$number" --repo "$GITHUB_REPOSITORY" --remove-label 'author ready'
+              printf '%s\n' "$MESSAGE" |
+                gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body-file -
+            done
diff --git a/doc/contributing/collaborator-guide.md b/doc/contributing/collaborator-guide.md
index 2966f4dfeec0..49ece70c2bb0 100644
--- a/doc/contributing/collaborator-guide.md
+++ b/doc/contributing/collaborator-guide.md
@@ -87,6 +87,7 @@ A pull request is _author ready_ when:
 * There is a CI run in progress or completed.
 * There is at least one collaborator approval.
 * There are no outstanding review comments.
+* There are no conflicts with the base branch.
 
 Please always add the `author ready` label to the pull request in that case.
 Please always remove it again as soon as the conditions are not met anymore.

From b12688c6e6e59d439779be91c940d5bc3f67d3fa Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Wed, 9 Sep 2026 09:46:46 +0200
Subject: [PATCH 194/202] http2: add new connectionWindowSize option

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65619
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
---
 doc/api/http2.md                              |  44 ++++++-
 lib/internal/http2/core.js                    |  59 +++++-----
 lib/internal/http2/util.js                    |   8 +-
 src/node_http2.cc                             |  19 +--
 src/node_http2.h                              |  15 ++-
 src/node_http2_state.h                        |   1 +
 ...est-http2-connection-window-size-option.js | 108 ++++++++++++++++++
 .../test-http2-util-update-options-buffer.js  |  11 +-
 8 files changed, 218 insertions(+), 47 deletions(-)
 create mode 100644 test/parallel/test-http2-connection-window-size-option.js

diff --git a/doc/api/http2.md b/doc/api/http2.md
index fe31f970b2f4..f3d8ff6d85fc 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -669,10 +669,16 @@ added:
 
 * `windowSize` {number}
 
-Sets the local endpoint's window size.
+Sets the local endpoint's connection-level window size.
 The `windowSize` is the total window size to set, not
 the delta.
 
+Increases take effect immediately, but decreases only apply as the window
+already advertised to the peer is consumed, since a window that has been
+advertised cannot be retracted. To use a window smaller than the default from
+the start of the connection, set the `connectionWindowSize` option when
+creating the server or client session instead.
+
 ```mjs
 import { createServer } from 'node:http2';
 
@@ -2844,6 +2850,9 @@ Throws `ERR_INVALID_ARG_TYPE` for invalid `settings` argument.
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65619
+    description: Added the `connectionWindowSize` option.
   - version:
      - v25.7.0
      - v24.15.0
@@ -2961,6 +2970,13 @@ changes:
     error that should tell the peer to not open any more streams, continuing
     to open streams is therefore regarded as a sign of a misbehaving peer.
     **Default:** `100`.
+  * `connectionWindowSize` {number} Sets the initial flow control window for
+    each session, in bytes. This is the total amount of data the remote peer
+    may send across all streams before it has to wait for a `WINDOW_UPDATE`.
+    The equivalent per-stream limit is `settings.initialWindowSize`. The
+    minimum allowed value is `1` and the maximum is 2<sup>31</sup>-1. Values
+    below 65535 will not take effect until the initial protocol-default
+    window of 65535 has been used.
   * `settings` {HTTP/2 Settings Object} The initial settings to send to the
     remote peer upon connection.
   * `streamResetBurst` {number} and `streamResetRate` {number} Sets the rate
@@ -3072,6 +3088,9 @@ server.listen(8000);
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65619
+    description: Added the `connectionWindowSize` option.
   - version:
      - v25.7.0
      - v24.15.0
@@ -3180,6 +3199,14 @@ changes:
     error that should tell the peer to not open any more streams, continuing
     to open streams is therefore regarded as a sign of a misbehaving peer.
     **Default:** `100`.
+  * `connectionWindowSize` {number} Sets the initial flow control window for
+    each session, in bytes. This is the total amount of data the remote peer
+    may send across all streams before it has to wait for a `WINDOW_UPDATE`.
+    The equivalent per-stream limit is `settings.initialWindowSize`. The
+    minimum allowed value is `1` and the maximum is 2<sup>31</sup>-1. Values
+    below 65535 will not take effect until the initial protocol-default
+    window of 65535 has been used.
+    **Default:** `33554432`.
   * `settings` {HTTP/2 Settings Object} The initial settings to send to the
     remote peer upon connection.
   * `streamResetBurst` {number} and `streamResetRate` {number} Sets the rate
@@ -3276,6 +3303,9 @@ server.listen(8443);
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65619
+    description: Added the `connectionWindowSize` option.
   - version:
       - v15.10.0
       - v14.16.0
@@ -3363,6 +3393,14 @@ changes:
   * `protocol` {string} The protocol to connect with, if not set in the
     `authority`. Value may be either `'http:'` or `'https:'`. **Default:**
     `'https:'`
+  * `connectionWindowSize` {number} Sets the initial flow control window for
+    this session, in bytes. This is the total amount of data the remote peer
+    may send across all streams before it has to wait for a `WINDOW_UPDATE`.
+    The equivalent per-stream limit is `settings.initialWindowSize`. The
+    minimum allowed value is `1` and the maximum is 2<sup>31</sup>-1. Values
+    below 65535 will not take effect until the initial protocol-default
+    window of 65535 has been used.
+    **Default:** `33554432`.
   * `settings` {HTTP/2 Settings Object} The initial settings to send to the
     remote peer upon connection.
   * `remoteCustomSettings` {Array} The array of integer values determines the
@@ -3795,6 +3833,9 @@ properties.
 * `initialWindowSize` {number} Specifies the _sender's_ initial window size in
   bytes for stream-level flow control. The minimum allowed value is 0. The
   maximum allowed value is 2<sup>32</sup>-1. **Default:** `4194304`.
+  This is a per-stream limit; the window for the connection as a whole is
+  configured separately with the `connectionWindowSize` option of
+  [`http2.createServer()`][] or [`http2.connect()`][].
 * `maxFrameSize` {number} Specifies the size in bytes of the largest frame
   payload. The minimum allowed value is 16,384. The maximum allowed value is
   2<sup>24</sup>-1. **Default:** `16384`.
@@ -5258,6 +5299,7 @@ you need to implement any fall-back behavior yourself.
 [`http.createServer()`]: http.md#httpcreateserveroptions-requestlistener
 [`http2.SecureServer`]: #class-http2secureserver
 [`http2.Server`]: #class-http2server
+[`http2.connect()`]: #http2connectauthority-options-listener
 [`http2.createSecureServer()`]: #http2createsecureserveroptions-onrequesthandler
 [`http2.createServer()`]: #http2createserveroptions-onrequesthandler
 [`http2stream.pushStream()`]: #http2streampushstreamheaders-options-callback
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 4700120b0dd4..ceb173aa04e6 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -241,6 +241,8 @@ function debugSessionObj(session, message, ...args) {
 const kMaxFrameSize = (2 ** 24) - 1;
 const kMaxInt = (2 ** 32) - 1;
 const kMaxInitialWindowSize = (2 ** 31) - 1;  // HTTP/2 spec maximum
+// A connection window of 0 stalls the connection
+const kMinConnectionWindowSize = 1;
 const kMaxStreams = (2 ** 32) - 1;
 const kMaxALTSVC = (2 ** 14) - 2;
 
@@ -3590,12 +3592,8 @@ function connectionListener(socket) {
   this.emit('session', session);
 }
 
-function initializeOptions(options) {
-  assertIsObject(options, 'options');
-  options = { ...options };
-  assertIsObject(options.settings, 'options.settings');
-  options.settings = { ...options.settings };
-
+// Validates the session options that apply to both client and server sessions
+function validateSessionOptions(options) {
   assertIsArray(options.remoteCustomSettings, 'options.remoteCustomSettings');
   if (options.remoteCustomSettings) {
     options.remoteCustomSettings = [ ...options.remoteCustomSettings ];
@@ -3603,6 +3601,29 @@ function initializeOptions(options) {
       throw new ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS();
   }
 
+  if (options.strictSingleValueFields !== undefined) {
+    validateBoolean(
+      options.strictSingleValueFields,
+      'options.strictSingleValueFields',
+    );
+  } else {
+    options.strictSingleValueFields = true;
+  }
+
+  if (options.connectionWindowSize !== undefined) {
+    validateInt32(options.connectionWindowSize, 'options.connectionWindowSize',
+                  kMinConnectionWindowSize, kMaxInitialWindowSize);
+  }
+}
+
+function initializeOptions(options) {
+  assertIsObject(options, 'options');
+  options = { ...options };
+  assertIsObject(options.settings, 'options.settings');
+  options.settings = { ...options.settings };
+
+  validateSessionOptions(options);
+
   if (options.maxSessionInvalidFrames !== undefined)
     validateUint32(options.maxSessionInvalidFrames, 'options.maxSessionInvalidFrames');
 
@@ -3619,16 +3640,6 @@ function initializeOptions(options) {
     // TODO(danbev): is this a good default value?
     options.unknownProtocolTimeout = 10000;
 
-  if (options.strictSingleValueFields !== undefined) {
-    validateBoolean(
-      options.strictSingleValueFields,
-      'options.strictSingleValueFields',
-    );
-  } else {
-    options.strictSingleValueFields = true;
-  }
-
-
   // Initialize http1Options bag for HTTP/1 fallback when allowHTTP1 is true.
   // This bag is passed to storeHTTPOptions() to configure HTTP/1 server
   // behavior (timeouts, IncomingMessage/ServerResponse classes, etc.).
@@ -3840,21 +3851,7 @@ function connect(authority, options, listener) {
     maxOriginSetSize = 128;
   }
 
-  assertIsArray(options.remoteCustomSettings, 'options.remoteCustomSettings');
-  if (options.remoteCustomSettings) {
-    options.remoteCustomSettings = [ ...options.remoteCustomSettings ];
-    if (options.remoteCustomSettings.length > MAX_ADDITIONAL_SETTINGS)
-      throw new ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS();
-  }
-
-  if (options.strictSingleValueFields !== undefined) {
-    validateBoolean(
-      options.strictSingleValueFields,
-      'options.strictSingleValueFields',
-    );
-  } else {
-    options.strictSingleValueFields = true;
-  }
+  validateSessionOptions(options);
 
   if (typeof authority === 'string')
     authority = new URL(authority);
diff --git a/lib/internal/http2/util.js b/lib/internal/http2/util.js
index 159ba5bd5315..e2e6288b9ec6 100644
--- a/lib/internal/http2/util.js
+++ b/lib/internal/http2/util.js
@@ -233,7 +233,8 @@ const IDX_OPTIONS_MAX_SETTINGS = 9;
 const IDX_OPTIONS_STREAM_RESET_RATE = 10;
 const IDX_OPTIONS_STREAM_RESET_BURST = 11;
 const IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION = 12;
-const IDX_OPTIONS_FLAGS = 13;
+const IDX_OPTIONS_CONNECTION_WINDOW_SIZE = 13;
+const IDX_OPTIONS_FLAGS = 14;
 
 function updateOptionsBuffer(options) {
   let flags = 0;
@@ -303,6 +304,11 @@ function updateOptionsBuffer(options) {
     optionsBuffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION] =
       options.strictFieldWhitespaceValidation === true ? 0 : 1;
   }
+  if (typeof options.connectionWindowSize === 'number') {
+    flags |= (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE);
+    optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE] =
+      options.connectionWindowSize;
+  }
 
   optionsBuffer[IDX_OPTIONS_FLAGS] = flags;
 }
diff --git a/src/node_http2.cc b/src/node_http2.cc
index 4ce35dc37c23..f5018d10d7ee 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -217,6 +217,11 @@ Http2Options::Http2Options(Http2State* http2_state, SessionType type) {
         static_cast<size_t>(buffer[IDX_OPTIONS_MAX_SETTINGS]));
   }
 
+  if (flags & (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE)) {
+    set_connection_window_size(
+        static_cast<int32_t>(buffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE]));
+  }
+
   if ((flags & (1 << IDX_OPTIONS_STREAM_RESET_BURST)) &&
       (flags & (1 << IDX_OPTIONS_STREAM_RESET_RATE))) {
     nghttp2_option_set_stream_reset_rate_limit(
@@ -612,15 +617,13 @@ Http2Session::Http2Session(Http2State* http2_state,
       &alloc_info), 0);
   session_.reset(session);
 
-  // Increase the default local connection window to improve throughput
-  // on high-latency connections. The default 64KB window limits throughput
-  // to window_size / RTT. With a 32MB connection window, throughput is
-  // significantly improved. See https://github.com/nodejs/node/issues/38426
+  // The default connection window is larger than the 64KB required by the
+  // spec to improve throughput on high-latency connections, where throughput
+  // is limited to window_size / RTT. User settings have to be applied here
+  // initially rather than updating later as windows cannot be shrunk after
+  // they've been advertised.
   CHECK_EQ(nghttp2_session_set_local_window_size(
-               session,
-               NGHTTP2_FLAG_NONE,
-               0,
-               DEFAULT_SETTINGS_LOCAL_CONNECTION_WINDOW_SIZE),
+               session, NGHTTP2_FLAG_NONE, 0, opts.connection_window_size()),
            0);
 
   outgoing_storage_.reserve(1024);
diff --git a/src/node_http2.h b/src/node_http2.h
index f3edcf658f80..c042c46ab595 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -39,6 +39,10 @@ constexpr size_t kDefaultMaxSettings = 10;
 // Default maximum total memory cap for Http2Session.
 constexpr uint64_t kDefaultMaxSessionMemory = 10000000;
 
+// Default connection-level flow control window (32MB) to improve throughput
+// on high-latency connections. See https://github.com/nodejs/node/issues/38426
+constexpr int32_t kDefaultConnectionWindowSize = 33554432;
+
 // These are the standard HTTP/2 defaults as specified by the RFC
 constexpr uint32_t DEFAULT_SETTINGS_HEADER_TABLE_SIZE = 4096;
 constexpr uint32_t DEFAULT_SETTINGS_ENABLE_PUSH = 1;
@@ -51,10 +55,6 @@ constexpr uint32_t MAX_MAX_FRAME_SIZE = 16777215;
 constexpr uint32_t MIN_MAX_FRAME_SIZE = DEFAULT_SETTINGS_MAX_FRAME_SIZE;
 constexpr uint32_t MAX_INITIAL_WINDOW_SIZE = 2147483647;
 
-// Default local connection window size (32MB) to improve throughput
-// on high-latency connections. See https://github.com/nodejs/node/issues/38426
-constexpr uint32_t DEFAULT_SETTINGS_LOCAL_CONNECTION_WINDOW_SIZE = 33554432;
-
 // Stream is not going to have any DATA frames
 constexpr int STREAM_OPTION_EMPTY_PAYLOAD = 0x1;
 
@@ -245,9 +245,16 @@ class Http2Options {
     return max_session_memory_;
   }
 
+  void set_connection_window_size(int32_t size) {
+    connection_window_size_ = size;
+  }
+
+  int32_t connection_window_size() const { return connection_window_size_; }
+
  private:
   Nghttp2OptionPointer options_;
   uint64_t max_session_memory_ = kDefaultMaxSessionMemory;
+  int32_t connection_window_size_ = kDefaultConnectionWindowSize;
   uint32_t max_header_pairs_ = DEFAULT_MAX_HEADER_LIST_PAIRS;
   PaddingStrategy padding_strategy_ = PADDING_STRATEGY_NONE;
   size_t max_outstanding_pings_ = kDefaultMaxPings;
diff --git a/src/node_http2_state.h b/src/node_http2_state.h
index 914ad011e021..33fe342fd0b7 100644
--- a/src/node_http2_state.h
+++ b/src/node_http2_state.h
@@ -61,6 +61,7 @@ namespace http2 {
     IDX_OPTIONS_STREAM_RESET_RATE,
     IDX_OPTIONS_STREAM_RESET_BURST,
     IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION,
+    IDX_OPTIONS_CONNECTION_WINDOW_SIZE,
     IDX_OPTIONS_FLAGS
   };
 
diff --git a/test/parallel/test-http2-connection-window-size-option.js b/test/parallel/test-http2-connection-window-size-option.js
new file mode 100644
index 000000000000..ddf5932fb28d
--- /dev/null
+++ b/test/parallel/test-http2-connection-window-size-option.js
@@ -0,0 +1,108 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const http2 = require('http2');
+
+const DEFAULT_WINDOW = 33554432;
+const SPEC_DEFAULT_WINDOW = 65535;
+
+// Set client & server's windows (or default if undefined) and validate that
+// the both peers see the remote value as expected.
+function check(serverWindow, clientWindow) {
+  const server = http2.createServer({ connectionWindowSize: serverWindow });
+  serverWindow ??= DEFAULT_WINDOW;
+  clientWindow ??= DEFAULT_WINDOW;
+
+  server.on('session', common.mustCall((session) => {
+    assert.strictEqual(session.state.effectiveLocalWindowSize, serverWindow);
+  }));
+
+  server.on('stream', common.mustCall((stream) => {
+    assert.strictEqual(stream.session.state.remoteWindowSize, clientWindow);
+    stream.respond({ ':status': 200 }, { endStream: true });
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    const client = http2.connect(`http://localhost:${server.address().port}`,
+                                 { connectionWindowSize: clientWindow });
+
+    client.on('connect', common.mustCall(() => {
+      assert.strictEqual(client.state.effectiveLocalWindowSize, clientWindow);
+    }));
+
+    const req = client.request();
+    req.resume();
+    req.on('close', common.mustCall(() => {
+      assert.strictEqual(client.state.remoteWindowSize, serverWindow);
+      client.close();
+      server.close();
+    }));
+  }));
+}
+
+check(undefined, undefined);
+
+// The option shrinks the window below the default, which setLocalWindowSize()
+// cannot do once the connection has been established.
+check(SPEC_DEFAULT_WINDOW, SPEC_DEFAULT_WINDOW);
+
+// Each end of the connection is configured independently.
+check(2 ** 20, 2 ** 21);
+
+// A window below the peer's fixed initial 65535 is the only case that shrinks
+// the window nghttp2 has already accounted for, leaving a reduction to pay off
+// before any WINDOW_UPDATE can be sent again. Larger windows, including the
+// default, only ever grow it. Send more than the window to prove the
+// connection still resumes rather than stalling once the reduction is paid.
+{
+  const windowSize = 16384;
+  const payload = Buffer.alloc(2 ** 18, 'x');
+  const server = http2.createServer({ connectionWindowSize: windowSize });
+
+  server.on('stream', common.mustCall((stream) => {
+    let received = 0;
+    stream.on('data', (chunk) => { received += chunk.length; });
+    stream.on('end', common.mustCall(() => {
+      assert.strictEqual(received, payload.length);
+      stream.respond({ ':status': 200 }, { endStream: true });
+    }));
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    const client = http2.connect(`http://localhost:${server.address().port}`,
+                                 { connectionWindowSize: windowSize });
+    const req = client.request({ ':method': 'POST', ':path': '/' });
+    req.resume();
+    req.end(payload);
+    req.on('close', common.mustCall(() => {
+      client.close();
+      server.close();
+    }));
+  }));
+}
+
+for (const connectionWindowSize of [-1, 0, 2 ** 31, 1.5]) {
+  assert.throws(() => http2.createServer({ connectionWindowSize }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => http2.createSecureServer({ connectionWindowSize }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => http2.connect('http://localhost:80', { connectionWindowSize }),
+                { code: 'ERR_OUT_OF_RANGE' });
+}
+
+// Windows below the peer's fixed initial 65535 are permitted: they cannot
+// shrink that first burst, but they do throttle everything after it.
+for (const connectionWindowSize of [1, 1024, 65534]) {
+  http2.createServer({ connectionWindowSize }).close();
+}
+
+for (const connectionWindowSize of ['1024', null, {}]) {
+  assert.throws(() => http2.createServer({ connectionWindowSize }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => http2.connect('http://localhost:80', { connectionWindowSize }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
diff --git a/test/parallel/test-http2-util-update-options-buffer.js b/test/parallel/test-http2-util-update-options-buffer.js
index 888ddd287cf1..c046395f1a88 100644
--- a/test/parallel/test-http2-util-update-options-buffer.js
+++ b/test/parallel/test-http2-util-update-options-buffer.js
@@ -26,7 +26,8 @@ const IDX_OPTIONS_MAX_SETTINGS = 9;
 const IDX_OPTIONS_STREAM_RESET_RATE = 10;
 const IDX_OPTIONS_STREAM_RESET_BURST = 11;
 const IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION = 12;
-const IDX_OPTIONS_FLAGS = 13;
+const IDX_OPTIONS_CONNECTION_WINDOW_SIZE = 13;
+const IDX_OPTIONS_FLAGS = 14;
 
 {
   updateOptionsBuffer({
@@ -42,7 +43,8 @@ const IDX_OPTIONS_FLAGS = 13;
     maxSettings: 10,
     streamResetRate: 11,
     streamResetBurst: 12,
-    strictFieldWhitespaceValidation: false
+    strictFieldWhitespaceValidation: false,
+    connectionWindowSize: 13
   });
 
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_DEFLATE_DYNAMIC_TABLE_SIZE], 1);
@@ -58,6 +60,7 @@ const IDX_OPTIONS_FLAGS = 13;
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_STREAM_RESET_RATE], 11);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_STREAM_RESET_BURST], 12);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION], 1);
+  assert.strictEqual(optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE], 13);
 
   const flags = optionsBuffer[IDX_OPTIONS_FLAGS];
 
@@ -73,11 +76,13 @@ const IDX_OPTIONS_FLAGS = 13;
   assert.ok(flags & (1 << IDX_OPTIONS_STREAM_RESET_RATE));
   assert.ok(flags & (1 << IDX_OPTIONS_STREAM_RESET_BURST));
   assert.ok(flags & (1 << IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION));
+  assert.ok(flags & (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE));
 }
 
 {
   optionsBuffer[IDX_OPTIONS_MAX_SEND_HEADER_BLOCK_LENGTH] = 0;
   optionsBuffer[IDX_OPTIONS_MAX_OUTSTANDING_PINGS] = 0;
+  optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE] = 0;
 
   updateOptionsBuffer({
     maxDeflateDynamicTableSize: 1,
@@ -94,6 +99,7 @@ const IDX_OPTIONS_FLAGS = 13;
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_HEADER_LIST_PAIRS], 6);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_SEND_HEADER_BLOCK_LENGTH], 0);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_OUTSTANDING_PINGS], 0);
+  assert.strictEqual(optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE], 0);
 
   const flags = optionsBuffer[IDX_OPTIONS_FLAGS];
 
@@ -105,4 +111,5 @@ const IDX_OPTIONS_FLAGS = 13;
 
   assert.ok(!(flags & (1 << IDX_OPTIONS_MAX_SEND_HEADER_BLOCK_LENGTH)));
   assert.ok(!(flags & (1 << IDX_OPTIONS_MAX_OUTSTANDING_PINGS)));
+  assert.ok(!(flags & (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE)));
 }

From 875d905390676f826513bf70a43a79af150cbee8 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 8 Sep 2026 11:26:24 +0200
Subject: [PATCH 195/202] Revert "deps: V8: backport b36cf9f6ccd2"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit ccd648eb0cf0bbf1fee0ffa9a6fc91f9101ce508.

PR-URL: https://github.com/nodejs/node/pull/65907
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 deps/v8/BUILD.bazel                           |  6 ----
 deps/v8/BUILD.gn                              | 11 ------
 deps/v8/src/common/assert-scope.h             |  2 +-
 deps/v8/src/execution/isolate.cc              |  7 ----
 deps/v8/src/inspector/v8-debugger.cc          |  1 -
 deps/v8/src/inspector/v8-inspector-impl.cc    |  1 -
 .../inspector/v8-inspector-session-impl.cc    |  2 --
 deps/v8/src/inspector/v8-regex.cc             |  2 --
 deps/v8/test/cctest/test-api.cc               | 20 -----------
 deps/v8/test/cctest/test-regexp.cc            |  8 +----
 .../debugger/debug/futex-reentrant-wait.js    | 35 -------------------
 11 files changed, 2 insertions(+), 93 deletions(-)
 delete mode 100644 deps/v8/test/debugger/debug/futex-reentrant-wait.js

diff --git a/deps/v8/BUILD.bazel b/deps/v8/BUILD.bazel
index 53c06e3ceccf..f28fea4e8aa1 100644
--- a/deps/v8/BUILD.bazel
+++ b/deps/v8/BUILD.bazel
@@ -148,11 +148,6 @@ v8_flag(name = "v8_enable_trace_maps")
 
 v8_flag(name = "v8_enable_v8_checks")
 
-v8_flag(
-    name = "v8_disallow_js_in_api_interrupts_is_checked",
-    default = True,
-)
-
 v8_flag(name = "v8_enable_verify_csa")
 
 v8_flag(name = "v8_enable_verify_heap")
@@ -501,7 +496,6 @@ v8_config(
         "v8_android_log_stdout": "V8_ANDROID_LOG_STDOUT",
         "v8_code_comments": "V8_CODE_COMMENTS",
         "v8_deprecation_warnings": "V8_DEPRECATION_WARNINGS",
-        "v8_disallow_js_in_api_interrupts_is_checked": "V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED",
         "v8_imminent_deprecation_warnings": "V8_IMMINENT_DEPRECATION_WARNINGS",
         "v8_enable_debug_code": "V8_ENABLE_DEBUG_CODE",
         "v8_enable_disassembler": "ENABLE_DISASSEMBLER",
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index ea335df90341..e81430fbc393 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -59,10 +59,6 @@ declare_args() {
   # Enable compiler warnings when using V8_DEPRECATED apis.
   v8_deprecation_warnings = true
 
-  # Check that executing JavaScript inside API interrupt callbacks is
-  # disallowed.
-  v8_disallow_js_in_api_interrupts_is_checked = true
-
   # Enable compiler warnings when using V8_DEPRECATE_SOON apis.
   v8_imminent_deprecation_warnings = true
 
@@ -1003,7 +999,6 @@ external_v8_defines = [
   "V8_COMPRESS_ZONES",
   "V8_ENABLE_SANDBOX",
   "V8_DEPRECATION_WARNINGS",
-  "V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED",
   "V8_IMMINENT_DEPRECATION_WARNINGS",
   "V8_USE_PERFETTO",
   "V8_USE_PERFETTO_JSON_EXPORT",
@@ -1052,10 +1047,6 @@ if (v8_enable_sandbox) {
 if (v8_deprecation_warnings) {
   enabled_external_v8_defines += [ "V8_DEPRECATION_WARNINGS" ]
 }
-if (v8_disallow_js_in_api_interrupts_is_checked) {
-  enabled_external_v8_defines +=
-      [ "V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED" ]
-}
 if (v8_imminent_deprecation_warnings) {
   enabled_external_v8_defines += [ "V8_IMMINENT_DEPRECATION_WARNINGS" ]
 }
@@ -3102,8 +3093,6 @@ generated_file("v8_generate_features_json") {
   output_conversion = "json"
   contents = {
     v8_deprecation_warnings = v8_deprecation_warnings
-    v8_disallow_js_in_api_interrupts_is_checked =
-        v8_disallow_js_in_api_interrupts_is_checked
     v8_enable_31bit_smis_on_64bit_arch = v8_enable_31bit_smis_on_64bit_arch
     v8_enable_direct_handle = v8_enable_direct_handle
     v8_enable_extensible_ro_snapshot = v8_enable_extensible_ro_snapshot
diff --git a/deps/v8/src/common/assert-scope.h b/deps/v8/src/common/assert-scope.h
index 494d330b3332..cf82be0bc8ee 100644
--- a/deps/v8/src/common/assert-scope.h
+++ b/deps/v8/src/common/assert-scope.h
@@ -110,7 +110,7 @@ class V8_NODISCARD PerThreadAssertScope
     ScopeType& operator=(const ScopeType&) = delete;                 \
     V8_EXPORT_PRIVATE ~ScopeType();                                  \
                                                                      \
-    V8_EXPORT_PRIVATE static bool IsAllowed(Isolate* isolate);       \
+    static bool IsAllowed(Isolate* isolate);                         \
                                                                      \
     V8_EXPORT_PRIVATE static void Open(Isolate* isolate,             \
                                        bool* was_execution_allowed); \
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 37c72639cd7f..74762de5a9aa 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -2357,13 +2357,6 @@ void Isolate::InvokeApiInterruptCallbacks() {
     }
     VMState<EXTERNAL> state(this);
     HandleScope handle_scope(this);
-    // API interrupt callbacks are forbidden from executing JavaScript on the
-    // interrupted Isolate (see v8::Isolate::RequestInterrupt contract in
-    // v8-isolate.h: "Registered |callback| must not reenter interrupted
-    // Isolate.").
-#ifdef V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
-    DisallowJavascriptExecution no_js(this);
-#endif  // V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
     entry.first(reinterpret_cast<v8::Isolate*>(this), entry.second);
   }
 }
diff --git a/deps/v8/src/inspector/v8-debugger.cc b/deps/v8/src/inspector/v8-debugger.cc
index 747abefcedd5..69fb293610bc 100644
--- a/deps/v8/src/inspector/v8-debugger.cc
+++ b/deps/v8/src/inspector/v8-debugger.cc
@@ -532,7 +532,6 @@ void V8Debugger::handleProgramBreak(
         }
       });
   {
-    v8::Isolate::AllowJavascriptExecutionScope allow_script(m_isolate);
     v8::Context::Scope scope(pausedContext);
 
     m_inspector->forEachSession(
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index f085f7f72ec7..a4610e0d9b33 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -96,7 +96,6 @@ int V8InspectorImpl::resolveUniqueContextId(
 
 v8::MaybeLocal<v8::Value> V8InspectorImpl::compileAndRunInternalScript(
     v8::Local<v8::Context> context, v8::Local<v8::String> source) {
-  v8::Isolate::AllowJavascriptExecutionScope allow_script(m_isolate);
   v8::Local<v8::UnboundScript> unboundScript;
   if (!v8::debug::CompileInspectorScript(m_isolate, source)
            .ToLocal(&unboundScript))
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.cc b/deps/v8/src/inspector/v8-inspector-session-impl.cc
index 38d8dd93ea41..95ae57032b32 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.cc
@@ -355,8 +355,6 @@ void V8InspectorSessionImpl::reportAllContexts(V8RuntimeAgentImpl* agent) {
 }
 
 void V8InspectorSessionImpl::dispatchProtocolMessage(StringView message) {
-  v8::Isolate::AllowJavascriptExecutionScope allow_script(
-      m_inspector->isolate());
   KeepSessionAliveScope keepAlive(*this);
 
   using v8_crdtp::span;
diff --git a/deps/v8/src/inspector/v8-regex.cc b/deps/v8/src/inspector/v8-regex.cc
index 09c308f84d38..4adf347843ff 100644
--- a/deps/v8/src/inspector/v8-regex.cc
+++ b/deps/v8/src/inspector/v8-regex.cc
@@ -38,7 +38,6 @@ V8Regex::V8Regex(V8InspectorImpl* inspector, const String16& pattern,
   v8::Local<v8::RegExp> regex;
   // Protect against reentrant debugger calls via interrupts.
   v8::debug::PostponeInterruptsScope no_interrupts(m_inspector->isolate());
-  v8::Isolate::AllowJavascriptExecutionScope allow_js(m_inspector->isolate());
   if (v8::RegExp::New(context, toV8String(isolate, pattern),
                       static_cast<v8::RegExp::Flags>(flags))
           .ToLocal(&regex))
@@ -70,7 +69,6 @@ int V8Regex::match(const String16& string, int startFrom,
                                  v8::MicrotasksScope::kDoNotRunMicrotasks);
   // Protect against reentrant debugger calls via interrupts.
   v8::debug::PostponeInterruptsScope no_interrupts(m_inspector->isolate());
-  v8::Isolate::AllowJavascriptExecutionScope allow_js(m_inspector->isolate());
   v8::TryCatch tryCatch(isolate);
 
   v8::Local<v8::RegExp> regex = m_regex.Get(isolate);
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 9b5fdd3cfd96..ba7e079f411c 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -22306,26 +22306,6 @@ TEST(RequestInterruptSmallScripts) {
   CHECK(interrupt_was_called);
 }
 
-#ifdef V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
-static bool interrupt_check_no_js = false;
-void DisallowJsInterruptCallback(v8::Isolate* isolate, void* data) {
-  CHECK(!i::AllowJavascriptExecution::IsAllowed(
-      reinterpret_cast<i::Isolate*>(isolate)));
-  interrupt_check_no_js = true;
-}
-
-TEST(RequestInterruptDisallowsJavascript) {
-  LocalContext env;
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope scope(isolate);
-
-  interrupt_check_no_js = false;
-  isolate->RequestInterrupt(&DisallowJsInterruptCallback, nullptr);
-  CompileRun("(function(x){return x;})(1);");
-  CHECK(interrupt_check_no_js);
-}
-#endif  // V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED
-
 static v8::Global<Value> function_new_expected_env_global;
 static void FunctionNewCallback(const v8::FunctionCallbackInfo<Value>& info) {
   v8::Isolate* isolate = info.GetIsolate();
diff --git a/deps/v8/test/cctest/test-regexp.cc b/deps/v8/test/cctest/test-regexp.cc
index 08be47b221a8..946695833c64 100644
--- a/deps/v8/test/cctest/test-regexp.cc
+++ b/deps/v8/test/cctest/test-regexp.cc
@@ -124,13 +124,7 @@ class InterruptTest {
     CHECK(string->ContainsOnlyOneByte());
     // Internalize the subject by using it as a computed property name in an
     // object.
-    {
-      // This test is technically wrong for running JS in a C++ interrupt.
-      // However we know that the interuptee here is the regexp engine, which
-      // does not care.
-      Isolate::AllowJavascriptExecutionScope allow_script(isolate);
-      CompileRun("o = { [subject_string]: 'foo' }");
-    }
+    CompileRun("o = { [subject_string]: 'foo' }");
     CHECK(string->IsOneByte());
   }
 
diff --git a/deps/v8/test/debugger/debug/futex-reentrant-wait.js b/deps/v8/test/debugger/debug/futex-reentrant-wait.js
deleted file mode 100644
index fc82beac534e..000000000000
--- a/deps/v8/test/debugger/debug/futex-reentrant-wait.js
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2026 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-var Debug = debug.Debug;
-var exception = null;
-
-Debug.setListener(function (event, exec_state, event_data, data) {
-  if (event == Debug.DebugEvent.Break) {
-    try {
-      var sab2 = new SharedArrayBuffer(4);
-      var i32a2 = new Int32Array(sab2);
-      Atomics.wait(i32a2, 0, 0, 10);
-    } catch (e) {
-      exception = e;
-    }
-  }
-});
-
-let sab = new SharedArrayBuffer(4);
-let i32a = new Int32Array(sab);
-
-let timeout = {
-  valueOf: function() {
-    %ScheduleBreak();
-    return 10;
-  }
-};
-
-Atomics.wait(i32a, 0, 0, timeout);
-
-assertNotNull(exception);
-assertTrue(exception.message.includes("cannot be called in this context"));

From 8b52f14ae5ad2eaeb33b565edf739989ee5ba170 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 8 Sep 2026 11:26:26 +0200
Subject: [PATCH 196/202] Revert "deps: enable V8 API interrupt JS check"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 49e26084925d3e177000cc1bcb74b76f8b108f7b.

PR-URL: https://github.com/nodejs/node/pull/65907
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 common.gypi                     | 5 -----
 tools/v8_gypfiles/features.gypi | 6 ------
 2 files changed, 11 deletions(-)

diff --git a/common.gypi b/common.gypi
index ce602beccf66..e6a17d3505a5 100644
--- a/common.gypi
+++ b/common.gypi
@@ -55,8 +55,6 @@
     # Refs: https://github.com/nodejs/node/issues/23167
     # Enable compiler warnings when using V8_DEPRECATED apis from V8 code.
     'v8_deprecation_warnings': 0,
-    # Check that JavaScript execution is disallowed in V8 API interrupts.
-    'v8_disallow_js_in_api_interrupts_is_checked': 1,
     # Enable compiler warnings when using V8_DEPRECATE_SOON apis from V8 code.
     'v8_imminent_deprecation_warnings': 0,
 
@@ -537,9 +535,6 @@
       ['v8_deprecation_warnings == 1', {
         'defines': ['V8_DEPRECATION_WARNINGS',],
       }],
-      ['v8_disallow_js_in_api_interrupts_is_checked == 1', {
-        'defines': ['V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED',],
-      }],
       ['v8_imminent_deprecation_warnings == 1', {
         'defines': ['V8_IMMINENT_DEPRECATION_WARNINGS',],
       }],
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index 9c8c94a17082..d656c7492dec 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -107,9 +107,6 @@
     # Enable compiler warnings when using V8_DEPRECATED apis.
     'v8_deprecation_warnings%': 0,
 
-    # Check that JavaScript execution is disallowed in V8 API interrupts.
-    'v8_disallow_js_in_api_interrupts_is_checked%': 0,
-
     # Enable compiler warnings when using V8_DEPRECATE_SOON apis.
     'v8_imminent_deprecation_warnings%': 0,
 
@@ -420,9 +417,6 @@
       ['v8_deprecation_warnings==1', {
         'defines': ['V8_DEPRECATION_WARNINGS',],
       }],
-      ['v8_disallow_js_in_api_interrupts_is_checked==1', {
-        'defines': ['V8_DISALLOW_JS_IN_API_INTERRUPTS_IS_CHECKED',],
-      }],
       ['v8_imminent_deprecation_warnings==1', {
         'defines': ['V8_IMMINENT_DEPRECATION_WARNINGS',],
       }],

From a28496591e668fc006523947d736a86a1d24f205 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 8 Sep 2026 11:26:27 +0200
Subject: [PATCH 197/202] Revert "inspector: defer JS execution from V8
 interrupts"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 30f4990224486be3502f94202e6c0e706163b315.

PR-URL: https://github.com/nodejs/node/pull/65907
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 src/inspector_agent.cc  | 183 ++++++++++++++++++----------------------
 src/inspector_agent.h   |  18 ++--
 src/inspector_js_api.cc |  46 +++-------
 3 files changed, 102 insertions(+), 145 deletions(-)

diff --git a/src/inspector_agent.cc b/src/inspector_agent.cc
index 83d3398da36b..dcec24c16dba 100644
--- a/src/inspector_agent.cc
+++ b/src/inspector_agent.cc
@@ -79,52 +79,6 @@ static std::atomic_bool start_io_thread_async_initialized { false };
 // Protects the Agent* stored in start_io_thread_async.data.
 static Mutex start_io_thread_async_mutex;
 
-template <typename Defer, typename OnFailure>
-void SyncJavaScriptHookState(Environment* env,
-                             JavaScriptHookState* state,
-                             Local<Function> enable_function,
-                             Local<Function> disable_function,
-                             bool require_bootstrapping,
-                             Defer defer,
-                             OnFailure on_failure) {
-  // The debugger can request an interrupt from within a hook's JS toggle
-  // function. A nested sync only records the new requested state; the
-  // outermost sync sees it when re-checking the loop after each toggle.
-  if (state->syncing) return;
-  state->syncing = true;
-  auto on_exit = OnScopeLeave([state]() { state->syncing = false; });
-
-  Isolate* isolate = env->isolate();
-  while (state->wanted != state->enabled) {
-    // No hook events will be emitted during cleanup, and calling into JS is no
-    // longer possible.
-    // Refs: https://github.com/nodejs/node/pull/34362#discussion_r456006039
-    if (!env->can_call_into_js()) return;
-
-    bool enable = state->wanted;
-    Local<Function> function = enable ? enable_function : disable_function;
-    if (function.IsEmpty()) return;
-
-    if (env->is_processing_v8_interrupt()) {
-      defer();
-      return;
-    }
-
-    if (require_bootstrapping) CHECK(env->has_run_bootstrapping_code());
-    Local<Context> context = env->context();
-    v8::TryCatch try_catch(isolate);
-    USE(function->Call(context, Undefined(isolate), 0, nullptr));
-    if (try_catch.HasCaught()) {
-      // Termination may abort the toggle invocation. Do not record a state that
-      // may not have taken effect, so a later sync can retry it.
-      if (try_catch.HasTerminated()) return;
-      PrintCaughtException(isolate, context, try_catch);
-      on_failure();
-    }
-    state->enabled = enable;
-  }
-}
-
 // Called on the main thread.
 void StartIoThreadAsyncCallback(uv_async_t* handle) {
   static_cast<Agent*>(handle->data)->StartIoThread();
@@ -521,16 +475,6 @@ class SameThreadInspectorSession : public InspectorSession {
 
 void NotifyClusterWorkersDebugEnabled(Environment* env) {
   Isolate* isolate = env->isolate();
-
-  // Starting the inspector from an interrupt is safe, but emitting the cluster
-  // notification calls into JS.
-  if (env->is_processing_v8_interrupt()) {
-    env->SetImmediate(
-        [](Environment* env) { NotifyClusterWorkersDebugEnabled(env); },
-        CallbackFlags::kUnrefed);
-    return;
-  }
-
   HandleScope handle_scope(isolate);
 
   // Send message to enable debug in cluster workers
@@ -1037,40 +981,54 @@ void Agent::SetupNetworkTracking(Local<Function> enable_function,
                                  Local<Function> disable_function) {
   parent_env_->set_inspector_enable_network_tracking(enable_function);
   parent_env_->set_inspector_disable_network_tracking(disable_function);
-  SyncNetworkTrackingState();
+  if (pending_enable_network_tracking) {
+    pending_enable_network_tracking = false;
+    EnableNetworkTracking();
+  } else if (pending_disable_network_tracking) {
+    pending_disable_network_tracking = false;
+    DisableNetworkTracking();
+  }
 }
 
 void Agent::EnableNetworkTracking() {
-  network_tracking_state_.wanted = true;
-  SyncNetworkTrackingState();
+  if (network_tracking_enabled_) {
+    return;
+  }
+  HandleScope scope(parent_env_->isolate());
+  Local<Function> enable = parent_env_->inspector_enable_network_tracking();
+  if (enable.IsEmpty()) {
+    pending_enable_network_tracking = true;
+  } else {
+    ToggleNetworkTracking(parent_env_->isolate(), enable);
+    network_tracking_enabled_ = true;
+  }
 }
 
 void Agent::DisableNetworkTracking() {
-  if (client_->hasConnectedSessions()) return;
-  network_tracking_state_.wanted = false;
-  SyncNetworkTrackingState();
+  if (!network_tracking_enabled_) {
+    return;
+  }
+  HandleScope scope(parent_env_->isolate());
+  Local<Function> disable = parent_env_->inspector_disable_network_tracking();
+  if (disable.IsEmpty()) {
+    pending_disable_network_tracking = true;
+  } else if (!client_->hasConnectedSessions()) {
+    ToggleNetworkTracking(parent_env_->isolate(), disable);
+    network_tracking_enabled_ = false;
+  }
 }
 
-void Agent::SyncNetworkTrackingState() {
-  Isolate* isolate = parent_env_->isolate();
+void Agent::ToggleNetworkTracking(Isolate* isolate, Local<Function> fn) {
+  if (!parent_env_->can_call_into_js()) return;
+  auto context = parent_env_->context();
   HandleScope scope(isolate);
-  SyncJavaScriptHookState(
-      parent_env_,
-      &network_tracking_state_,
-      parent_env_->inspector_enable_network_tracking(),
-      parent_env_->inspector_disable_network_tracking(),
-      false,
-      [this]() {
-        parent_env_->SetImmediate(
-            [](Environment* env) {
-              Agent* agent = env->inspector_agent();
-              if (agent != nullptr) agent->SyncNetworkTrackingState();
-            },
-            CallbackFlags::kUnrefed);
-      },
-      []() {
-        UNREACHABLE("Cannot toggle network tracking, please report this.");
-      });
+  CHECK(!fn.IsEmpty());
+  v8::TryCatch try_catch(isolate);
+  USE(fn->Call(context, Undefined(isolate), 0, nullptr));
+  if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
+    PrintCaughtException(isolate, context, try_catch);
+    UNREACHABLE("Cannot toggle network tracking, please report this.");
+  }
 }
 
 void Agent::WaitForDisconnect() {
@@ -1121,7 +1079,7 @@ void Agent::RegisterAsyncHook(Isolate* isolate,
 }
 
 void Agent::SetAsyncHookTrackingEnabled(bool enabled) {
-  async_hook_state_.wanted = enabled;
+  async_hook_wanted_ = enabled;
   SyncAsyncHookState();
 }
 
@@ -1135,25 +1093,52 @@ void Agent::SetAsyncHookTrackingEnabled(bool enabled) {
 // When it's not safe to call into JS, this is a no-op and we'll try again in
 // RegisterAsyncHook() (for 1) or from a scheduled immediate (for 2).
 void Agent::SyncAsyncHookState() {
+  // The debugger can request an interrupt within the toggle JS function itself,
+  // A nested call only records the new requested state, the outermost call sees
+  // it when re-checking the loop condition after each toggle.
+  if (syncing_async_hook_state_) return;
+  syncing_async_hook_state_ = true;
+  auto on_exit = OnScopeLeave([this]() { syncing_async_hook_state_ = false; });
+
   Isolate* isolate = parent_env_->isolate();
   HandleScope scope(isolate);
-  SyncJavaScriptHookState(
-      parent_env_,
-      &async_hook_state_,
-      parent_env_->inspector_enable_async_hooks(),
-      parent_env_->inspector_disable_async_hooks(),
-      true,
-      [this]() {
-        parent_env_->SetImmediate(
-            [](Environment* env) {
-              Agent* agent = env->inspector_agent();
-              if (agent != nullptr) agent->SyncAsyncHookState();
-            },
-            CallbackFlags::kUnrefed);
-      },
-      []() {
-        UNREACHABLE("Cannot toggle Inspector's AsyncHook, please report this.");
-      });
+  while (async_hook_wanted_ != async_hook_enabled_) {
+    // Guard against running this during cleanup -- no async events will be
+    // emitted anyway at that point anymore, and calling into JS is not
+    // possible. This should probably not be something we're attempting in the
+    // first place,
+    // Refs: https://github.com/nodejs/node/pull/34362#discussion_r456006039
+    if (!parent_env_->can_call_into_js()) return;
+
+    bool enable = async_hook_wanted_;
+    Local<Function> fn = enable ? parent_env_->inspector_enable_async_hooks()
+                                : parent_env_->inspector_disable_async_hooks();
+    if (fn.IsEmpty()) return;
+
+    if (parent_env_->is_processing_v8_interrupt()) {
+      parent_env_->SetImmediate(
+          [](Environment* env) {
+            Agent* agent = env->inspector_agent();
+            if (agent != nullptr) agent->SyncAsyncHookState();
+          },
+          CallbackFlags::kUnrefed);
+      return;
+    }
+
+    CHECK(parent_env_->has_run_bootstrapping_code());
+    Local<Context> context = parent_env_->context();
+    v8::TryCatch try_catch(isolate);
+    USE(fn->Call(context, Undefined(isolate), 0, nullptr));
+    if (try_catch.HasCaught()) {
+      // Termination may abort the toggle invocation, retrying now would just
+      // be terminated again. Instead of recording the toggle that may not have
+      // taken effect, leave the states as-is so that a later sync retries.
+      if (try_catch.HasTerminated()) return;
+      PrintCaughtException(isolate, context, try_catch);
+      UNREACHABLE("Cannot toggle Inspector's AsyncHook, please report this.");
+    }
+    async_hook_enabled_ = enable;
+  }
 }
 
 void Agent::AsyncTaskScheduled(const StringView& task_name, void* task,
diff --git a/src/inspector_agent.h b/src/inspector_agent.h
index 73835d2a4d1d..932e4e8dce89 100644
--- a/src/inspector_agent.h
+++ b/src/inspector_agent.h
@@ -28,12 +28,6 @@ class ParentInspectorHandle;
 class NodeInspectorClient;
 class WorkerManager;
 
-struct JavaScriptHookState {
-  bool wanted = false;
-  bool enabled = false;
-  bool syncing = false;
-};
-
 class InspectorSession {
  public:
   virtual ~InspectorSession() = default;
@@ -138,7 +132,7 @@ class Agent {
 
  private:
   void SyncAsyncHookState();
-  void SyncNetworkTrackingState();
+  void ToggleNetworkTracking(v8::Isolate* isolate, v8::Local<v8::Function> fn);
 
   node::Environment* parent_env_;
   // Encapsulates majority of the Inspector functionality
@@ -158,11 +152,13 @@ class Agent {
   // The state of the async hook used for async stack traces that the protocol
   // last requested, and the state JS currently has. SyncAsyncHookState()
   // reconciles the two when it is possible and safe to call into JS.
-  JavaScriptHookState async_hook_state_;
+  bool async_hook_wanted_ = false;
+  bool async_hook_enabled_ = false;
+  bool syncing_async_hook_state_ = false;
 
-  // Network tracking uses JS hooks. Reconcile the protocol requested and
-  // applied states after leaving a V8 interrupt.
-  JavaScriptHookState network_tracking_state_;
+  bool network_tracking_enabled_ = false;
+  bool pending_enable_network_tracking = false;
+  bool pending_disable_network_tracking = false;
   std::shared_ptr<NetworkResourceManager> network_resource_manager_;
 };
 
diff --git a/src/inspector_js_api.cc b/src/inspector_js_api.cc
index 09f0d7e84ce6..ef1f99d7f38a 100644
--- a/src/inspector_js_api.cc
+++ b/src/inspector_js_api.cc
@@ -60,31 +60,13 @@ struct MainThreadConnection {
 template <typename ConnectionType>
 class JSBindingsConnection : public BaseObject {
  public:
-  struct PendingMicrotask {
-    explicit PendingMicrotask(JSBindingsConnection* connection)
-        : env(connection->env()), connection(connection) {
-      env->AddCleanupHook(Delete, this);
-    }
-
-    static void Delete(void* data) {
-      delete static_cast<PendingMicrotask*>(data);
-    }
-
-    static void Run(void* data) {
-      std::unique_ptr<PendingMicrotask> pending(
-          static_cast<PendingMicrotask*>(data));
-      pending->env->RemoveCleanupHook(Delete, pending.get());
-      pending->connection->FlushPendingMessages();
-    }
-
-    Environment* env;
-    BaseObjectPtr<JSBindingsConnection> connection;
-  };
-
   class JSBindingsSessionDelegate : public InspectorSessionDelegate {
    public:
-    explicit JSBindingsSessionDelegate(JSBindingsConnection* connection)
-        : connection_(connection) {}
+    JSBindingsSessionDelegate(Environment* env,
+                              JSBindingsConnection* connection)
+                              : env_(env),
+                                connection_(connection) {
+    }
 
     void SendMessageToFrontend(const v8_inspector::StringView& message)
         override {
@@ -92,6 +74,7 @@ class JSBindingsConnection : public BaseObject {
     }
 
    private:
+    Environment* env_;
     BaseObjectPtr<JSBindingsConnection> connection_;
   };
 
@@ -101,10 +84,10 @@ class JSBindingsConnection : public BaseObject {
       : BaseObject(env, wrap), callback_(env->isolate(), callback) {
     Agent* inspector = env->inspector_agent();
     session_ = ConnectionType::Connect(
-        inspector, std::make_unique<JSBindingsSessionDelegate>(this));
-    // Inspector responses may be produced from a GC weak callback or a V8
-    // interrupt, where invoking the JavaScript session callback is forbidden.
-    // Defer delivery until it is safe to call into JavaScript.
+        inspector, std::make_unique<JSBindingsSessionDelegate>(env, this));
+    // Inspector responses may be produced from a GC weak callback, where
+    // invoking the JavaScript session callback is forbidden. Defer delivery
+    // until the GC has completed.
     env->isolate()->AddGCPrologueCallback(GCPrologueCallback, this);
     env->isolate()->AddGCEpilogueCallback(GCEpilogueCallback, this);
   }
@@ -115,8 +98,7 @@ class JSBindingsConnection : public BaseObject {
   }
 
   void SendMessageToFrontend(const v8_inspector::StringView& message) {
-    if (in_gc_ || env()->is_processing_v8_interrupt() || delivering_ ||
-        !pending_messages_.empty()) {
+    if (in_gc_ || delivering_ || !pending_messages_.empty()) {
       pending_messages_.emplace_back(
           message.is8Bit()
               ? std::u16string(message.characters8(),
@@ -144,12 +126,6 @@ class JSBindingsConnection : public BaseObject {
   void ScheduleFlush() {
     if (flush_scheduled_ || delivering_) return;
     flush_scheduled_ = true;
-    if (!in_gc_ && env()->is_processing_v8_interrupt()) {
-      auto* pending = new PendingMicrotask(this);
-      env()->context()->GetMicrotaskQueue()->EnqueueMicrotask(
-          env()->isolate(), PendingMicrotask::Run, pending);
-      return;
-    }
     BaseObjectPtr<JSBindingsConnection> strong_ref{this};
     env()->SetImmediate(
         [strong_ref](Environment*) { strong_ref->FlushPendingMessages(); },

From b3fb3440ae64fb56261876cc6cb90770bc0ea843 Mon Sep 17 00:00:00 2001
From: Wiyeong Seo <wiyeong79@gmail.com>
Date: Wed, 9 Sep 2026 17:04:41 +0900
Subject: [PATCH 198/202] path: remove `StringPrototypeCharCodeAt` from some
 methods of `posix`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove `StringPrototypeCharCodeAt` from `posix.resolve`,
`posix.normalize`, `posix.parse`.

PR-URL: https://github.com/nodejs/node/pull/54668
Refs: https://github.com/nodejs/node/pull/54546
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/path.js | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/lib/path.js b/lib/path.js
index 63b037cddfb9..658b5d6901df 100644
--- a/lib/path.js
+++ b/lib/path.js
@@ -1262,8 +1262,7 @@ const posix = {
       }
 
       resolvedPath = `${path}/${resolvedPath}`;
-      resolvedAbsolute =
-        StringPrototypeCharCodeAt(path, 0) === CHAR_FORWARD_SLASH;
+      resolvedAbsolute = path[0] === '/';
     }
 
     if (!resolvedAbsolute) {
@@ -1296,10 +1295,8 @@ const posix = {
     if (path.length === 0)
       return '.';
 
-    const isAbsolute =
-      StringPrototypeCharCodeAt(path, 0) === CHAR_FORWARD_SLASH;
-    const trailingSeparator =
-      StringPrototypeCharCodeAt(path, path.length - 1) === CHAR_FORWARD_SLASH;
+    const isAbsolute = path[0] === '/';
+    const trailingSeparator = path[path.length - 1] === '/';
 
     // Normalize the path
     path = normalizeString(path, !isAbsolute, '/', isPosixPathSeparator);
@@ -1639,8 +1636,8 @@ const posix = {
 
     // Get non-dir info
     for (; i >= start; --i) {
-      const code = StringPrototypeCharCodeAt(path, i);
-      if (code === CHAR_FORWARD_SLASH) {
+      const char = path[i];
+      if (char === '/') {
         // If we reached a path separator that was not part of a set of path
         // separators at the end of the string, stop now
         if (!matchedSlash) {
@@ -1655,7 +1652,7 @@ const posix = {
         matchedSlash = false;
         end = i + 1;
       }
-      if (code === CHAR_DOT) {
+      if (char === '.') {
         // If this is our first dot, mark it as the start of our extension
         if (startDot === -1)
           startDot = i;

From ee51d1344662af852bb4c53b36989721d71ce1ec Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 9 Sep 2026 12:19:49 +0200
Subject: [PATCH 199/202] tools: lint PR commit messages without approval

Use pull_request_target to run commit message linting without fork
workflow approval. Fetch the first commit through the API and pass
its message to a pinned validator as JSON on stdin.

Capture validator output and report failures through escaped
annotations, using only read access to pull requests.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65875
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 .../commit-lint-problem-matcher.json          | 13 -----
 .github/workflows/commit-lint.yml             | 49 +++++++++++++------
 2 files changed, 33 insertions(+), 29 deletions(-)
 delete mode 100644 .github/workflows/commit-lint-problem-matcher.json

diff --git a/.github/workflows/commit-lint-problem-matcher.json b/.github/workflows/commit-lint-problem-matcher.json
deleted file mode 100644
index 72dd13b9e092..000000000000
--- a/.github/workflows/commit-lint-problem-matcher.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "problemMatcher": [
-    {
-      "owner": "core-validate-commit",
-      "pattern": [
-        {
-          "regexp": "^not ok \\d+ (.*)$",
-          "message": 1
-        }
-      ]
-    }
-  ]
-}
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 5537d1e19c65..037ea7e810e0 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -1,7 +1,7 @@
 name: First commit message adheres to guidelines
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
 
@@ -9,27 +9,44 @@ env:
   NODE_VERSION: lts/*
 
 permissions:
-  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   lint-commit-message:
+    name: lint-commit-message
     runs-on: ubuntu-slim
     steps:
-      - name: Compute number of commits in the PR
-        id: nb-of-commits
-        run: |
-          echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
-          echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
-          persist-credentials: false
-      - run: git reset HEAD^2
       - name: Install Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-      - name: Validate commit message
-        run: |
-          echo "::add-matcher::.github/workflows/commit-lint-problem-matcher.json"
-          git rev-parse HEAD~${{ steps.nb-of-commits.outputs.minusOne }} | xargs npx -q core-validate-commit --no-validate-metadata --tap
+      - name: Validate first commit message
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          script: |
+            const { data: [commit] } = await github.rest.pulls.listCommits({
+              ...context.repo,
+              pull_number: context.issue.number,
+              per_page: 1,
+            });
+            if (!commit) {
+              throw new Error('No commits found in pull request');
+            }
+            const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [
+              '-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0',
+              '--no-validate-metadata', '--tap', '-',
+            ], {
+              cwd: process.env.RUNNER_TEMP,
+              input: Buffer.from(JSON.stringify([{ id: commit.sha, message: commit.commit.message }])),
+              silent: true,
+              ignoreReturnCode: true,
+            });
+            if (exitCode !== 0) {
+              core.setFailed(stdout + stderr || 'Commit message validation failed');
+            } else {
+              core.info('First commit message passes validation');
+            }

From fd6682c8713e0f8c348ffb427ad48ce20378b150 Mon Sep 17 00:00:00 2001
From: Filip Skokan <panva.ip@gmail.com>
Date: Wed, 9 Sep 2026 15:57:36 +0200
Subject: [PATCH 200/202] lib: fix shared buffer growability validation

Use the intrinsic growable getter instead of buffer.growable so
shadowed properties cannot bypass validation or reject fixed buffers.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: GitHub Copilot
PR-URL: https://github.com/nodejs/node/pull/65845
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
---
 lib/internal/webidl.js                        | 10 +--
 src/node_util.cc                              | 19 ++++
 .../test-internal-webidl-buffer-source.js     | 88 ++++++++++++++++++-
 typings/internalBinding/util.d.ts             |  1 +
 4 files changed, 111 insertions(+), 7 deletions(-)

diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 128db9b16c74..ee0388b70e97 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -37,6 +37,8 @@ const {
   isTypedArray,
 } = require('internal/util/types');
 
+const { getSharedArrayBufferGrowable } = internalBinding('util');
+
 const BIGINT_2_63 = 1n << 63n;
 const BIGINT_2_64 = 1n << 64n;
 
@@ -946,12 +948,8 @@ function validateBufferSourceBacking(buffer, options) {
 function validateAllowGrowableSharedArrayBuffer(buffer, options) {
   // SharedArrayBuffer and ArrayBufferView conversion step 3:
   // IsFixedLengthArrayBuffer(buffer) must be true without [AllowResizable].
-  // Do not use a primordial getter here. When this module is included in the
-  // startup snapshot, an early-captured SharedArrayBuffer.prototype.growable
-  // getter does not detect growable buffers created after deserialization.
-  // Lazily capturing the getter would work, but it would observe the runtime
-  // prototype at first comparison, so it would not be an actual primordial.
-  if (!options.allowResizable && buffer.growable) {
+  if (!options.allowResizable &&
+      FunctionPrototypeCall(getSharedArrayBufferGrowable, buffer)) {
     throw makeException(
       'is backed by a growable SharedArrayBuffer, which is not allowed.',
       options);
diff --git a/src/node_util.cc b/src/node_util.cc
index ab74b2e8d375..39523bd256c8 100644
--- a/src/node_util.cc
+++ b/src/node_util.cc
@@ -520,6 +520,25 @@ void Initialize(Local<Object> target,
   Environment* env = Environment::GetCurrent(context);
   Isolate* isolate = env->isolate();
 
+  {
+    const Local<Object> prototype =
+        SharedArrayBuffer::New(isolate, 0)->GetPrototypeV2().As<Object>();
+    const Local<Object> descriptor =
+        prototype
+            ->GetOwnPropertyDescriptor(
+                context, FIXED_ONE_BYTE_STRING(isolate, "growable"))
+            .ToLocalChecked()
+            .As<Object>();
+    const Local<Value> getter =
+        descriptor->Get(context, env->get_string()).ToLocalChecked();
+    CHECK(getter->IsFunction());
+    target
+        ->Set(context,
+              FIXED_ONE_BYTE_STRING(isolate, "getSharedArrayBufferGrowable"),
+              getter)
+        .Check();
+  }
+
   {
     Local<ObjectTemplate> tmpl = ObjectTemplate::New(isolate);
 #define V(PropertyName, _)                                                     \
diff --git a/test/parallel/test-internal-webidl-buffer-source.js b/test/parallel/test-internal-webidl-buffer-source.js
index 9e522d7d7b8a..8e81f42a9456 100644
--- a/test/parallel/test-internal-webidl-buffer-source.js
+++ b/test/parallel/test-internal-webidl-buffer-source.js
@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const { test } = require('node:test');
 const vm = require('vm');
@@ -272,6 +272,92 @@ test('AllowSharedBufferSource handles growable shared buffers with explicit ' +
   }
 });
 
+test('Shared buffer growability checks do not read JavaScript properties', () => {
+  for (const [buffer, growable] of [
+    [new SharedArrayBuffer(8), false],
+    [new SharedArrayBuffer(8, { maxByteLength: 8 }), true],
+    [new SharedArrayBuffer(8, { maxByteLength: 16 }), true],
+    [vm.runInNewContext('new SharedArrayBuffer(8)'), false],
+    [vm.runInNewContext('new SharedArrayBuffer(8, { maxByteLength: 16 })'), true],
+  ]) {
+    const view = new Uint8Array(buffer);
+    const dataView = new DataView(buffer);
+    for (const mode of ['shadow', 'getter', 'prototype']) {
+      if (mode === 'shadow') {
+        Object.defineProperty(buffer, 'growable', {
+          value: !growable,
+          configurable: true,
+        });
+      } else if (mode === 'getter') {
+        Object.defineProperty(buffer, 'growable', {
+          get: common.mustNotCall('Unexpected growable getter'),
+          configurable: true,
+        });
+      } else {
+        delete buffer.growable;
+        Object.setPrototypeOf(buffer, null);
+      }
+
+      for (const value of [buffer, view, dataView]) {
+        if (growable) {
+          assert.throws(() => converters.AllowSharedBufferSource(value), {
+            code: 'ERR_INVALID_ARG_TYPE',
+          });
+        } else {
+          assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+        }
+        assert.strictEqual(converters.AllowSharedBufferSource(value, {
+          allowResizable: true,
+        }), value);
+      }
+
+      if (growable) {
+        assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+      }
+      assert.strictEqual(converters.Uint8Array(view, {
+        allowShared: true,
+        allowResizable: true,
+      }), view);
+    }
+  }
+});
+
+test('Shared WebAssembly buffer growability is checked per buffer', {
+  skip: typeof WebAssembly === 'undefined',
+}, () => {
+  const memory = new WebAssembly.Memory({ initial: 1, maximum: 2, shared: true });
+  for (const [buffer, growable] of [
+    [memory.buffer, false],
+    [memory.toResizableBuffer(), true],
+    [memory.toFixedLengthBuffer(), false],
+  ]) {
+    for (const value of [buffer, new Uint8Array(buffer), new DataView(buffer)]) {
+      if (growable) {
+        assert.throws(() => converters.AllowSharedBufferSource(value), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+      }
+      assert.strictEqual(converters.AllowSharedBufferSource(value, {
+        allowResizable: true,
+      }), value);
+    }
+    const view = new Uint8Array(buffer);
+    if (growable) {
+      assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+        code: 'ERR_INVALID_ARG_TYPE',
+      });
+    } else {
+      assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+    }
+  }
+});
+
 test('BufferSource rejects objects with a forged @@toStringTag', () => {
   const fake = { [Symbol.toStringTag]: 'Uint8Array' };
   assert.throws(
diff --git a/typings/internalBinding/util.d.ts b/typings/internalBinding/util.d.ts
index a3026b5a0305..4c3eeca8ed82 100644
--- a/typings/internalBinding/util.d.ts
+++ b/typings/internalBinding/util.d.ts
@@ -47,6 +47,7 @@ export interface UtilBinding {
   styleText(format: Array<string> | string, text: string): string;
   isInsideNodeModules(frameLimit?: number): boolean;
   constructSharedArrayBuffer(length?: number): SharedArrayBuffer;
+  getSharedArrayBufferGrowable(this: SharedArrayBuffer): boolean;
 
   constants: {
     kPending: 0;

From 7ac314f06cd96f6aaea0b0df273b80b83b7be059 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 8 Sep 2026 22:22:17 +0200
Subject: [PATCH 201/202] 2026-09-09, Version 26.8.2 (Current)

Notable changes:

doc:
  * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) https://github.com/nodejs/node/pull/65593
deps:
  * update Undici to 8.10.2 https://github.com/nodejs/node/pull/65788
  * update OpenSSL to 3.5.8 https://github.com/nodejs/node/pull/65542
meta:
  * refine the security vuln posture for experimental features (James M Snell) https://github.com/nodejs/node/pull/65438

PR-URL: https://github.com/nodejs/node/pull/65917
---
 CHANGELOG.md                    |  3 +-
 doc/api/deprecations.md         |  4 +-
 doc/api/tls.md                  |  2 +-
 doc/changelogs/CHANGELOG_V26.md | 91 +++++++++++++++++++++++++++++++++
 4 files changed, 96 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index df831a89bc5a..b23a413ec223 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.2">26.8.2</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.6.0">26.6.0</a><br/>
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index e63ea5f35957..5179f0bc5420 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4709,7 +4709,7 @@ successfully before the response closed.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v26.8.2
     pr-url: https://github.com/nodejs/node/pull/64794
     description: Runtime deprecation.
 -->
@@ -4726,7 +4726,7 @@ calling or overriding `_listen2`.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v26.8.2
     pr-url: https://github.com/nodejs/node/pull/64342
     description: Documentation-only deprecation.
 -->
diff --git a/doc/api/tls.md b/doc/api/tls.md
index c8e12eaacf62..7df2ab938606 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -1095,7 +1095,7 @@ property is set only when `tlsSocket.authorized === false`.
 <!-- YAML
 added: v0.11.4
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64677
     description: On TLS 1.3, a resumed session where the client presented no
                  certificate is no longer reported as authorized.
diff --git a/doc/changelogs/CHANGELOG_V26.md b/doc/changelogs/CHANGELOG_V26.md
index d88306ed1b34..11c30aeef58b 100644
--- a/doc/changelogs/CHANGELOG_V26.md
+++ b/doc/changelogs/CHANGELOG_V26.md
@@ -8,6 +8,7 @@
 </tr>
 <tr>
 <td>
+<a href="#26.8.2">26.8.2</a><br/>
 <a href="#26.8.1">26.8.1</a><br/>
 <a href="#26.8.0">26.8.0</a><br/>
 <a href="#26.7.0">26.7.0</a><br/>
@@ -52,6 +53,96 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="26.8.2"></a>
+
+## 2026-09-09, Version 26.8.2 (Current), @aduh95
+
+### Notable Changes
+
+* \[[`616bd3fa26`](https://github.com/nodejs/node/commit/616bd3fa26)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`ae1801eb55`](https://github.com/nodejs/node/commit/ae1801eb55)] - **meta**: refine the security vuln posture for experimental features (James M Snell) [#65438](https://github.com/nodejs/node/pull/65438)
+* \[[`09feba74c8`](https://github.com/nodejs/node/commit/09feba74c8)] - **deps**: update Undici to 8.10.2 (Node.js GitHub Bot) [#65788](https://github.com/nodejs/node/pull/65788)
+* \[[`7efdbe3eb9`](https://github.com/nodejs/node/commit/7efdbe3eb9)] - **deps**: update OpenSSL to 3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+
+### Commits
+
+* \[[`d8aedd6584`](https://github.com/nodejs/node/commit/d8aedd6584)] - **build**: skip dockit on riscv64 (Stewart X Addison) [#62251](https://github.com/nodejs/node/pull/62251)
+* \[[`1899c274eb`](https://github.com/nodejs/node/commit/1899c274eb)] - **build**: activate correct default flags for riscv64 (Stewart X Addison) [#65708](https://github.com/nodejs/node/pull/65708)
+* \[[`ec8a3be996`](https://github.com/nodejs/node/commit/ec8a3be996)] - **build**: derive NODE\_ARCH from target\_cpu in the GN build (Shelley Vohr) [#65491](https://github.com/nodejs/node/pull/65491)
+* \[[`b73118a507`](https://github.com/nodejs/node/commit/b73118a507)] - **build,win**: remove LTO parallelisation limit (Stefan Stojanovic) [#65535](https://github.com/nodejs/node/pull/65535)
+* \[[`09feba74c8`](https://github.com/nodejs/node/commit/09feba74c8)] - **deps**: update undici to 8.10.2 (Node.js GitHub Bot) [#65788](https://github.com/nodejs/node/pull/65788)
+* \[[`e47c432dd6`](https://github.com/nodejs/node/commit/e47c432dd6)] - **deps**: upgrade npm to 11.19.1 (npm team) [#65573](https://github.com/nodejs/node/pull/65573)
+* \[[`2fd6ce36a9`](https://github.com/nodejs/node/commit/2fd6ce36a9)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`49dec2767a`](https://github.com/nodejs/node/commit/49dec2767a)] - **deps**: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) [#65654](https://github.com/nodejs/node/pull/65654)
+* \[[`676174a071`](https://github.com/nodejs/node/commit/676174a071)] - **deps**: update simdjson to 4.6.9 (Node.js GitHub Bot) [#65655](https://github.com/nodejs/node/pull/65655)
+* \[[`2f1b7fa0bb`](https://github.com/nodejs/node/commit/2f1b7fa0bb)] - **deps**: update perfetto to 58.2 (Node.js GitHub Bot) [#65656](https://github.com/nodejs/node/pull/65656)
+* \[[`12acd0ad15`](https://github.com/nodejs/node/commit/12acd0ad15)] - **deps**: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) [#65494](https://github.com/nodejs/node/pull/65494)
+* \[[`48631c80fb`](https://github.com/nodejs/node/commit/48631c80fb)] - **deps**: update archs files for openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`7efdbe3eb9`](https://github.com/nodejs/node/commit/7efdbe3eb9)] - **deps**: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`bdc75900ee`](https://github.com/nodejs/node/commit/bdc75900ee)] - **doc**: replace `node:modules` documentation header (René) [#65800](https://github.com/nodejs/node/pull/65800)
+* \[[`44c8a499ba`](https://github.com/nodejs/node/commit/44c8a499ba)] - **doc**: clarify return type of `fs.mkdtemp*` (Antoine du Hamel) [#65743](https://github.com/nodejs/node/pull/65743)
+* \[[`025fb5eeb0`](https://github.com/nodejs/node/commit/025fb5eeb0)] - **doc**: update `changelog-maker` instructions for releasing (Juan José) [#65707](https://github.com/nodejs/node/pull/65707)
+* \[[`5f64847afa`](https://github.com/nodejs/node/commit/5f64847afa)] - **doc**: add stability status to `crypto.setEngine` (Antoine du Hamel) [#65746](https://github.com/nodejs/node/pull/65746)
+* \[[`299dee0cb9`](https://github.com/nodejs/node/commit/299dee0cb9)] - **doc**: remove outdated TLS authorized warning (Tim Perry) [#65597](https://github.com/nodejs/node/pull/65597)
+* \[[`e97dcc0278`](https://github.com/nodejs/node/commit/e97dcc0278)] - **doc**: fix broken `using` link in ffi.md (Soul Lee) [#65632](https://github.com/nodejs/node/pull/65632)
+* \[[`2c9cc7d237`](https://github.com/nodejs/node/commit/2c9cc7d237)] - **doc**: fix some broken links (Antoine du Hamel) [#65583](https://github.com/nodejs/node/pull/65583)
+* \[[`0c330ec329`](https://github.com/nodejs/node/commit/0c330ec329)] - **doc**: fix stale TOC in maintaining-dependencies (greenhead) [#65523](https://github.com/nodejs/node/pull/65523)
+* \[[`9c522a3a69`](https://github.com/nodejs/node/commit/9c522a3a69)] - **doc**: refactor the AI guidelines (Joyee Cheung) [#65269](https://github.com/nodejs/node/pull/65269)
+* \[[`46cbf1bf8c`](https://github.com/nodejs/node/commit/46cbf1bf8c)] - **doc**: fix triggerAsyncId() comment in async\_hooks example (soreavis) [#64583](https://github.com/nodejs/node/pull/64583)
+* \[[`788904ff78`](https://github.com/nodejs/node/commit/788904ff78)] - **doc**: fix fsPromises.watch overflow value (Matt Radbourne) [#64605](https://github.com/nodejs/node/pull/64605)
+* \[[`3d06ff19e8`](https://github.com/nodejs/node/commit/3d06ff19e8)] - **doc**: clarify stream direction in options.stdio note (Avocado) [#65236](https://github.com/nodejs/node/pull/65236)
+* \[[`d334838379`](https://github.com/nodejs/node/commit/d334838379)] - **doc**: clarify signal listener behavior (Som Samantray) [#65243](https://github.com/nodejs/node/pull/65243)
+* \[[`d55a2bd56a`](https://github.com/nodejs/node/commit/d55a2bd56a)] - **doc**: add test reporter event lifecycle diagram (sangwook) [#63780](https://github.com/nodejs/node/pull/63780)
+* \[[`c17dfc87de`](https://github.com/nodejs/node/commit/c17dfc87de)] - **doc**: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) [#64342](https://github.com/nodejs/node/pull/64342)
+* \[[`616bd3fa26`](https://github.com/nodejs/node/commit/616bd3fa26)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`4e6d7e0ca6`](https://github.com/nodejs/node/commit/4e6d7e0ca6)] - **meta**: cleanup targos emeritus changes (Antoine du Hamel) [#65738](https://github.com/nodejs/node/pull/65738)
+* \[[`a70cfe1747`](https://github.com/nodejs/node/commit/a70cfe1747)] - **meta**: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65714](https://github.com/nodejs/node/pull/65714)
+* \[[`e43a0ad4ce`](https://github.com/nodejs/node/commit/e43a0ad4ce)] - **meta**: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65717](https://github.com/nodejs/node/pull/65717)
+* \[[`99e06288f1`](https://github.com/nodejs/node/commit/99e06288f1)] - **meta**: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot\[bot]) [#65718](https://github.com/nodejs/node/pull/65718)
+* \[[`89662762b3`](https://github.com/nodejs/node/commit/89662762b3)] - **meta**: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot\[bot]) [#65719](https://github.com/nodejs/node/pull/65719)
+* \[[`6b8f078672`](https://github.com/nodejs/node/commit/6b8f078672)] - **meta**: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot\[bot]) [#65720](https://github.com/nodejs/node/pull/65720)
+* \[[`6c6fb18e63`](https://github.com/nodejs/node/commit/6c6fb18e63)] - **meta**: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot\[bot]) [#65721](https://github.com/nodejs/node/pull/65721)
+* \[[`0e002e859f`](https://github.com/nodejs/node/commit/0e002e859f)] - **meta**: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65722](https://github.com/nodejs/node/pull/65722)
+* \[[`98aaffe4b9`](https://github.com/nodejs/node/commit/98aaffe4b9)] - **meta**: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65723](https://github.com/nodejs/node/pull/65723)
+* \[[`d247cb2975`](https://github.com/nodejs/node/commit/d247cb2975)] - **meta**: document collaborator automation (Filip Skokan) [#65671](https://github.com/nodejs/node/pull/65671)
+* \[[`ae1801eb55`](https://github.com/nodejs/node/commit/ae1801eb55)] - **meta**: refine the security vuln posture for experimental features (James M Snell) [#65438](https://github.com/nodejs/node/pull/65438)
+* \[[`fab81d15c3`](https://github.com/nodejs/node/commit/fab81d15c3)] - **test**: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`62e2a6265c`](https://github.com/nodejs/node/commit/62e2a6265c)] - **test**: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`7eb20b1810`](https://github.com/nodejs/node/commit/7eb20b1810)] - **test**: only count restarts after the write in watch emit-restarted test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`14c3a77bc5`](https://github.com/nodejs/node/commit/14c3a77bc5)] - **test**: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`ebc99e0560`](https://github.com/nodejs/node/commit/ebc99e0560)] - **test**: handle EPIPE in closed channel test (Christian Aurich) [#65770](https://github.com/nodejs/node/pull/65770)
+* \[[`5e73a2ca79`](https://github.com/nodejs/node/commit/5e73a2ca79)] - **test**: deflake test-permission-net-udp-handle (Christian Aurich) [#65767](https://github.com/nodejs/node/pull/65767)
+* \[[`beb669f7de`](https://github.com/nodejs/node/commit/beb669f7de)] - **test**: deflake test-runner-coverage (Christian Aurich) [#65728](https://github.com/nodejs/node/pull/65728)
+* \[[`ef4b6bfa62`](https://github.com/nodejs/node/commit/ef4b6bfa62)] - **test**: set type=none on IBM i for empty source (Abdirahim Musse) [#65545](https://github.com/nodejs/node/pull/65545)
+* \[[`027eef0691`](https://github.com/nodejs/node/commit/027eef0691)] - **test**: deflake WASI poll timing checks (Filip Skokan) [#65672](https://github.com/nodejs/node/pull/65672)
+* \[[`a352b0e2fe`](https://github.com/nodejs/node/commit/a352b0e2fe)] - **test**: skip `fs-watch-recursive-delete-race` on AIX (Antoine du Hamel) [#65698](https://github.com/nodejs/node/pull/65698)
+* \[[`f9ce35aa43`](https://github.com/nodejs/node/commit/f9ce35aa43)] - **test**: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) [#65584](https://github.com/nodejs/node/pull/65584)
+* \[[`32281cec7b`](https://github.com/nodejs/node/commit/32281cec7b)] - **test**: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) [#65623](https://github.com/nodejs/node/pull/65623)
+* \[[`79be5d61be`](https://github.com/nodejs/node/commit/79be5d61be)] - **test**: avoid orphaned child on Windows abort test (Kirill Saied) [#65451](https://github.com/nodejs/node/pull/65451)
+* \[[`8972b8540b`](https://github.com/nodejs/node/commit/8972b8540b)] - **test**: fix link-local dgram scope assertion (Filip Skokan) [#65629](https://github.com/nodejs/node/pull/65629)
+* \[[`b7cd1d96de`](https://github.com/nodejs/node/commit/b7cd1d96de)] - **test**: riscv64: skip node-api sea test (Stewart X Addison) [#65569](https://github.com/nodejs/node/pull/65569)
+* \[[`7eeb9d0e57`](https://github.com/nodejs/node/commit/7eeb9d0e57)] - **test**: mark platform-specific tests as flaky (Filip Skokan) [#65562](https://github.com/nodejs/node/pull/65562)
+* \[[`649ac82bda`](https://github.com/nodejs/node/commit/649ac82bda)] - **test**: account for varied OpenSSL CCM final behaviours (Filip Skokan) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`050fb1a15d`](https://github.com/nodejs/node/commit/050fb1a15d)] - **tools**: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot\[bot]) [#65757](https://github.com/nodejs/node/pull/65757)
+* \[[`5314dda396`](https://github.com/nodejs/node/commit/5314dda396)] - **tools**: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot\[bot]) [#65758](https://github.com/nodejs/node/pull/65758)
+* \[[`5938a08929`](https://github.com/nodejs/node/commit/5938a08929)] - **tools**: do not hardcode `yamllint` path (Antoine du Hamel) [#65747](https://github.com/nodejs/node/pull/65747)
+* \[[`d8408f7415`](https://github.com/nodejs/node/commit/d8408f7415)] - **tools**: refine contributor guidance workflow (Filip Skokan) [#65745](https://github.com/nodejs/node/pull/65745)
+* \[[`196e372b69`](https://github.com/nodejs/node/commit/196e372b69)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#65716](https://github.com/nodejs/node/pull/65716)
+* \[[`7e986b09f6`](https://github.com/nodejs/node/commit/7e986b09f6)] - **tools**: do not flag force push as invalid message (Antoine du Hamel) [#65700](https://github.com/nodejs/node/pull/65700)
+* \[[`837ce2ccef`](https://github.com/nodejs/node/commit/837ce2ccef)] - **tools**: do not hardcode path to Ruff (Antoine du Hamel) [#65681](https://github.com/nodejs/node/pull/65681)
+* \[[`1c7149a96a`](https://github.com/nodejs/node/commit/1c7149a96a)] - **tools**: retry first-time contributor query (Filip Skokan) [#65648](https://github.com/nodejs/node/pull/65648)
+* \[[`bd310a2bea`](https://github.com/nodejs/node/commit/bd310a2bea)] - **tools**: query first-time contributor status (Filip Skokan) [#65592](https://github.com/nodejs/node/pull/65592)
+* \[[`ab7b57e547`](https://github.com/nodejs/node/commit/ab7b57e547)] - **tools**: offset GitHub crons by 3 minutes (Michaël Zasso) [#65612](https://github.com/nodejs/node/pull/65612)
+* \[[`62ece28eae`](https://github.com/nodejs/node/commit/62ece28eae)] - **tools**: label PRs lacking second approval (Filip Skokan) [#65538](https://github.com/nodejs/node/pull/65538)
+* \[[`68227b4029`](https://github.com/nodejs/node/commit/68227b4029)] - **tools**: welcome first-time contributors (Filip Skokan) [#65533](https://github.com/nodejs/node/pull/65533)
+* \[[`490dc93e37`](https://github.com/nodejs/node/commit/490dc93e37)] - **tools**: enable concurrency for eslint (Huáng Jùnliàng) [#62352](https://github.com/nodejs/node/pull/62352)
+* \[[`d794676217`](https://github.com/nodejs/node/commit/d794676217)] - **typings**: fix fs\_event\_wrap start filename type (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`29e2b5a325`](https://github.com/nodejs/node/commit/29e2b5a325)] - **typings**: add fs\_event\_wrap internal binding types (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`6357c8f56e`](https://github.com/nodejs/node/commit/6357c8f56e)] - **typings**: add stream\_pipe internal binding types (Seongeun Lee) [#65664](https://github.com/nodejs/node/pull/65664)
+* \[[`569720ac7f`](https://github.com/nodejs/node/commit/569720ac7f)] - **typings**: add profiler internal binding types (Seongeun Lee) [#65660](https://github.com/nodejs/node/pull/65660)
+* \[[`52ae89c69d`](https://github.com/nodejs/node/commit/52ae89c69d)] - **typings**: add ffi internal binding types (Donghoon Kang) [#65734](https://github.com/nodejs/node/pull/65734)
+* \[[`22c7469062`](https://github.com/nodejs/node/commit/22c7469062)] - **typings**: update zlib binding declarations (이혜미) [#65639](https://github.com/nodejs/node/pull/65639)
+
 <a id="26.8.1"></a>
 
 ## 2026-08-26, Version 26.8.1 (Current), @aduh95

From fb4f75956934d67f975b52ad8da567b7fd37b0dc Mon Sep 17 00:00:00 2001
From: Christopher Buss <christopher.buss+github@protonmail.com>
Date: Wed, 9 Sep 2026 21:24:46 +0100
Subject: [PATCH 202/202] doc: document windowsHide for child_process.fork

Describe the existing windowsHide option and its false default alongside
the other fork options, using the wording already documented for spawn.

Refs: https://github.com/DefinitelyTyped/DefinitelyTyped/pull/75525
Signed-off-by: christopher-buss <christopher.buss+github@protonmail.com>
Assisted-by: Codex
Co-authored-by: Codex <noreply@openai.com>
PR-URL: https://github.com/nodejs/node/pull/65887
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 doc/api/child_process.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index bdf7d1f98b40..e06f88af3a5f 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -561,6 +561,8 @@ changes:
     is used, it must contain exactly one item with value `'ipc'` or an error
     will be thrown. For instance `[0, 1, 2, 'ipc']`.
   * `uid` {number} Sets the user identity of the process (see setuid(2)).
+  * `windowsHide` {boolean} Hide the subprocess console window that would
+    normally be created on Windows systems. **Default:** `false`.
   * `windowsVerbatimArguments` {boolean} No quoting or escaping of arguments is
     done on Windows. Ignored on Unix. **Default:** `false`.
   * `timeout` {number} In milliseconds the maximum amount of time the process